Abnormal node determination method and device, electronic equipment, chip and storage medium

Abstract

The invention provides an abnormal node determination method and device, electronic equipment, a chip and a medium, and the method comprises the steps: determining a node attribute information matrix corresponding to a current time slice of a network, the node attribute information matrix being generated according to the data flow features of a plurality of nodes contained in the network; performing Hash representation on the node attribute information matrix by adopting a Hash learning method, and generating a node Hash code matrix of the network in the current time slice; on the basis of the node hash code matrix, entropy values of a plurality of nodes contained in the network in the current time slice are determined; and according to the entropy values of the plurality of nodes included in the network in the current time slice and the plurality of adjacent time slices, determining abnormal nodes in the network. According to the invention, the nodes in the network can be subjected to aggregation analysis, the node states of multiple time slices can be subjected to aggregation analysis, the abnormal nodes can be detected before the nodes are congested, and the misjudgment rate of the abnormal nodes is reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to an abnormal node determination method, device, electronic device, chip and storage medium. Background Art

[0002] When a network is attacked, abnormal nodes will appear. These abnormal nodes are generally concentrated in routing nodes and target hosts. The appearance of abnormal nodes will cause network congestion or network paralysis, affecting network performance and related service quality indicators. The detection of related abnormal nodes has problems of post-event reflection and low detection accuracy. Summary of the invention

[0003] The present disclosure provides a method, device, electronic device, chip and storage medium for determining an abnormal node.

[0004] A first aspect embodiment of the present disclosure proposes a method for determining abnormal nodes, the method comprising: determining a node attribute information matrix corresponding to a network in a current time slice, the node attribute information matrix being generated based on data stream characteristics of multiple nodes contained in the network; performing hash representation on the node attribute information matrix using a hash learning method to generate a node hash code matrix of the network in the current time slice; determining entropy values ​​of multiple nodes contained in the network in the current time slice based on the node hash code matrix; and determining abnormal nodes in the network based on the entropy values ​​of multiple nodes contained in the network in the current time slice and multiple adjacent time slices.

[0005] In some embodiments of the present disclosure, data flow characteristics corresponding to multiple nodes included in the network in the current time slice are determined, and the data flow characteristics include at least one of the number of data packets received by the node in the current time slice, the size of the traffic received by the node in the current time slice, the number of data packets sent by the node in the current time slice, the size of the traffic sent by the node in the current time slice, and the average delay of the node in the current time slice; based on the data flow characteristics corresponding to the multiple nodes in the current time slice, a node attribute information matrix corresponding to the network in the current time slice is generated.

[0006] In some embodiments of the present disclosure, a hash learning method is used to perform hash representation on a node attribute information matrix, and generating a node hash code matrix of the network in the current time slice includes: converting the node attribute information matrix corresponding to the network in the current time slice to obtain a linear conversion matrix; reconstructing the node attribute information matrix corresponding to the network in the current time slice and the linear conversion matrix to obtain a reconstructed information matrix; establishing a residual function based on the linear conversion matrix and the reconstructed information matrix; and determining the node hash code matrix when the residual function meets a preset condition.

[0007] In some embodiments of the present disclosure, based on the node hash code matrix, determining the entropy values ​​of multiple nodes included in the network in the current time slice includes: for each of the multiple nodes, using a similarity function to perform a similarity analysis on the hash code of the node and the hash code of the neighbor node, and determining the comprehensive similarity between the node and the neighbor node; determining the abnormality coefficient between the node and the neighbor node based on the comprehensive similarity between the node and the neighbor node; and using an entropy function to determine the entropy value of the node in the current time slice based on the abnormality coefficient between the node and the neighbor node.

[0008] In some embodiments of the present disclosure, determining an abnormal node in a network based on entropy values ​​of multiple nodes included in the network in a current time slice and multiple adjacent time slices includes: sorting the entropy values ​​of multiple nodes included in the network in a current time slice and multiple adjacent time slices, respectively; determining the sorting results of the entropy values ​​of the multiple nodes in the current time slice and multiple adjacent time slices; and determining that the node is an abnormal node when the sorting results of the entropy values ​​of the node in the current time slice and multiple adjacent time slices meet preset conditions.

[0009] In some embodiments of the present disclosure, the preset condition is that the number of time slices in which the entropy value ranking of the node is within a preset range is greater than or equal to a preset threshold.

[0010] The second aspect embodiment of the present disclosure proposes an abnormal node determination device, including a first processing unit, used to determine the node attribute information matrix corresponding to the network in the current time slice, the node attribute information matrix is ​​generated according to the data flow characteristics of multiple nodes contained in the network; a second processing unit, used to use a hash learning method to hash the node attribute information matrix to generate a node hash code matrix of the network in the current time slice; a third processing unit, used to determine the entropy values ​​of multiple nodes contained in the network in the current time slice based on the node hash code matrix; a fourth processing unit, used to determine the abnormal nodes in the network according to the entropy values ​​of multiple nodes contained in the network in the current time slice and multiple adjacent time slices.

[0011] The third aspect embodiment of the present disclosure proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in the first aspect embodiment of the present disclosure.

[0012] The fourth aspect embodiment of the present disclosure proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the method described in the first aspect embodiment of the present disclosure.

[0013] A fifth aspect embodiment of the present disclosure provides a computer program product, including a computer program, which executes the method described in the first aspect embodiment of the present disclosure when a processor is used to execute the computer program.

[0014] The sixth aspect embodiment of the present disclosure proposes a chip, which includes one or more interfaces and one or more processors; the interface is used to receive signals from a memory of an electronic device and send signals to the processor, the signals include computer instructions stored in the memory, and when the processor executes the computer instructions, the electronic device executes the method described in the first aspect embodiment of the present disclosure.

[0015] In summary, the abnormal node determination method, device, electronic device, chip and storage medium proposed in the present invention can improve the recognition accuracy of abnormal nodes by aggregating and analyzing the data flow characteristics of nodes in the network and aggregating and analyzing the data flow characteristics of nodes in multiple time slices. Abnormal nodes can be determined by comprehensive analysis of the nodes in the entire network and comprehensive analysis of the entropy values ​​of nodes in multiple time slices, which can distinguish between node isolation and common phenomena, reduce the misjudgment rate of abnormal nodes, and improve the recognition accuracy of abnormal nodes. Through comprehensive analysis of nodes, false attacks or legitimate low-speed flows that flood critical paths can be identified, so that abnormal nodes can be identified before they cause alarms or congestion, thereby reducing losses caused by abnormal nodes.

