Abnormal traffic detection method, device, equipment, storage medium and program product

Abstract

The application provides an abnormal traffic detection method, device, equipment, storage medium and program product. The method comprises the following steps: obtaining a traffic data set to be detected in a preset unit time period and performing aggregation processing to obtain a plurality of feature space data; wherein the traffic data set comprises a plurality of network traffic data; extracting the features of each aggregated traffic data to obtain corresponding feature vector data; calculating the density information of each feature vector data and the relative deviation information of the feature space data; and comprehensively determining whether there is abnormal traffic in the unit time period based on the density information of the feature vector data and the relative deviation information of the feature space data. The method improves the timeliness and accuracy of abnormal traffic detection.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method, apparatus, device, storage medium, and program product for detecting abnormal traffic. Background Technology

[0002] In today's increasingly complex network environment, port forwarding, as a common network configuration method, is widely used in enterprise internal networks, cloud computing services, and various Internet application scenarios to enable internal and external network communication, overcome network barriers, or optimize network resource access paths. However, this convenience also brings new challenges to network security, especially when port forwarding becomes a potential channel for abnormal traffic. Therefore, abnormal traffic detection related to port forwarding becomes crucial.

[0003] Currently, identifying and protecting against abnormal traffic requires building a multi-layered defense system, including firewall policies at the network entry point, application-layer access control, and the deployment of specialized traffic monitoring and analysis tools. However, both the construction of this multi-layered defense system and the detection of abnormal traffic require human intervention.

[0004] However, existing methods for detecting abnormal traffic require a significant investment of manpower and cannot identify abnormal traffic in a timely manner. Summary of the Invention

[0005] This application provides a method for detecting abnormal traffic, which solves the problem in the prior art that abnormal traffic relies on manual detection and cannot be identified in a timely manner.

[0006] Firstly, this application provides a method for detecting abnormal traffic, comprising:

[0007] Obtain the traffic dataset to be detected, which includes multiple network traffic data.

[0008] Based on a preset time period, network traffic data is aggregated to obtain multiple feature space data.

[0009] Extract the features of each aggregated traffic data to obtain the corresponding feature vector data;

[0010] Calculate the density information of each feature vector data, and based on the density information, determine whether there is a first traffic anomaly in the unit time period corresponding to the feature vector data;

[0011] Calculate the relative deviation information of the feature space data, and based on the relative deviation information, determine whether there is a second traffic anomaly in the unit time period corresponding to the feature space data;

[0012] If there is a first traffic anomaly and a second traffic anomaly within a unit time period corresponding to the feature vector data, then it is determined that there is abnormal traffic within the unit time period.

[0013] In one possible implementation, the density information of each feature vector data is calculated, including:

[0014] For each feature vector data, a corresponding local domain is constructed based on a preset neighborhood radius, and feature vector data whose distance from the feature vector data is less than or equal to the preset neighborhood radius are identified as neighbor points;

[0015] The density value of the feature vector data is determined by the ratio of the number of neighboring points of the feature vector data to the area of ​​the local domain of the feature vector data.

[0016] In one possible implementation, based on density information, determining whether there is a first traffic anomaly within a unit time period corresponding to the feature vector data includes:

[0017] Calculate the average density value based on the density values ​​of all feature vector data;

[0018] If the density value of the feature vector data is greater than the average density value, then the density value of the feature vector data is compared with the preset deviation threshold.

[0019] If the density value of the feature vector data is greater than the preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data.

[0020] In one possible implementation, the preset deviation threshold includes a first type of preset deviation threshold, a second type of preset deviation threshold, and a third type of preset deviation threshold;

[0021] Accordingly, if the density value of the feature vector data is greater than a preset deviation threshold, then it is determined that there is a first traffic anomaly within the unit time period corresponding to the feature vector data, including:

[0022] If the density value of the feature vector data is less than or equal to the first type of preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the first type of anomaly.

[0023] If the density value of the feature vector data is less than or equal to the second type of preset deviation threshold and greater than the first type of preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the second type of anomaly.

[0024] If the density value of the feature vector data is greater than the third type of preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the third type of anomaly.

