Abnormal network flow detection method and related hardware

Abstract

The embodiment of the invention provides an abnormal network flow detection method and related hardware, and the method comprises the steps: obtaining a first communication data sequence sent by a target switch through a target agent controller, and obtaining a second communication data sequence corresponding to the target network flow through a detection server after determining that the corresponding target network flow meets a set condition, performing discrete wavelet transform, depth separable convolution and LSTM analysis on the second communication data sequence in sequence, and judging whether the target network traffic is abnormal network traffic or not.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an abnormal network traffic detection method and related hardware. Background Art

[0002] With the continuous development of information technology, the scale of the Internet continues to grow, and it is necessary to provide secure, stable, and reliable connection and forwarding functions to meet the future network dynamics, concurrency, and real-time requirements. As a result, network attack technologies are also constantly developing, bringing major challenges to the normal operation of network facilities. For example, denial of service attacks targeting the available queue capacity of the controller, distributed denial of service (DDoS) attacks targeting the switch flow table, cache, and communication link, and low-rate denial of service (LDoS) attacks targeting protocol vulnerabilities, in addition to attacks against worms and viruses. Network attacks are often accompanied by abnormal network traffic, which manifests as abnormal behavior patterns that do not meet expectations. Therefore, it is necessary to detect abnormal traffic in the network in a timely and accurate manner, and then effectively discover attack behaviors in the network, reduce the impact of malicious attacks on network operations, and maintain the security of network infrastructure. Summary of the invention

[0003] The embodiment of the present invention provides an abnormal network traffic detection method and related hardware for effectively detecting abnormal network traffic.

[0004] In a first aspect, an embodiment of the present invention provides a method for detecting abnormal network traffic, comprising: Acquire a second communication data sequence, wherein the second communication data sequence is determined according to a second network flow of the target switch; the network flow is a communication data sequence generated by the switch corresponding to the network data packet sent and received by the corresponding client; After feature encoding the second communication data sequence, discrete wavelet transform is performed to obtain a plurality of target communication feature subsequences of different frequency bands, and each target communication feature subsequence is merged into a first feature graph; Performing a depthwise separable convolution (DSC) on the first feature map to obtain a second feature map; The second feature map is input into a long short-term memory network (LSTM) for processing to obtain an abnormal traffic probability; the abnormal traffic probability is used to indicate whether the second network traffic is abnormal network traffic.

[0005] Optionally, the step of inputting the second feature map into a long short-term memory network (LSTM) for processing to obtain an abnormal traffic probability specifically includes: Inputting each channel feature of the second feature map into the LSTM unit respectively to obtain the classification evaluation sub-feature corresponding to each channel feature; Input each of the classification evaluation sub-features into a fully connected layer to obtain a classification evaluation total feature output by the fully connected layer; The total classification evaluation feature is input into the classification activation layer to obtain the abnormal traffic probability output by the classification activation layer.

[0006] Optionally, the acquiring the second communication data sequence specifically includes any one of the following: Receiving a second communication data sequence sent by the target switch; Receive a second communication data sequence sent by a target proxy controller; wherein the second communication data sequence is a communication data sequence generated according to a first network flow that satisfies a set condition and is detected by the target proxy controller, using the first network flow as the second network flow.

[0007] Optionally, if the abnormal traffic probability indicates that the second network traffic is abnormal traffic, the method further includes at least one of the following: Notify the target switch to perform a first operation; the first operation is that the target switch closes a first input port within a target time period, and the first input port is an input port that receives a data packet whose destination address is the abnormal destination address; Notify the target switch to perform a second operation; the second operation is that the target switch closes a second input port that has received the second network traffic within a target time period; The target switch is notified to perform a third operation; the third operation is that within a target time period, the target switch is prohibited from sending a forwarding rule query request to the proxy controller.