[0016] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0018] Figure 1 A flowchart of a method for determining an abnormal node provided by an embodiment of the present disclosure;

[0019] Figure 2 A flowchart of a method for determining an abnormal node provided by an embodiment of the present disclosure;

[0020] Figure 3 A flowchart of a method for determining an abnormal node provided by an embodiment of the present disclosure;

[0021] Figure 4 A schematic diagram of a node communication behavior flow provided by an embodiment of the present disclosure;

[0022] Figure 5 A schematic diagram of a hash code conversion process provided by an embodiment of the present disclosure;

[0023] Figure 6 A schematic diagram of a process of reconstructing original attribute information provided by an embodiment of the present disclosure;

[0024] Figure 7 A schematic diagram of the structure of an abnormal node determination device provided by an embodiment of the present disclosure;

[0025] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure;

[0026] Fig. 9 A schematic diagram of the chip structure provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] Embodiments of the present disclosure are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present disclosure, and should not be construed as limiting the present disclosure.

[0028] After the network is attacked, abnormal nodes will appear, which are generally concentrated in routing nodes and target hosts. However, since the routing nodes themselves have firmware backdoors and vulnerabilities, attackers often obtain management privileges through phishing and brute force within a few minutes. Routing nodes are responsible for data forwarding and transmission in the network topology. Therefore, once the attacker obtains the privilege, he can attack the target host by dropping packets, tampering packets, or injecting invalid packets. The above network security behaviors have seriously affected network performance and related quality of service (QoS) indicators. Although existing scholars use path-based detection technology and neighbor node-based detection technology to determine the location of abnormal network routing nodes, as the network scale increases, the path-based detection method causes an exponential increase in the amount of calculation caused by the increase in paths; abnormal node detection based on neighbor nodes uses the method of aggregated data streams to determine abnormal nodes, but all data stream information reports information to a single global node. Once the node is damaged or the network scale is too large, network congestion or network paralysis will occur.

[0029] To address the above issues, some researchers have proposed the following methods to detect abnormal nodes.

[0030] For example, a network fault location method based on machine learning puts the historical alarm data into an artificial intelligence model for training, generates a fault root cause reasoning relationship based on the existing network topology and alarm relationship, and obtains a tree diagram of the alarm relationship, thereby using artificial intelligence to infer the root cause of the fault.

[0031] However, this method cannot effectively deal with the attacker's false attacks or the behavior of legitimate low-speed flows flooding the critical path. Sometimes the attacker will not continuously send a large number of routing detection packets, so it will not affect the performance of the target server and will not cause the detection system to detect it. In this case, this method cannot locate the fault of the network node.

[0032] For another example, each network fault positioning method, device, storage medium and electronic device, when the method detects alarm information, determines the starting node information of at least one starting node where the abnormality occurs in the knowledge graph set based on the alarm information; queries the subtree of at least one starting node in the knowledge graph set to obtain a subtree set; traverses the nodes of each subtree in the subtree set, and detects abnormal nodes with abnormalities to obtain an abnormal node set; sorts the nodes in the abnormal node set according to the relationship between the nodes in the knowledge graph set, and locates the root cause of the alarm information based on the node at the end of the queue after sorting.

[0033] This method is also unable to effectively deal with attackers' false attacks or legitimate low-speed flows that overwhelm critical paths. If the detection system is not aware of this, the faulty network nodes cannot be identified, and real-time network security detection cannot be achieved.

[0034] As another example, a fault detection method, apparatus and computer equipment based on the Internet Control Message Protocol (ICMP) protocol, the method captures ICMP data packets in real time; compares the sending and receiving time of ICMP echo request messages and ICMP echo reply messages to measure network delay and monitor delay fluctuations; analyzes ICMP destination unreachable messages to identify IP data packets that cause errors, and refines the fault type based on the ICMP code value in the ICMP data packet; tracks the network path based on ICMP time exceeded messages to obtain the transmission path of the ICMP data packet, thereby locating the faulty node on the network path; dynamically adjusts the threshold for anomaly detection by continuously monitoring the ICMP interaction mode, and generates a network fault report when an anomaly is detected.

[0035] Although this method can track data packets in real time and refine the fault type, as the network scale continues to increase, the tracking of data packets leads to a particularly large amount of calculation and is not practical. In addition, this method usually identifies attacks based on the delay of a single data stream. However, in a flood attack scenario, the difference between a single attack stream and a normal stream is very small, making it difficult to improve detection accuracy.

[0036] Therefore, in order to solve the above technical problems, the present invention proposes a method for determining abnormal nodes, which can be executed by an electronic device, for example, by a server. The method greatly reduces the complexity of abnormal node calculation of the entire network system through hash codes; in addition, the entropy of the abnormal node data stream is ranked in descending order through multiple time slices, which can avoid misjudgment behavior due to the burstiness of the data stream.

[0037] Figure 1 A flowchart of a method for determining an abnormal node provided by an embodiment of the present disclosure is shown in FIG. Figure 1 As shown, the method may include the following steps.

[0038] Step 101, determining the node attribute information matrix corresponding to the network in the current time slice.

[0039] In some embodiments, a network may include multiple nodes, and the node attribute information matrix is ​​generated based on the data flow characteristics of the multiple nodes included in the network, that is, the node attribute information matrix can be generated based on the data flow characteristics of all or part of the nodes included in the network.

[0040] In some embodiments, the data flow characteristics of nodes in the network within multiple time periods can be analyzed to determine abnormal nodes. By way of example, multiple time periods can be divided into multiple time slices, and the data flow characteristics of the nodes in the network in each time slice are analyzed separately. By way of example, the current time slice can be the time slice that is being analyzed and processed, for example, the current time slice can be represented as time slice t.

[0041] In other words, a comprehensive analysis can be performed on all nodes contained in the network, and the data of nodes in multiple time slices can be comprehensively analyzed to determine abnormal nodes, which can improve the accuracy of identifying abnormal nodes and reduce the misjudgment rate of abnormal nodes.

[0042] In some embodiments, for example, determining the node attribute information matrix corresponding to the network in the current time slice includes: determining data flow characteristics corresponding to multiple nodes contained in the network in the current time slice, the data flow characteristics at least including at least one of the number of data packets received by the node in the current time slice, the size of the traffic received by the node in the current time slice, the number of data packets sent by the node in the current time slice, the size of the traffic sent by the node in the current time slice, and the average delay of the node in the current time slice; based on the data flow characteristics corresponding to the multiple nodes in the current time slice, generating the node attribute information matrix corresponding to the network in the current time slice.

[0043] In other words, a node attribute information matrix can be generated based on the data flow characteristics of the nodes in the current time slice. For example, a network can generate a node attribute information matrix in one time slice. For example, if the data of n time slices of a network are analyzed, the network can generate node attribute information in n time slices, that is, the network has n node attribute information matrices.