[0025] In one possible implementation, calculating the relative deviation information of the feature space data includes:

[0026] The relative deviation of the feature space data is calculated using a simplified exponential smoothing formula.

[0027] In one possible implementation, based on relative deviation information, determining whether a second traffic anomaly exists within a unit time period corresponding to the feature space data includes:

[0028] If the relative deviation value is greater than the preset relative deviation threshold, it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data.

[0029] In one possible implementation, the preset relative deviation threshold includes a first preset relative deviation threshold, a second preset relative deviation threshold, and a third preset relative deviation threshold;

[0030] Accordingly, if the relative deviation value is greater than a preset relative deviation threshold, it is determined that a second traffic anomaly exists within the unit time period corresponding to the feature space data, including:

[0031] If the relative deviation value is less than or equal to the first preset relative deviation threshold, then it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the fourth type of anomaly.

[0032] If the relative deviation value is greater than the first preset relative deviation threshold and less than or equal to the second preset relative deviation threshold, then it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the fifth type of anomaly.

[0033] If the relative deviation value is greater than the third preset relative deviation threshold, it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the sixth type of anomaly.

[0034] In one possible implementation, after determining that abnormal traffic exists within a unit time period if both a first traffic anomaly and a second traffic anomaly exist, the method further includes:

[0035] Based on the feature space data and / or feature vector data of a unit time period, generate and send alarm information.

[0036] Secondly, this application provides an abnormal flow detection device, comprising:

[0037] The acquisition module is used to acquire the traffic dataset to be detected, which includes multiple network traffic data.

[0038] The aggregation module is used to aggregate network traffic data according to a preset unit time period to obtain multiple feature space data.

[0039] The extraction module is used to extract the features of each aggregated traffic data to obtain the corresponding feature vector data;

[0040] The first calculation module is used to calculate the density information of each feature vector data, and based on the density information, to determine whether there is a first traffic anomaly in the unit time period corresponding to the feature vector data.

[0041] The second calculation module is used to calculate the relative deviation information of the feature space data, and based on the relative deviation information, to determine whether there is a second traffic anomaly in the unit time period corresponding to the feature space data.

[0042] The determination module is used to determine that there is abnormal traffic within a unit time period if there is a first traffic anomaly and a second traffic anomaly within a unit time period corresponding to the feature vector data.

[0043] Thirdly, this application provides an abnormal traffic detection device, comprising:

[0044] At least one processor;

[0045] and a memory communicatively connected to at least one processor; wherein,

[0046] The memory stores instructions that can be executed by at least one processor to enable the at least one processor to perform the first aspect or various possible implementations of the first aspect as described above.

[0047] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect or various possible implementations of the first aspect.

[0048] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect or various possible implementations of the first aspect.

[0049] This application provides a method, apparatus, device, storage medium, and program product for detecting abnormal traffic. It aggregates a traffic dataset within a preset unit time period to obtain multiple feature space data. The traffic dataset includes multiple network traffic data points. Features are extracted from each aggregated traffic data point to obtain corresponding feature vector data. Density information is calculated for each feature vector data point, and based on this density information, it is determined whether a first traffic anomaly exists within the corresponding unit time period. Relative deviation information of the feature space data is calculated, and based on this relative deviation information, it is determined whether a second traffic anomaly exists within the corresponding unit time period. If both a first and second traffic anomaly exist within the corresponding unit time period, then abnormal traffic is confirmed to exist within that unit time period. Compared to existing technologies that rely on manual detection of abnormal traffic, this application determines the existence of abnormal traffic within a unit time period by aggregating a traffic dataset containing multiple network traffic data points, extracting features, calculating the density information of each feature vector, and calculating the relative deviation information of the feature space data. This reduces manual operation, lowers the detection cost of abnormal traffic, and allows for timely detection of abnormal traffic, thereby improving the detection efficiency. Attached Figure Description

[0050] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0051] Figure 1 A schematic diagram of an abnormal traffic detection system architecture provided in an embodiment of this application;

[0052] Figure 2 A flowchart illustrating an abnormal traffic detection method provided in an embodiment of this application;