[0008] Optionally, notifying the target switch to perform a target operation specifically includes: Sending first notification information instructing the target switch to perform the target operation to a centralized controller; causing the centralized controller to generate second notification information instructing the target switch to perform the target operation according to the first notification information, and sending the second notification information to a target proxy controller corresponding to the target switch; causing the target proxy controller to generate third notification information instructing the target switch to perform the target operation according to the second notification information, and sending the third notification information to the target switch through a southbound interface; Wherein, the centralized controller corresponds to a plurality of proxy controllers, and each proxy controller corresponds to at least one switch; The target operation includes at least one of the following: the first operation, the second operation, and the third operation.

[0009] In a second aspect, an embodiment of the present invention provides a method for detecting abnormal network traffic, comprising: Acquire a first communication data sequence sent by the target switch, wherein the first communication data sequence is determined according to a first network flow of the target switch; the network flow is a communication data sequence generated by the switch in response to receiving and sending a network data packet generated by a corresponding client; If it is determined according to the first communication data sequence that the first network traffic meets the set condition, then based on the result that the first network traffic meets the set condition, determining whether the first network traffic is abnormal network traffic; Among them, the set conditions include: the receiving and sending parameters of the network traffic meet the abnormal receiving and sending conditions, and / or the destination address of the network traffic meets the abnormal information entropy conditions.

[0010] Optionally, the determining whether the first network traffic is abnormal network traffic based on the result that the first network traffic satisfies a set condition specifically includes: Instruct the detection server to obtain a second communication data sequence, where the second communication data sequence is determined according to the first network traffic; enable the detection server to perform discrete wavelet transform on the second communication data sequence after feature encoding to obtain multiple target communication feature subsequences of different frequency bands, and merge each target communication feature subsequence into a first feature graph; perform DSC on the first feature graph to obtain a second feature graph; input the second feature graph into LSTM for processing to obtain an abnormal traffic probability; the abnormal traffic probability is used to indicate whether the second network traffic is abnormal network traffic.

[0011] Optionally, the instructing the detection server to obtain the second communication data sequence specifically includes any one of the following: Determine the second communication data sequence according to the first communication data sequence, and send the second communication data sequence to the detection server; The target switch is notified to determine the second communication data sequence according to the first network traffic and send the second communication data sequence to the detection server.

[0012] Optionally, the abnormal sending and receiving condition includes at least one of the following: When the transceiver parameter includes the total number of data packets received by the switch and the total number of data packets sent by the switch: within the specified time period, the ratio of the total number of data packets received by the switch to the total number of data packets sent by the switch is less than a preset first ratio threshold; When the receiving and sending parameters include the total number of data packets received by the switch and the number of forwarding rule query requests sent by the switch to the proxy controller: within a specified time period, a ratio of the total number of data packets received by the switch to the number of forwarding rule query requests sent by the switch to the proxy controller is less than a preset second ratio threshold.

[0013] Optionally, the information entropy abnormal condition includes at least one of the following: (1) In at least one monitoring window, the total information entropy of the destination address of the network traffic is less than a first information entropy threshold; wherein:

[0014] H w For monitoring window w The total information entropy of the destination address of the internal network traffic, N ( w ) is the monitoring window w The total number of destination addresses involved in the data packets in the internal network traffic, d w ( i ) is the monitoring window w In-network traffic i The number of packets corresponding to the destination address, d w To monitor the window w The total number of packets received by the internal switch; (2) In a preset number of consecutive monitoring windows, the average information entropy of the destination address of the network traffic is less than a second information entropy threshold; wherein:

[0015] For monitoring window w The average information entropy of the destination address of the internal network traffic, N ( w ) is the monitoring window w The total number of destination addresses involved in the data packets in the internal network traffic, H w For monitoring window w The total information entropy of the destination address of the internal network traffic; (3) In a preset number of consecutive monitoring windows, there are destination addresses in the network traffic whose information entropy of the destination addresses is less than a third information entropy threshold; wherein:

[0016] h w ( i ) is the first iDestination address in the monitoring window w The destination address information entropy within d w ( i ) is the monitoring window w In-network traffic i The number of packets corresponding to the destination address, d w To monitor the window w The total number of packets received by the internal switch; The monitoring window is the time period corresponding to the switch receiving a preset number of data packets.