[0044] In some embodiments, the data stream feature may optionally include the above five dimensions. For example, based on the data stream feature of a node in the current time slice, multi-dimensional attribute information of a node in the current time slice may be generated, which may be expressed as in, Represents the multi-dimensional attribute information of the routing node identified as 1 in time slice t, Indicates the number of data packets received by the routing node identified as 1 as the receiving end in time slice t, Indicates the amount of traffic received by the routing node identified as 1 as the receiving end in time slice t. Indicates the number of data packets sent by the routing node identified as 1 as the sender in time slice t, It indicates the traffic size sent by the routing node identified as 1 as the sender in time slice t. Indicates the average delay of data forwarding processed by the routing node identified as 1 in time slice t.

[0045] In some embodiments, optionally, the data flow characteristics of each node in the current time slice can generate a multi-dimensional attribute information, and according to the multi-dimensional attribute information of all or part of the nodes contained in the network, the node attribute information matrix corresponding to the network in the current time slice can be generated, for example, it can be expressed as the following formula 1:

[0046]

[0047] In some embodiments, optionally, the data flow features used to generate the node attribute information matrix may also include other dimensions. In actual scenarios, dimensions can be added as needed, for example, fields for measuring traffic attributes can be added, such as traffic average, instantaneous maximum traffic, etc. This is not limited by the present disclosure. By selecting data flow features of different dimensions, it is possible to avoid calculating useless data, reduce the amount of calculation, and improve calculation efficiency while determining the node status.

[0048] Step 102: A hash learning method is used to perform hash representation on the node attribute information matrix to generate a node hash code matrix of the network in the current time slice.

[0049] In some embodiments, a hash learning method may be used to hash the node attribute information matrix to obtain a corresponding node hash code matrix, so as to analyze and determine abnormal nodes based on the hash code matrix, thereby reducing the amount of calculation and the complexity of calculation.

[0050] In some embodiments, a hash learning method is used to perform hash representation on the node attribute information matrix, and generating a node hash code matrix of the network in the current time slice includes: converting the node attribute information matrix corresponding to the network in the current time slice to obtain a linear conversion matrix; reconstructing according to the node attribute information matrix corresponding to the network in the current time slice and the linear conversion matrix to obtain a reconstructed information matrix; establishing a residual function based on the linear conversion matrix and the reconstructed information matrix; and determining the node hash code matrix when the residual function meets preset conditions.

[0051] In other words, the hash learning method can be used to perform hash representation on the node attribute information matrix to achieve dimensionality reduction of the data. For example, the hash representation can be to represent the node attribute information with a specific binary string, which can reduce the computational complexity and improve the computational efficiency. That is, a node can correspond to a hash code in the current time slice, and the hash code is a binary string of a specific length. A node hash code matrix can be generated based on the hash codes of all or part of the nodes contained in the network. A network can generate a node hash code matrix in one time slice.

[0052] In some embodiments, optionally, a sparse representation may be used to perform hash representation on the node attribute information matrix. For example, sparse representation may refer to setting vectors of unimportant positions to 0 in order to reduce the amount of computation. For example, a vector [1 5 5 6] may be represented as [1 0 0 0] if the vector is sparsely represented. Sparse representation can reduce the amount of computation when performing related operations.

[0053] In some embodiments, when using sparse representation, it is necessary to pay more attention to the feature loss before and after the reconstruction data transformation to avoid excessive feature loss caused by sparse representation. Therefore, when performing hash representation on the node attribute information matrix, the loss before and after the hash code representation can be constrained to ensure the minimum loss. The specific process is as follows:

[0054] (1) The node attribute information f t The matrix is ​​transformed to obtain the linear transformation matrix U.

[0055] (2) Reconstruct the node attribute information matrix and the linear transformation matrix to obtain the reconstructed information matrix.

[0056] Specifically, we can target the multidimensional attribute information of each node in the node attribute matrix And the linear transformation matrix U, reconstruct the original information of each node, and the reconstructed original information can be expressed as For example, a reconstruction information matrix may be generated according to the reconstructed original information of all or part of the nodes included in the network.

[0057] (3) Establish the residual function based on the linear transformation matrix and the reconstructed information matrix.

[0058] Specifically, a residual function may be established for each node. For example, a residual function may be established for each node based on a linear transformation matrix and reconstruction information of each node. For example, the residual function It can be expressed as the following formula 2:

[0059]

[0060] Among them, is the F-norm, is the 2-norm, is the hash code corresponding to the multidimensional attribute information of the i-th node, representing the corresponding hash code sequence of the i-th node; is the attribute similarity matrix, which represents the attribute similarity matrix of the i-th node and the j-th dimension at time t, λ1 is the balance parameter, and λ2 is the non-negative penalty parameter.

[0061] In the above formula, the attribute similarity matrix is ​​trained through the corpus of a field. For example, the information of similar traffic semantics can be composed into a corpus. For example, the traffic semantic information of normal traffic can be composed into a corpus. The local semantics of this corpus can be trained isomorphically. For example, the above five attributes can be trained through corpus training to obtain the similarity between the five attributes of normal traffic. It can ensure that similar attribute information has similar hash codes, and similar hash codes have similar residual structures.

[0062] In the above formula, It can be used to represent the feature loss between the semantic representation before and after reconstruction. The residual function is Minimum Guarantee and Approximation, thereby minimizing the feature loss between the semantic representations before and after reconstruction; The constraint term is a regularization term that avoids overfitting of the residual function and improves the generalization ability of the residual function.

[0063] (4) When the residual function meets the preset conditions, the node hash code matrix is ​​determined.

[0064] Specifically, the preset condition can be that the residual function value is the minimum, that is, the b corresponding to the minimum residual function value is determined it The hash code of the node is used as the hash code, and a hash code matrix is ​​generated according to the hash codes of all or part of the nodes contained in the network, so that the feature loss of the node attribute information matrix can be minimized when it is converted into the hash code matrix.

[0065] Or, optionally, the preset condition may be that the residual function value is less than or equal to a preset threshold, etc. The preset condition may be determined according to an actual scenario, and the present disclosure does not limit this.

[0066] Step 103: Determine entropy values ​​of multiple nodes included in the network in the current time slice based on the node hash code matrix.

[0067] In some embodiments, the entropy value can be used to indicate the uncertainty of the traffic distribution of the node in the current time slice. Since the traffic of the node usually has periodicity and trend, if the traffic of the node in the current time slice fluctuates and changes unstably, the node may be an abnormal node. Therefore, the entropy value can be used to determine the abnormal node.

[0068] In some embodiments, the entropy value of a node in a time slice may be determined based on a hash code of the node in the time slice, that is, a node may have a corresponding entropy value in a time slice.