[0053] Figure 3 A flowchart illustrating an abnormal traffic detection method provided in an embodiment of this application;

[0054] Figure 4 A flowchart illustrating an abnormal traffic detection method provided in an embodiment of this application;

[0055] Figure 5 A flowchart illustrating an abnormal traffic detection method provided in an embodiment of this application;

[0056] Figure 6 A flowchart illustrating an abnormal traffic detection method provided in an embodiment of this application;

[0057] Figure 7 A schematic diagram of the structure of an abnormal flow detection device provided in an embodiment of this application;

[0058] Figure 8 This is a schematic diagram of the abnormal flow detection device provided in an embodiment of this application.

[0059] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0060] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0061] It should be noted that the data involved in this application (including but not limited to data used for analysis, data stored, data displayed, etc.) are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0062] In the current network environment, port forwarding is an important channel for internal and external network communication, crossing network barriers, or optimizing network resource access paths. However, it is also a potential channel for abnormal traffic. Therefore, in order to ensure network security, it is necessary to detect abnormal traffic in port forwarding.

[0063] In existing technologies, the identification and protection against abnormal traffic relies on manually constructing a multi-layered defense system to detect it. However, this method of abnormal traffic detection requires a significant investment of manpower and cannot identify abnormal traffic in a timely manner, resulting in low detection efficiency.

[0064] Therefore, existing technologies suffer from the problem of untimely abnormal traffic detection, resulting in low detection efficiency.

[0065] To address the aforementioned issues, the inventors discovered during traffic detection in port forwarding that a sudden surge in similar traffic within a given timeframe may indicate abnormal traffic. Relying solely on manual detection of this abnormal traffic can lead to delays and network security problems. Therefore, the inventors considered whether it's possible to automatically detect abnormal traffic by aggregating and extracting features from traffic datasets to obtain feature vectors, and then calculating the density of these feature vectors and the relative deviation of the feature space data. This would improve the timeliness and efficiency of abnormal traffic detection. Based on this, this application proposes an abnormal traffic detection method to enhance the timeliness and efficiency of abnormal traffic detection.

[0066] Optional, Figure 1 This is a schematic diagram of an abnormal traffic detection system architecture provided in an embodiment of this application. The abnormal traffic detection system is a computer device. Figure 1 In this framework, at least one of a data acquisition device 101, a processing device 102, and a display device 103 is included.

[0067] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the architecture of an abnormal traffic detection system. In other feasible embodiments of this application, the above architecture may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown can be implemented in hardware, software, or a combination of both.

[0068] In the specific implementation process, the data acquisition device 101 may include an input / output interface or a communication interface, and the data acquisition device 101 can be connected to the processing device through the input / output interface or the communication interface.

[0069] The processing device 102 can aggregate and extract features from the traffic dataset to obtain feature vectors, and calculate the density of each feature vector and the relative deviation information of the feature space data. Based on the density of each feature vector and the relative deviation information of the feature space data, it can automatically detect abnormal traffic.

[0070] The display device 103 can also be a touch screen or the screen of a terminal device, used to receive user commands while displaying the above-mentioned content, so as to realize interaction with the user.

[0071] It should be understood that the aforementioned processing device can be implemented by a processor reading instructions from memory and executing those instructions, or it can be implemented by a chip circuit.

[0072] Furthermore, the network architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0073] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0074] Figure 2 A flowchart illustrating an abnormal traffic detection method provided in this application embodiment is shown below. Figure 2 As shown, the method includes:

[0075] S201. Obtain the traffic dataset to be detected, which includes multiple network traffic data.

[0076] In this embodiment, the traffic dataset to be detected refers to the set of network traffic data collected from the server.

[0077] S202. Based on a preset time period, aggregate network traffic data to obtain multiple feature space data.

[0078] In this embodiment, network traffic data aggregation processing refers to performing data normalization, data standardization, data integration, data aggregation, and storage on the collected network traffic data.

[0079] For example, the preset unit time period can refer to 1 minute. Aggregating network traffic data can refer to aggregating network traffic data according to the dimensions of keywords (such as mobile phone number and source IP (Internet Protocol) address) and time to obtain multiple feature space data.