[0017] Optionally, the second information entropy threshold H 2 ' Determined by:

[0018] in, M is the preset quantity; The third information entropy threshold Determined by: .

[0019] Optionally, if it is determined that the first network traffic is abnormal network traffic, the method further includes at least one of the following: Notify the target switch to perform a first operation; the first operation is that the target switch closes a first input port within a target time period, and the first input port is an input port that receives a data packet with an abnormal destination address; Notify the target switch to perform a second operation; the second operation is that the target switch closes a second input port that has received the second network traffic within a target time period; The target switch is notified to perform a third operation; the third operation is that within a target time period, the target switch is prohibited from sending a forwarding rule query request to the proxy controller.

[0020] Optionally, notifying the target switch to perform a target operation specifically includes: receiving second notification information sent by the centralized controller for instructing the target switch to perform the target operation, generating third notification information instructing the target switch to perform the target operation according to the second notification information, and sending the third notification information to the target switch through the southbound interface; The second notification information is information generated by the centralized controller according to the first notification information, and the first notification information is information generated by the detection server for instructing the target switch to perform the target operation; Wherein, the centralized controller corresponds to a plurality of proxy controllers, and each proxy controller corresponds to at least one switch; The target operation includes at least one of the following: the first operation, the second operation, and the third operation.

[0021] In a third aspect, an embodiment of the present invention provides an abnormal network traffic detection system, comprising a switch, and at least one of the following: an agent controller, a detection server; in: The proxy controller is used to implement the abnormal network traffic detection method as described in the second aspect; The detection server is used to implement the abnormal network traffic detection method as described in the first aspect.

[0022] Optionally, the system includes: a switch, an agent controller, a centralized controller, and a detection server; Wherein, the centralized controller corresponds to a plurality of proxy controllers, and each proxy controller corresponds to at least one switch; The centralized controller is used to receive the first notification information sent by the detection server and instructing the target switch to perform the target operation, generate the second notification information instructing the target switch to perform the target operation according to the first notification information, and send the second notification information to the target proxy controller corresponding to the target switch; so that the target proxy controller generates the third notification information instructing the target switch to perform the target operation according to the second notification information, and sends the third notification information to the target switch through the southbound interface; The target operation includes at least one of a first operation, a second operation, and a third operation; The first operation is that within the target time period, the target switch closes the first input port, the first input port being the input port that receives the data packet with the destination address being an abnormal destination address; The second operation is that within the target time period, the target switch closes the second input port that has received the second network traffic; The third operation is that within the target time period, the target switch is prohibited from sending a forwarding rule query request to the proxy controller.

[0023] In a fourth aspect, an embodiment of the present invention provides an abnormal network traffic detection device, comprising: A first detection data acquisition module is used to acquire a first communication data sequence sent by a target switch, wherein the first communication data sequence is determined according to a first network flow of the target switch; the network flow is a communication data sequence generated by the switch in response to the network data packets generated by the corresponding client; A first detection module, configured to determine whether the first network traffic is abnormal network traffic based on the result that the first network traffic satisfies the set condition if it is determined according to the first communication data sequence that the first network traffic satisfies the set condition; Among them, the set conditions include: the receiving and sending parameters of the network traffic meet the abnormal receiving and sending conditions, and / or the destination address of the network traffic meets the abnormal information entropy conditions.

[0024] In a fifth aspect, an embodiment of the present invention provides an abnormal network traffic detection device, comprising: A second detection data acquisition module is used to acquire a second communication data sequence, wherein the second communication data sequence is determined according to a second network flow of the target switch; the network flow is a communication data sequence generated by the switch corresponding to the network data packets generated by the corresponding client; The second detection module is used to perform discrete wavelet transform on the second communication data sequence after feature encoding to obtain multiple target communication feature subsequences of different frequency bands, and merge the target communication feature subsequences into a first feature map; perform deep separable convolution DSC on the first feature map to obtain a second feature map; input the second feature map into a long short-term memory network LSTM for processing to obtain an abnormal traffic probability; the abnormal traffic probability is used to indicate whether the second network traffic is abnormal network traffic.