[0069] In some embodiments, based on the node hash code matrix, determining the entropy values ​​of multiple nodes included in the network in the current time slice includes: for each of the multiple nodes, using a similarity function to perform a similarity analysis on the hash code of the node and the hash code of the neighbor node to determine the comprehensive similarity between the node and the neighbor node; determining the abnormality coefficient between the node and the neighbor node based on the comprehensive similarity between the node and the neighbor node; and using an entropy function to determine the entropy value of the node in the current time slice based on the abnormality coefficient between the node and the neighbor node.

[0070] Specifically, the neighbor node may be a node whose hop count from the current node is less than a preset threshold. For example, the neighbor node may be a node within 2 hops from the current node. For example, the neighbor nodes of node 0 are 1 and 2, 1 also has 3 neighboring nodes, and 2 also has 4 neighboring nodes. Then, the neighbor nodes of node 0 within 2 hops are node 1, node 2, node 3, and node 4. The preset threshold of the hop count can be limited according to the actual usage scenario, and the present disclosure does not limit this.

[0071] Step 104: determine abnormal nodes in the network according to entropy values ​​of multiple nodes included in the network in the current time slice and multiple adjacent time slices.

[0072] In some embodiments, the adjacent time slice may be a time period adjacent to the current time slice. For example, when the current time slice is t, the adjacent time slice may be t-1, t+1, t+2, and so on. The number of adjacent time slices may be determined based on the actual scenario, and this disclosure is not limited to this.

[0073] In other words, we can conduct a comprehensive analysis on the entropy values ​​of nodes in different time slices, as well as the entropy values ​​of different nodes in the network to determine abnormal nodes. Attacking a node can affect the characteristics of surrounding nodes, and we can comprehensively determine abnormal nodes, distinguish between random data and attack behaviors, reduce the misjudgment rate of abnormal nodes, and improve the recognition accuracy of abnormal nodes.

[0074] In some embodiments, determining an abnormal node in a network based on entropy values ​​of multiple nodes included in the network in a current time slice and multiple adjacent time slices includes: sorting the entropy values ​​of multiple nodes included in the network in a current time slice and multiple adjacent time slices, respectively; determining the sorting results of the entropy values ​​of the multiple nodes in the current time slice and multiple adjacent time slices; when the sorting results of the entropy values ​​of the node in the current time slice and multiple adjacent time slices meet preset conditions, determining that the node is an abnormal node.

[0075] In summary, the above-mentioned embodiments of the present application, by comprehensively analyzing the data flow characteristics of multiple nodes in the network, and comprehensively analyzing the data flow characteristics of nodes in multiple time slices, and measuring the abnormal distribution of nodes in the entire network through entropy values, can determine the communication behavior of nodes in the entire network from a global perspective, and determine abnormal nodes; by determining abnormal nodes based on the entropy values ​​of multiple time slices, it is possible to distinguish between general anomalies caused by the randomness of data and individual anomalies caused by attacks, reduce the misjudgment rate of abnormal node identification, and improve the identification accuracy of abnormal nodes.

[0076] Figure 2 A flowchart of a method for determining an abnormal node provided by an embodiment of the present disclosure is shown in FIG. Figure 2 As shown, the method may include the following steps.

[0077] Step 201 : for each of the multiple nodes, a similarity function is used to perform similarity analysis on the hash code of the node and the hash code of the neighboring node to determine the comprehensive similarity between the node and the neighboring node.

[0078] In some embodiments, for multiple nodes included in the network, a similarity analysis may be performed on each of the multiple nodes to determine the comprehensive similarity between the node and the neighboring nodes. For example, the comprehensive similarity between the node and the neighboring nodes may be determined based on the similarity of the hash codes of the node and the neighboring nodes. For example, the similarity function may be a cosine function, that is, the cosine function may be used to perform a similarity analysis on the hash code of the node and the hash code of the neighboring node to determine the comprehensive similarity between the node and the neighboring nodes. For example, the similarity function may be expressed as the following formula 3:

[0079]

[0080] in, Represents the hash code of the kth node, that is, the kth node and the ith node are neighbor nodes. The above k∈Γ(i) means that the number of hops between the kth node and the ith node is less than or equal to a preset threshold, for example, the number of hops between the kth node and the ith node is less than or equal to 2.

[0081] In some embodiments, for each of the multiple nodes, the comprehensive similarity between the node and multiple neighboring nodes can be determined respectively. For example, when a node has five neighboring nodes, the corresponding node and the five neighboring nodes respectively have a comprehensive similarity value.

[0082] In some embodiments, nodes in different time slice networks may be processed separately to determine the comprehensive similarity between the node and neighboring nodes in each time slice.

[0083] Step 202: determine the abnormality coefficient between the node and its neighboring nodes based on the comprehensive similarity between the node and its neighboring nodes.

[0084] In some embodiments, based on the comprehensive similarity between the node and the neighboring nodes, the abnormal coefficient between the node and multiple neighboring nodes can be determined, that is, there is an abnormal coefficient between a node and a neighboring node. For example, the abnormal coefficient It can be expressed as the following formula 4:

[0085]

[0086] In some embodiments, nodes in different time slice networks may be processed separately to determine the abnormal coefficients between the nodes and neighboring nodes in each time slice.

[0087] Step 203: According to the abnormal coefficients of the node and its neighboring nodes, an entropy function is used to determine the entropy value of the node in the current time slice.

[0088] In some embodiments, the entropy value of a node may be determined based on the abnormal coefficient between the node and all neighboring nodes. For example, different time slices may be processed separately to determine the entropy values ​​corresponding to each of the multiple nodes in the network in different time slices. For example, the entropy function may be expressed as the following formula 5:

[0089]

[0090] Where K is a constant value greater than zero. is the entropy value corresponding to the i-th node in time slice t. For example, When , it means that there is no uncertainty in the traffic distribution of the node in time slice t; on the contrary When , it means that the traffic distribution of the node in time slice t has great uncertainty. Generally speaking, the traffic of a node has the characteristics of periodicity and trend. When the uncertainty of the traffic distribution of a node is high, it is very likely to be an abnormal node. Therefore, the entropy value can be used to detect abnormal nodes.

[0091] In summary, the above embodiments of the present application can determine the comprehensive similarity between the node and its neighboring nodes, determine the abnormality coefficient between the node and its neighboring nodes, and determine the entropy value of the node based on the abnormality coefficient between the node and its neighboring nodes, so as to determine the abnormal node based on the entropy value, and can identify the abnormal node according to the communication behavior between the nodes, and can distinguish between the general anomalies caused by the randomness of the data and the individual anomalies caused by the attack, reduce the misjudgment rate of abnormal node identification, and improve the identification accuracy of abnormal nodes.