[0080] S203. Extract the features of each aggregated traffic data to obtain the corresponding feature vector data.

[0081] In this embodiment, the feature vector includes the number of data records per unit time, the size of the data packet, the number of source IP addresses, the number of source ports, and the mobile phone number.

[0082] S204. Calculate the density information of each feature vector data, and based on the density information, determine whether there is a first traffic anomaly in the unit time period corresponding to the feature vector data.

[0083] In this embodiment, by calculating the number of data records, data packet size, number of source IP addresses, number of source ports, and density information of mobile phone numbers for each unit of time, different types of first traffic anomalies can be identified, and corresponding protective measures can be taken.

[0084] S205. Calculate the relative deviation information of the feature space data, and based on the relative deviation information, determine whether there is a second flow anomaly in the unit time period corresponding to the feature space data.

[0085] In this embodiment, feature space data refers to the sum of data packet sizes within the corresponding unit time period (the sum of data packet sizes can also be called traffic value). By judging the relative deviation information of data packet sizes within the corresponding unit time period, traffic anomalies in the time dimension can be determined.

[0086] S206. If there is a first traffic anomaly and a second traffic anomaly within a unit time period corresponding to the feature vector data, then it is determined that there is abnormal traffic within the unit time period.

[0087] In this embodiment, by comprehensively detecting the first and second abnormal traffic flows, it is possible to accurately determine the presence of abnormal traffic within a unit time period, thereby avoiding errors in abnormal traffic detection and improving the accuracy of abnormal traffic detection.

[0088] In this embodiment, the traffic dataset to be detected is automatically acquired for each unit time period, aggregated to obtain multiple feature space data, the relative deviation information of the feature space data is calculated, and features are extracted from the aggregated traffic data to obtain corresponding feature vector data. The density information of each feature vector data is calculated. Based on the relative deviation information of the feature space data and the density information of the feature vector data, abnormal traffic is detected comprehensively. This avoids the problems of untimely detection and low efficiency of abnormal traffic detection caused by manual detection, and improves the accuracy of abnormal traffic detection.

[0089] Optionally, if there is a first traffic anomaly and a second traffic anomaly within a unit time period corresponding to the feature vector data, after determining that there is abnormal traffic within the unit time period, the method further includes:

[0090] Based on the feature space data and / or feature vector data of a unit time period, generate and send alarm information.

[0091] In this embodiment, if abnormal traffic is determined to exist within a unit time period, alarm information is generated by generating the feature spatial data and / or feature vector data of the unit time period and sent to the backend personnel, so that the backend personnel can determine whether it is a traffic attack based on the feature spatial data and / or feature vector data of the unit time period, so as to take timely protection measures.

[0092] Figure 3 This is a flowchart illustrating an abnormal traffic detection method provided in an embodiment of this application. Figure 2 Based on the embodiments shown, as Figure 3 As shown, step S204 above, which calculates the density information of each feature vector data and, based on the density information, determines whether there is a first traffic anomaly within the unit time period corresponding to the feature vector data, includes:

[0093] S301. For each feature vector data, construct a corresponding local domain based on the preset neighborhood radius, and determine the feature vector data whose distance from the feature vector data is less than or equal to the preset neighborhood radius as neighbor points.

[0094] In this embodiment, scatter plots corresponding to feature vectors are drawn based on the number of data records per unit time, data packet size, number of source IP addresses, number of source ports, and mobile phone number, respectively.

[0095] Calculate the distance between each scatter point and all other scatter points in the scatter plot. Using each scatter point as the center, construct a corresponding local region based on a preset neighborhood radius r. Select scatter points within the corresponding local region whose distance to the feature vector data is less than or equal to the preset neighborhood radius r as neighbor points, and count the number N of neighbor points. i .

[0096] S302. The ratio of the number of neighboring points of the feature vector data to the area of ​​the local domain of the feature vector data is determined as the density value of the feature vector data.

[0097] In this embodiment, the density value P of the feature vector data i The calculation formula is as follows:

[0098]

[0099] Where i is the identifier of the feature vector data.

[0100] S303. Calculate the average density value based on the density values ​​of all feature vector data.

[0101] In this embodiment, the average density value P ′ The calculation formula is as follows:

[0102]

[0103] Where n is the number of all feature vector data.

[0104] S304. If the density value of the feature vector data is greater than the average density value, then the density value of the feature vector data is compared with the preset deviation threshold.

[0105] In this embodiment, the density value P of each feature vector data is... i Sort the data; if the density value P of the feature vector data... i Greater than the average density value P ′ Then, the density value of the feature vector data is compared with the preset deviation threshold. In this way, the unit time period that does not contain abnormal traffic can be initially removed, the amount of abnormal traffic detection data can be reduced, and the detection efficiency of abnormal traffic can be improved.

[0106] S305. If the density value of the feature vector data is greater than the preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data.

[0107] In this embodiment, the density value of the feature vector data is calculated, and the presence of abnormal traffic in the corresponding unit time period is determined according to the average density value and the preset deviation threshold, thus avoiding errors and improving the detection accuracy of abnormal traffic.

[0108] Figure 4 This is a flowchart illustrating an abnormal traffic detection method provided in an embodiment of this application. Figure 3 Based on the embodiments shown, as Figure 4 As shown, the preset deviation thresholds in step S305 above include a first type of preset deviation threshold, a second type of preset deviation threshold, and a third type of preset deviation threshold; correspondingly, if the density value of the feature vector data is greater than the preset deviation threshold, it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data, including:

[0109] S401a. If the density value of the feature vector data is less than or equal to the first type of preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the first type of anomaly.

[0110] In this embodiment, the first type of preset deviation threshold can be 1500, and the first type of abnormality can be a normal abnormality.

[0111] S401b If the density value of the feature vector data is less than or equal to the second type of preset deviation threshold and greater than the first type of preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the second type of anomaly.

[0112] In this embodiment, the second type of preset deviation threshold can be 4500, and the second type of abnormality can be severe abnormality.

[0113] S401c. If the density value of the feature vector data is greater than the third type of preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the third type of anomaly.

[0114] In this embodiment, the third type of preset deviation threshold can be 4500, and the third type of abnormality can be sudden change abnormality.

[0115] In this embodiment, the density values ​​of the feature vector data are divided by different preset deviation thresholds to determine different traffic anomaly levels, so that back-end personnel can make timely and targeted protection strategies.

[0116] Figure 5 This is a flowchart illustrating an abnormal traffic detection method provided in an embodiment of this application. Figures 1 to 4 Based on the embodiments shown, as Figure 5 As shown, step S205 above involves calculating the relative deviation information of the feature space data and, based on this relative deviation information, determining whether a second flow anomaly exists within the unit time period corresponding to the feature space data. This includes:

[0117] S501. The relative deviation of the feature space data is calculated using a simplified exponential smoothing formula.

[0118] In this embodiment, the feature space data refers to the sum of the sizes of all data packets. Therefore, a simplified exponential smoothing formula is used to calculate the relative deviation of the feature space data, including:

[0119] Obtain the actual flow value Y for each unit time period t. t And the initial predicted value S0, where the actual flow value Y t It refers to the total size of data packets in a unit time period t. The initial predicted value S0 can refer to the actual traffic value at the first unit time period t.

[0120] Based on the actual flow value Y for each unit time period t t Given the initial predicted value S0, the predicted value S for each unit time period t is obtained using a simplified exponential smoothing formula. t The simplified exponential smoothing formula is:

[0121] S t =wY t-1 +(1-w)S t-1

[0122] Where w is the smoothing constant 0.9, Y t-1 S represents the actual flow rate over a unit time period t-1. t-1 The predicted value is for a unit time period t-1;

[0123] The actual flow rate Y based on the unit time period tt and predicted value S t The relative deviation RD at time point t is calculated to obtain the relative deviation information of the feature space data. The calculation formula is as follows:

[0124]

[0125] S502. If the relative deviation value is greater than the preset relative deviation threshold, it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data.