[0092] Figure 3 A flowchart of a method for determining an abnormal node provided by an embodiment of the present disclosure is shown in FIG. Figure 3 As shown, the method may include the following steps.

[0093] Step 301 : sorting the entropy values ​​of multiple nodes in the network in the current time slice and multiple adjacent time slices respectively.

[0094] In some embodiments, for a time slice among multiple time slices, for example, for the current time slice, the entropy values ​​of the nodes contained in the current time slice network can be sorted. For example, if the network contains 5 nodes, the entropy values ​​of the 5 nodes in the current time slice can be sorted. For example, they can be arranged in descending order according to the size of the entropy value. For example, in the current time slice, the entropy value of node 1 is 0.8, the entropy value of node 2 is 0.5, the entropy value of node 3 is 0.9, the entropy value of node 4 is 0.6, and the entropy value of node 5 is 0.3. Then the sorting result of the current time slice is: node 3-node 1-node 4-node 2-node 5. When descending sorting is adopted, the uncertainty of the node with a higher ranking is higher.

[0095] Step 302: Determine the entropy value sorting results of multiple nodes in the current time slice and multiple adjacent time slices.

[0096] In some embodiments, the entropy values ​​of the nodes may be sorted in multiple time slices respectively, that is, one time slice may correspond to one sorting result, and the sorting result is the sorting of the entropy values ​​of multiple nodes included in the network.

[0097] For example, the entropy value sorting result of a node in the current time slice and multiple adjacent time slices may refer to the ranking of the node in the current time slice and multiple adjacent time slices. For example, for the i-th node, it can be determined that the node ranks second in time slice t, fifth in time slice t+1, second in time slice t+2, first in time slice t+3, and second in time slice t+4.

[0098] In other words, for each node, the ranking of the node in multiple time slices can be determined.

[0099] Step 303: When the entropy value sorting results of the node in the current time slice and multiple adjacent time slices meet a preset condition, determine that the node is an abnormal node.

[0100] In some embodiments, the preset condition is that the number of time slices in which the entropy value ranking of the node is within a preset range is greater than or equal to a preset threshold.

[0101] In other words, the number of time slices in which the entropy ranking of the node is within a preset range can be determined. For example, in the example of step 302 above, the preset range can be the top 2. At this time, it can be determined that the number of time slices in which the entropy ranking of the node is in the top 2 in multiple time slices is 4, namely, t time slice, t+2 time slice, t+3 time slice and t+4 time slice. At this time, the number of time slices that meet the above requirements is 4. When the preset threshold is 3, it is determined that the node meets the preset conditions and the node is an abnormal node.

[0102] In the above embodiment, when the entropy values ​​are sorted in descending order, the higher the traffic distribution uncertainty of the top-ranked nodes, the higher the possibility of being abnormal nodes. At this time, the preset range in the preset conditions can be the top-ranked range, that is, the nodes with relatively high uncertainties in multiple time slices are preferentially determined as abnormal nodes; optionally, the entropy values ​​can also be sorted in ascending order. At this time, the preset range in the preset conditions can be the bottom-ranked range, and so on, which is not limited by the present disclosure.

[0103] In the above embodiment, the preset range can be set according to the actual scenario, which is not limited by the present disclosure. For example, if the preset range is determined to be the top 5, when all 5 time slices of a node are in the top 5 in the descending order of uncertainty, it means that the node is an abnormal node.

[0104] In summary, the above embodiments of the present application can sort the entropy values ​​of multiple nodes in the network, and can comprehensively compare and analyze the nodes in the entire network to determine abnormal nodes. Through the entropy values ​​of multiple time slice nodes and the new comprehensive analysis, the node is determined to be an abnormal node only when the number of time slices that meet the conditions is greater than or equal to the threshold. It can distinguish between general anomalies caused by the randomness of the data and individual anomalies caused by attacks, avoid misjudgments caused by the randomness and suddenness of the data, and can reduce the misjudgment rate of abnormal node identification and improve the identification accuracy of abnormal nodes.

[0105] For the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should know that the present disclosure is not limited by the described order of actions, because according to the present disclosure, certain steps can be performed in other orders or simultaneously.

[0106] Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0107] The technical solution of the present disclosure is further described in detail below in conjunction with specific application examples.

[0108] The present disclosure provides a method for detecting and locating abnormal network nodes oriented to SDN.

[0109] The method of this example is based on the Software Defined Network (SDN) controller, taking advantage of the SDN global view, and combining the status of all nodes in the network to detect abnormal nodes before congestion occurs at the nodes. The node aggregation data stream characterizes the communication behavior of the nodes, constructs a node attribute information matrix, and uses a hash learning method to represent the node attribute information matrix with a hash code, which greatly reduces the amount of calculation of the node attribute information matrix. In addition, the nodes are graded according to the differences in hash codes, and the abnormal distribution of the nodes in the entire network is measured using entropy. The entropy of multiple consecutive (for example, 5) time slices is used for descending ranking. If 5 consecutive entropy descending rankings are within a specified range (for example, the top 5 are ranked), the node is considered to be an abnormal node, otherwise it is considered to be a normal node.

[0110] The specific content of this method is as follows.

[0111] Step 1: Characterize the communication behavior of nodes through node aggregation data flow and construct the node space feature matrix.

[0112] like Figure 4As shown in the figure, data flow f1 starts from source node A and flows to the target node after passing through B, C, D, E, and F, and data flow f2 flows from source node G to the target node after passing through D and F. It can be seen that if a single data flow is tracked, it will cost a lot to find abnormal nodes. The method of this example compromises between cost and accuracy, uses node aggregation data flow to characterize the communication behavior of nodes, and constructs a node space matrix based on the characteristics of node data flow.

[0113] Generally speaking, the characteristics of data flow include the number of sent and received data packets, the size of the sent and received traffic, and the average delay of data packet forwarding. Then the communication behavior of the node represented by the aggregated data flow in time slice t can be expressed as:

[0114]

[0115] Formula (1) shows the attribute information sequence of the number of packets sent and received and the average delay of packet forwarding for n routes in the entire network, where: Represents the multi-dimensional attribute information of the routing node identified as 1 in time slice t, Indicates the number of data packets received by the routing node identified as 1 as the receiving end in time slice t, Indicates the amount of traffic received by the routing node identified as 1 as the receiving end in time slice t. Indicates the number of data packets sent by the routing node identified as 1 as the sender in time slice t, It indicates the traffic size sent by the routing node identified as 1 as the sender in time slice t. Indicates the average delay of the routing node identified as 1 in processing data forwarding in time slice t. The attribute information of the node in this solution includes but is not limited to the above five dimensions, which can be increased according to actual conditions. In the actual process, there are many fields for measuring traffic attributes, and some fields can be added according to actual scenarios, such as: average traffic value, instantaneous maximum traffic value, etc. The above attribute information sequence is input into the hash model to obtain the corresponding hash code.