[0126] In this embodiment, the relative deviation value of the feature space data is calculated, and the presence of abnormal traffic in the corresponding unit time period is determined according to the preset relative deviation threshold. Abnormal traffic detection is performed for cases where traffic increases sharply at a certain time point but is low at other time points, thus avoiding errors and improving the accuracy of abnormal traffic detection.

[0127] Figure 6 This is a flowchart illustrating an abnormal traffic detection method provided in an embodiment of this application. Figure 5 Based on the embodiments shown, as Figure 4 As shown, the preset relative deviation threshold in step S502 includes a first preset relative deviation threshold, a second preset relative deviation threshold, and a third preset relative deviation threshold; correspondingly, if the relative deviation value is greater than the preset relative deviation threshold, it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data, including:

[0128] S601a. ​​If the relative deviation value is less than or equal to the first preset relative deviation threshold, then it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the fourth type of anomaly.

[0129] In this embodiment, the first preset relative deviation threshold can be 15%, and the fourth type of abnormality can be a normal abnormality.

[0130] S601b If the relative deviation value is greater than the first preset relative deviation threshold and less than or equal to the second preset relative deviation threshold, then it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the fifth type of anomaly.

[0131] In this embodiment, the second preset relative deviation threshold can be 45%, and the fifth type of abnormality can be a severe abnormality.

[0132] S601c. If the relative deviation value is greater than the third preset relative deviation threshold, it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the sixth type of anomaly.

[0133] In this embodiment, the third preset relative deviation threshold can be 45%, and the sixth type of abnormality can be a sudden change abnormality.

[0134] In this embodiment, different preset relative deviation thresholds are used to classify traffic anomalies in different time periods, reflecting the degree of traffic anomalies in each time period, so that back-end personnel can preset protective measures based on historical data.

[0135] Figure 7 This is a schematic diagram of the structure of an abnormal flow detection device provided in an embodiment of this application, as shown below. Figure 5 As shown, the abnormal flow detection device includes:

[0136] The aggregation module 701 is used to aggregate network traffic data according to a preset unit time period to obtain multiple feature space data.

[0137] The extraction module 702 is used to extract the features of each aggregated traffic data to obtain the corresponding feature vector data.

[0138] The first calculation module 703 is used to calculate the density information of each feature vector data, and based on the density information, to determine whether there is a first traffic anomaly in the unit time period corresponding to the feature vector data.

[0139] The second calculation module 704 is used to calculate the relative deviation information of the feature space data, and based on the relative deviation information, to determine whether there is a second traffic anomaly in the unit time period corresponding to the feature space data.

[0140] The determination module 705 is used to determine that there is abnormal traffic within a unit time period if there is a first traffic anomaly and a second traffic anomaly within a unit time period corresponding to the feature vector data.

[0141] Figure 8 This is a schematic diagram of the abnormal flow detection device provided in an embodiment of this application. Figure 8 As shown, the abnormal traffic detection device provided in this embodiment includes:

[0142] At least one processor 801 and memory 802.

[0143] Optionally, the device also includes a communication component 803. The processor 801, memory 802, and communication component 803 are connected via a bus 804.

[0144] In a specific implementation, at least one processor 801 executes computer execution instructions stored in memory 802, causing at least one processor 801 to perform the above-described method.

[0145] The specific implementation process of processor 801 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0146] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0147] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0148] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0149] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0150] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0151] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0152] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an application-specific integrated circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0153] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0154] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0155] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0156] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as a portable hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0157] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0158] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for detecting abnormal traffic flow, characterized in that, include: Obtain the traffic dataset to be detected, wherein the traffic dataset includes multiple network traffic data; The network traffic data is aggregated according to a preset time period to obtain multiple feature space data. Extract the features of each aggregated traffic data to obtain the corresponding feature vector data; For each feature vector data, a corresponding local domain is constructed based on a preset neighborhood radius, and feature vector data whose distance from the feature vector data is less than or equal to the preset neighborhood radius are determined as neighbor points; The ratio of the number of neighboring points of the feature vector data to the area of ​​the local domain of the feature vector data is determined as the density value of the feature vector data. Calculate the average density value based on the density values ​​of all the aforementioned feature vector data; If the density value of the feature vector data is greater than the average density value, then the density value of the feature vector data is compared with a preset deviation threshold. If the density value of the feature vector data is greater than the preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data; Calculate the relative deviation information of the feature space data, and based on the relative deviation information, determine whether there is a second traffic anomaly in the unit time period corresponding to the feature space data; If there is a first traffic anomaly and a second traffic anomaly within a unit time period corresponding to the feature vector data, then it is determined that there is abnormal traffic within that unit time period.

2. The method according to claim 1, characterized in that, The preset deviation thresholds include a first type of preset deviation threshold, a second type of preset deviation threshold, and a third type of preset deviation threshold; Accordingly, the step of determining that there is a first traffic anomaly in the unit time period corresponding to the feature vector data if the density value of the feature vector data is greater than the preset deviation threshold includes: If the density value of the feature vector data is less than or equal to the first type of preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the first type of anomaly. If the density value of the feature vector data is less than or equal to the second type of preset deviation threshold and greater than the first type of preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the second type of anomaly. If the density value of the feature vector data is greater than the third type of preset deviation threshold, then it is determined that there is a first traffic anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the third type of anomaly.

3. The method according to any one of claims 1 to 2, characterized in that, The relative deviation information of the calculated feature space data includes: The relative deviation of the feature space data is calculated using a simplified exponential smoothing formula.

4. The method according to claim 3, characterized in that, The step of determining whether there is a second traffic anomaly within a unit time period corresponding to the feature space data based on the relative deviation information includes: If the relative deviation value is greater than the preset relative deviation threshold, then it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data.

5. The method according to claim 4, characterized in that, The preset relative deviation threshold includes a first preset relative deviation threshold, a second preset relative deviation threshold, and a third preset relative deviation threshold; Accordingly, the step of determining that a second traffic anomaly exists within a unit time period corresponding to the feature space data if the relative deviation value is greater than a preset relative deviation threshold includes: If the relative deviation value is less than or equal to the first preset relative deviation threshold, then it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the fourth type of anomaly. If the relative deviation value is greater than the first preset relative deviation threshold and less than or equal to the second preset relative deviation threshold, then it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the fifth type of anomaly. If the relative deviation value is greater than the third preset relative deviation threshold, then it is determined that there is a second traffic anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the sixth type of anomaly.

6. The method according to any one of claims 1 to 2, characterized in that, After determining that abnormal traffic exists within a unit time period if both a first and a second traffic anomaly exist within the unit time period corresponding to the feature vector data, the method further includes: Based on the feature space data and / or feature vector data of the unit time period, alarm information is generated and sent.

7. A device for detecting abnormal flow rate, characterized in that, include: The acquisition module is used to acquire the traffic dataset to be detected, wherein the traffic dataset includes multiple network traffic data. The aggregation module is used to aggregate the network traffic data according to a preset unit time period to obtain multiple feature space data. An extraction module is used to extract features from each of the aggregated traffic data to obtain corresponding feature vector data; The first determining module is used to construct a corresponding local domain for each feature vector data according to a preset neighborhood radius, and to determine the feature vector data whose distance from the feature vector data is less than or equal to the preset neighborhood radius as neighbor points; The second determining module is used to determine the density value of the feature vector data as the ratio of the number of neighboring points of the feature vector data to the area of ​​the local domain of the feature vector data. The first calculation module is used to calculate the average density value based on the density values ​​of all the feature vector data; The comparison module is used to compare the density value of the feature vector data with a preset deviation threshold if the density value of the feature vector data is greater than the average density value. The third determining module is used to determine that if the density value of the feature vector data is greater than the preset deviation threshold, there is a first traffic anomaly in the unit time period corresponding to the feature vector data. The second calculation module is used to calculate the relative deviation information of the feature space data, and based on the relative deviation information, determine whether there is a second traffic anomaly in the unit time period corresponding to the feature space data. The fourth determining module is used to determine that there is abnormal traffic in the unit time period if there is a first traffic anomaly and a second traffic anomaly within the unit time period corresponding to the feature vector data.

8. An abnormal flow detection device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the abnormal traffic detection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the abnormal traffic detection method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the abnormal traffic detection method according to any one of claims 1 to 6.

Images