[0116] Step 2: The hash learning method is used to represent the node attribute information matrix with hash codes, which greatly reduces the amount of calculation of the attribute information matrix.

[0117] The node attribute information matrix representation based on hash learning is to map the different attribute data of a node into the Hamming space (i.e., the common latent space), and then transform it into a binary string of "0" or "1" of a specific length through some form of transformation. Then, the hash-based algorithm can directly use binary coding operations and other methods when calculating the similarity. Using binary to calculate the similarity can greatly reduce the computational complexity and improve the efficiency of calculating the similarity. In addition, since a corresponding binary sequence is generated for each node in a certain time slice t to aggregate the data stream to represent the communication behavior of the node (assuming 5 attribute information, then a binary sequence such as "01100" is generated accordingly), a lot of memory can be saved when storing node attribute information. If the above n is 100, then there are 100 binary sequences. The specific transformation process is as follows: Figure 5 shown.

[0118] Figure 5 The common latent space is used to reduce the dimensionality of the original data, and fewer hash codes are used to represent the attributes of a node. However, the use of sparse representation in the common latent space requires more attention to the feature loss before and after the reconstruction of the data transformation. Since the attribute information of each network is very different, different networks cannot use the same common latent space for hash code conversion. Among them, sparse representation is to set the vectors of unimportant positions to 0, in order to reduce the amount of calculation. For example: if a vector is [1 5 5 6], if this vector is sparse, it is likely to form [1 0 0 0]. In this way, the amount of calculation can be reduced when performing related operations.

[0119] The basic idea of ​​the common latent space is: the residual value before and after the transformation of the original attribute information is combined with the original attribute information and the information after reconstruction to achieve the minimum feature loss before and after reconstruction. That is, the purpose of constructing the common latent space is to map high dimensions to low dimensions, and in the mapping process, it is hoped that the information of the original attributes will not be lost too much, otherwise this dimensionality reduction is meaningless. Therefore, it is hoped that the feature loss before and after reconstruction is minimized. Represents the residual between the original attribute information transformed by the linear matrix and the hash code, which is specifically expressed as

[0120]

[0121] Among them, is the F-norm, is the 2-norm, and the matrix U is the linear transformation matrix obtained by transforming the original information.

[0122] is the hash code corresponding to the original attribute information, indicating the corresponding hash code sequence of the i-th node; is the attribute similarity matrix, which represents the attribute similarity matrix of the jth dimension at the i-th node at time t. The attribute similarity matrix is ​​trained through the corpus of a field, and the information of similar traffic semantics constitutes a corpus. For example, the traffic semantic information of normal traffic constitutes a corpus, and the local semantics of this corpus is trained isomorphically, such as the above five attributes. Through corpus training, the similarity between the five attributes of normal traffic can be trained.

[0123] λ1 is a balance parameter, and λ2 is a non-negative penalty parameter. The reconstructed residual is added It can ensure that similar attribute information has similar hash codes, and similar hash codes have similar residual structures. It is the process of hash code reconstruction, the purpose of which is to minimize the feature loss between the semantic representation before and after reconstruction, and to make the value as close to 0 as possible, through the reconstruction of the original attribute information is a binary hash code A nearest neighbor sample in .

[0124] Specifically, Figure 6 As shown in the figure, the original attribute information is reconstructed through the hash code and the dictionary information. The hash code is actually calculated by the operation of the original attribute information (which has been converted into a linear matrix) and the dictionary itself. Generally speaking, the original attribute information is multiplied by the inverse matrix of the dictionary. Then the linear conversion of the dictionary into the inverse matrix is ​​the writing of the above hash code reconstruction formula.

[0125] Because the dictionary generation process cannot be generated by a single sample, it needs to be generated by a corpus in a certain field. The construction of the corpus requires neighboring samples, that is, similar samples, to ensure that the generated dictionary has the characteristics of the field.

[0126] In the above formula 2, By minimizing and Approximation, approximation is to achieve the minimum feature loss, The constraint term is a regularization term to avoid overfitting. Based on this, we can obtain the hash code of the original attribute information. matrix.

[0127] Optionally, in order to reduce the amount of calculation, in addition to the hash algorithm, other dimensionality reduction methods can also be used, such as Linear Discriminant Analysis (LDA), Locally Linear Embedding (LLE), Singular Value Decomposition (SVD), etc. However, the above methods are not as advantageous as the hash algorithm of this solution, because binary feature representation is the simplest and has the least amount of calculation. At the same time, the constraint term used in this patent when calculating the latent space is a regularization term to avoid overfitting, which avoids losing too many characteristics of the data itself in order to reduce the amount of calculation, and can better retain the characteristics of the data during the dimensionality reduction process.

[0128] (3) Nodes are graded based on the differences in hash codes, and entropy is used to measure the abnormal distribution of nodes in the entire network.

[0129] The similarity of binary hash codes of different nodes is measured by the cosine function, so the comprehensive similarity between node i and its neighboring nodes within 2 hops can be expressed as:

[0130]

[0131] in, Represents the hash code of the kth node.

[0132] Due to the differences between different nodes, a certain node cannot be measured against other nodes. Therefore, the method in this example uses 2-hop neighbor nodes for measurement, that is, the range of node k cannot exceed the 2-hop range of node i. Among them, the explanation of the 2-hop range is: the neighboring nodes of node 0 are 1 and 2, the neighboring nodes of 1 are 3, and the neighboring nodes of 2 are 4. Then the 2-hop range of node 0 is 1, 2, 3 and 4, which is the comprehensive similarity of all 2-hop neighbors. In addition, according to actual needs, 3-hop range and 4-hop range are also possible. However, the calculation complexity of 3-hop range and 4-hop range is relatively high, and generally 2-hop range can be used to measure the traffic characteristics of neighbor nodes.

[0133] Based on the comprehensive similarity between node i and its neighboring nodes within 2 hops, the abnormal coefficient between node i and its neighboring nodes within 2 hops can be calculated:

[0134]

[0135] Similarly, the anomaly coefficients of other nodes are calculated according to formula (4). Entropy is used to measure the abnormal distribution of nodes in the entire network, and abnormal nodes are selected by ranking. The entropy formula can be expressed as follows.

[0136]

[0137] Where K is a constant value greater than zero. is the uncertainty of the traffic distribution of network node i in time slice t. The uncertainty of the traffic distribution of network node i can characterize the reason for node abnormality: if the traffic of a node fluctuates, which is very different from the usual distribution, and its traffic characteristics are unpredictable, then the node is a suspected abnormal node. Generally speaking, the traffic of a node has periodic and trend characteristics. If such characteristics are uncertain, then it is very likely to be an abnormal node.

[0138] if This means that there is no uncertainty in its traffic distribution; on the contrary This shows that its traffic distribution has great uncertainty, and the detection of abnormal nodes is realized.

[0139] The method in this example requires multiple time slices. The reason why one time slice cannot be used to judge whether a node is abnormal is that the traffic of a node has periodicity and trend. The traffic of a single node may be affected by randomness and will show abnormalities within a short period of time. Therefore, a single time slice cannot judge whether the node is abnormal. Multiple time slices are needed to judge the abnormality. Multiple time slices are used to judge whether the traffic of the node conforms to the periodicity and trend and whether it is different from the normal characteristic distribution.

[0140] The method in this example uses entropy to measure the abnormality of node traffic, and the entropy of multiple time slices is used for descending ranking in order to observe the law of traffic changes by the length of time. Therefore, by ranking uncertainty in descending order, when the five time slices t of a node are all in the top five in the descending ranking of uncertainty, it means that the node is an abnormal node, and the location of the abnormal node is achieved. The method in this example uses the length of time to observe the law of traffic changes, avoids misjudgment due to the suddenness of data flow, and comprehensively judges the two factors of time (multiple time slices) and space (descending ranking of entropy) to reduce the probability of node misjudgment.

[0141] For example, when this method is actually used to determine abnormal nodes, if node i is ranked first in descending order in time slices t, t+1, t+2 and t+3, but is ranked sixth or even behind in t+4, will there be an underreporting situation? Explanation: It is unlikely, because once the attacker launches a real attack on the node (rather than a tentative attack), continuous alarms will definitely appear within a certain range. If a tentative attack occurs, it is not a real attack behavior, but only a tentative attack to find the target host. However, once the host is found, the attacker will definitely use multiple attack methods to implement the attack.

[0142] In summary, the above examples of the present disclosure characterize the communication behavior of nodes through node aggregation data flow, construct a node attribute information matrix, and use the hash learning method to represent the node attribute information matrix with a hash code; based on the hash code matrix of the node, the abnormality coefficient of the node and the neighboring node is calculated; the entropy method is used to measure the abnormality coefficient of the node, and the entropy of multiple time slices is used to perform descending ranking to determine the abnormal distribution of the nodes in the entire network.

[0143] The computational complexity of the method in the above example is greatly reduced compared with the traditional method. By converting the traffic characteristics into hash codes and quickly measuring the abnormal communication behavior of the node through the abnormal coefficient of node i and the neighboring nodes within 2 hops, a data basis is provided for the identification of abnormal nodes. The method in the above example uses entropy to measure the law of traffic change, and uses the entropy of multiple time slices for descending ranking. On the one hand, the traffic change law is observed by the length of time. On the other hand, the abnormal node is determined by the ranking of the node in the global network node to avoid misjudgment behavior due to the burstiness of the data flow. The two factors of time and space are comprehensively judged to reduce the probability of node misjudgment.

[0144] Figure 7 FIG. 7 is a block diagram of an abnormal node determination device 700 provided in an embodiment of the present disclosure. Figure 7 As shown, the device 700 includes: a first processing unit 710, used to determine the node attribute information matrix corresponding to the network in the current time slice, and the node attribute information matrix is ​​generated according to the data flow characteristics of multiple nodes contained in the network; a second processing unit 720, used to use a hash learning method to hash the node attribute information matrix to generate a node hash code matrix of the network in the current time slice; a third processing unit 730, used to determine the entropy values ​​of multiple nodes contained in the network in the current time slice based on the node hash code matrix; a fourth processing unit 740, used to determine abnormal nodes in the network according to the entropy values ​​of multiple nodes contained in the network in the current time slice and multiple adjacent time slices.

[0145] In summary, the above-mentioned device of the present invention can improve the recognition accuracy of abnormal nodes by performing aggregation analysis on the data flow characteristics of nodes in the network and aggregation analysis on the data flow characteristics of nodes in multiple time slices. By performing comprehensive analysis on the nodes in the entire network and determining the abnormal nodes through comprehensive analysis on the entropy values ​​of nodes in multiple time slices, it is possible to distinguish between node isolation and common phenomena, reduce the misjudgment rate of abnormal nodes, and improve the recognition accuracy of abnormal nodes. Through comprehensive analysis of nodes, false attacks or legitimate low-speed flows that flood critical paths can be identified, so that abnormal nodes can be identified before they cause alarms or congestion occurs, thereby reducing losses caused by abnormal nodes.

[0146] In some embodiments, the first processing unit is also used to determine the data flow characteristics corresponding to multiple nodes contained in the network in the current time slice, the data flow characteristics include at least one of the number of data packets received by the node in the current time slice, the size of the traffic received by the node in the current time slice, the number of data packets sent by the node in the current time slice, the size of the traffic sent by the node in the current time slice, and the average delay of the node in the current time slice; based on the data flow characteristics corresponding to multiple nodes in the current time slice, a node attribute information matrix corresponding to the network in the current time slice is generated.

[0147] In some embodiments, the second processing unit is also used to convert the node attribute information matrix corresponding to the network in the current time slice to obtain a linear transformation matrix; reconstruct the node attribute information matrix corresponding to the network in the current time slice and the linear transformation matrix to obtain a reconstructed information matrix; establish a residual function based on the linear transformation matrix and the reconstructed information matrix; when the residual function meets the preset conditions, determine the node hash code matrix.

[0148] In some embodiments, the third processing unit is also used to perform a similarity analysis on the hash code of the node and the hash code of the neighbor node for each of the multiple nodes using a similarity function to determine the comprehensive similarity between the node and the neighbor node; determine the abnormality coefficient between the node and the neighbor node based on the comprehensive similarity between the node and the neighbor node; and determine the entropy value of the node in the current time slice using an entropy function based on the abnormality coefficient between the node and the neighbor node.

[0149] In some embodiments, the fourth processing unit is also used to sort the entropy values ​​of multiple nodes contained in the network in the current time slice and multiple adjacent time slices, respectively; determine the entropy value sorting results of multiple nodes in the current time slice and multiple adjacent time slices; when the entropy value sorting results of the node in the current time slice and multiple adjacent time slices meet preset conditions, determine that the node is an abnormal node.

[0150] In some embodiments, the preset condition is that the number of time slices in which the entropy value ranking of the node is within a preset range is greater than or equal to a preset threshold.

[0151] Figure 8 A block diagram of an electronic device 800 for implementing the above method is provided in an embodiment of the present disclosure.

[0152] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present disclosure, the embodiment of the present disclosure also provides an electronic device, such as Figure 8 As shown, the electronic device 800 includes:

[0153] Communication interface 801, capable of exchanging information with other devices;

[0154] The processor 802 is connected to the communication interface 801 to implement information interaction with other devices, and is used to execute the method provided by one or more of the above technical solutions when running the computer program;

[0155] A memory 803 , on which the computer program is stored.

[0156] Specifically, the processor 802 may be configured to determine a first family to which the first object belongs based on the communication data of the first object; determine the first family as a target family when the first family satisfies a first preset condition; and push target information to the target family.

[0157] It should be noted that the specific processing process of the processor 802 can be understood by referring to the above method.

[0158] Of course, in actual application, the various components in the electronic device 800 are coupled together through the bus system 804. It can be understood that the bus system 804 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 804 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 8 Various buses are labeled as bus system 804 .

[0159] The memory 803 in the embodiment of the present application is used to store various types of data to support the operation of the electronic device 800. Examples of such data include: any computer program used to operate on the electronic device 800.

[0160] The method disclosed in the above embodiment of the present application can be applied to the processor 802, or implemented by the processor 802. The processor 802 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 802. The above-mentioned first processor 802 can be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 802 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 803, and the processor 802 reads the information in the memory 803 and completes the steps of the above method in combination with its hardware.

[0161] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0162] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the above instructions can be executed by the processor 820 of the electronic device 800 to complete the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0163] The embodiments of the present disclosure further provide a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the method described in the above embodiments of the present disclosure.

[0164] The embodiment of the present disclosure also provides a chip, such as Fig. 9 As shown, the chip includes a processor 910 and an interface 920. The number of the processor 910 may be one or more, the number of the interface 920 may be multiple, and the interface circuit is used to receive a signal from the memory of the electronic device and send a signal to the processor, the signal includes a computer instruction stored in the memory, and when the processor executes the computer instruction, the electronic device executes the method described in the above embodiment of the present disclosure.

[0165] It should be noted that, for the convenience of description, only the parts related to the relevant invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0166] It should be understood that the "system", "device", "unit" and / or "module" used in this application is a method for distinguishing different components, elements, parts, portions or assemblies at different levels. However, if other words can achieve the same purpose, the word can be replaced by other expressions.

[0167] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "a kind" and / or "the" do not refer to the singular, but also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of clearly identified steps and elements, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements. The elements defined by the sentence "includes a..." do not exclude the existence of other identical elements in the process, method, commodity or device that includes the elements.

[0168] In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0169] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0170] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, the various steps may be processed in reverse order or simultaneously. At the same time, other operations may also be added to these processes, or one or more operations may be removed from these processes.

[0171] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0172] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0173] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processing module, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (control method), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or otherwise processing in a suitable manner if necessary, and then stored in a computer memory.

[0174] It should be understood that the various parts of the embodiments of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0175] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0176] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent commodity, it may also be stored in a computer-readable storage medium. The above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0177] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for determining abnormal nodes, characterized in that: The method comprises: Determine a node attribute information matrix corresponding to the network in the current time slice, wherein the node attribute information matrix is ​​generated according to data flow characteristics of a plurality of nodes included in the network; A hash learning method is used to perform hash representation on the node attribute information matrix to generate a node hash code matrix of the network in the current time slice; Determining entropy values ​​of a plurality of nodes included in the network in a current time slice based on the node hash code matrix; Abnormal nodes in the network are determined according to entropy values ​​of multiple nodes included in the network in a current time slice and multiple adjacent time slices.

2. The method according to claim 1, characterized in that The node attribute information matrix corresponding to the network in the current time slice is determined as follows: Determine data flow characteristics corresponding to multiple nodes included in the network in the current time slice, the data flow characteristics at least including at least one of the number of data packets received by the node in the current time slice, the size of the traffic received by the node in the current time slice, the number of data packets sent by the node in the current time slice, the size of the traffic sent by the node in the current time slice, and the average delay of the node in the current time slice; Based on the data flow characteristics corresponding to the multiple nodes in the current time slice, a node attribute information matrix corresponding to the network in the current time slice is generated.

3. The method according to claim 1, characterized in that The step of using a hash learning method to perform hash representation on the node attribute information matrix to generate a node hash code matrix of the network in the current time slice includes: Transforming the node attribute information matrix corresponding to the network at the current time slice to obtain a linear transformation matrix; Reconstructing the network according to the node attribute information matrix corresponding to the current time slice and the linear transformation matrix to obtain a reconstructed information matrix; Establishing a residual function based on the linear transformation matrix and the reconstruction information matrix; When the residual function satisfies a preset condition, the node hash code matrix is ​​determined.

4. The method according to claim 1, characterized in that: Determining the entropy values ​​of the multiple nodes included in the network in the current time slice based on the node hash code matrix includes: For each of the multiple nodes, using a similarity function to perform a similarity analysis on a hash code of the node and a hash code of a neighboring node to determine a comprehensive similarity between the node and the neighboring node; Determining anomaly coefficients between the node and neighboring nodes based on comprehensive similarities between the node and neighboring nodes; According to the abnormal coefficients of the node and neighboring nodes, an entropy function is used to determine the entropy value of the node in the current time slice.

5. The method according to claim 1, characterized in that The determining of abnormal nodes in the network according to entropy values ​​of multiple nodes included in the network in a current time slice and multiple adjacent time slices includes: sorting entropy values ​​of a plurality of nodes included in the network in a current time slice and a plurality of adjacent time slices respectively; Determine the entropy value sorting results of the multiple nodes in the current time slice and multiple adjacent time slices; When the entropy value sorting results of the node in the current time slice and multiple adjacent time slices meet a preset condition, the node is determined to be an abnormal node.

6. The method according to claim 5, characterized in that The preset condition is that the number of time slices in which the entropy ranking of the node is within a preset range is greater than or equal to a preset threshold.

7. An abnormal node determination device, characterized in that: The device includes: A first processing unit, configured to determine a node attribute information matrix corresponding to a network in a current time slice, wherein the node attribute information matrix is ​​generated according to data flow characteristics of a plurality of nodes included in the network; A second processing unit is used to perform hash representation on the node attribute information matrix by using a hash learning method to generate a node hash code matrix of the network in a current time slice; A third processing unit, configured to determine entropy values ​​of a plurality of nodes included in the network in a current time slice based on the node hash code matrix; The fourth processing unit is used to determine abnormal nodes in the network according to entropy values ​​of multiple nodes included in the network in a current time slice and multiple adjacent time slices.

8. An electronic device, characterized in that: include: one or more processors; A storage device communicatively connected to the one or more processors, on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-6.

10. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images