[0025] In a sixth aspect, an embodiment of the present invention provides an electronic device, comprising: a processor and a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the abnormal network traffic detection method as described in the first aspect, or to implement the abnormal network traffic detection method as described in the second aspect.

[0026] In the seventh aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the readable storage medium stores a computer program code, and the computer program code is used to implement the abnormal network traffic detection method as described in the first aspect, or to implement the abnormal network traffic detection method as described in the second aspect.

[0027] In an eighth aspect, an embodiment of the present invention provides a computer program product, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the abnormal network traffic detection method as described in the first aspect, or to implement the abnormal network traffic detection method as described in the second aspect.

[0028] The beneficial effects of the present invention are as follows: The abnormal network traffic detection method and related hardware provided in the embodiment of the present invention analyze the characteristics of network traffic by adopting discrete wavelet transform-DSC-LSTM, and comprehensively analyze from the perspectives of whether the receiving and sending parameters of the network traffic meet the abnormal receiving and sending conditions, whether the destination address of the network traffic meets the abnormal information entropy conditions, etc., so as to effectively and accurately identify abnormal network traffic, thereby facilitating the implementation of subsequent network protection and evidence collection work. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 One of the structural schematic diagrams of the abnormal network traffic detection system provided by an embodiment of the present invention; Figure 2 A second structural diagram of the abnormal network traffic detection system provided by an embodiment of the present invention; Figure 3 A third structural diagram of the abnormal network traffic detection system provided by an embodiment of the present invention; Figure 4 A fourth structural diagram of the abnormal network traffic detection system provided by an embodiment of the present invention; Figure 5 A flow chart of an abnormal network traffic detection method applied to an agent controller provided by an embodiment of the present invention; Figure 6 A flow chart of a method for detecting abnormal network traffic applied to a detection server provided by an embodiment of the present invention; Figure 7 A data flow diagram of an abnormal network traffic detection method applied to a detection server provided by an embodiment of the present invention; Figure 8 A partial flow chart of a method for detecting abnormal network traffic applied to a detection server provided by an embodiment of the present invention; Fig. 9 A flowchart of a method for detecting abnormal network traffic provided by an embodiment of the present invention; Fig.10 One of the structural schematic diagrams of the abnormal network traffic detection device provided by an embodiment of the present invention; Fig.11 A second structural diagram of the abnormal network traffic detection device provided by an embodiment of the present invention; Fig.12 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and understandable, the present invention will be further described below with reference to the accompanying drawings and examples. However, the exemplary embodiments can be implemented in various forms and should not be understood as being limited to the embodiments described herein; on the contrary, these embodiments are provided to make the present invention more comprehensive and complete, and to fully convey the concepts of the exemplary embodiments to those skilled in the art. The same figure marks in the figures represent the same or similar structures, and thus their repeated descriptions will be omitted. The words expressing position and direction described in the present invention are all explained with reference to the accompanying drawings as examples, but changes can be made as needed, and the changes made are all included in the scope of protection of the present invention. The drawings of the present invention are only used to illustrate the relative position relationship and do not represent the true proportion.

[0031] It should be noted that specific details are described in the following description to facilitate a full understanding of the present invention. However, the present invention can be implemented in a variety of other ways different from those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below. The subsequent description of the specification is a preferred embodiment of the present application, but the description is for the purpose of illustrating the general principles of the present application and is not intended to limit the scope of the present application. The scope of protection of the present application shall be determined by the definition of the attached claims.

[0032] The following first introduces some professional terms involved in the embodiments of this application: Software Defined Network (SDN): SDN is a new type of network architecture, usually composed of a forwarding plane, a control plane, and an application plane. The centralized control plane is separated from the distributed forwarding plane. The control plane uses the control-forwarding communication interface (i.e., the southbound interface) to centrally control the network devices of the forwarding plane, and provides flexible programmability to the application plane through the application-control interface (i.e., the northbound interface).

[0033] DDoS: DDoS is a malicious network attack method that aims to prevent the target server, service or network from processing requests normally, thereby preventing legitimate users from accessing or using these resources.

[0034] LDoS: LDoS is a new type of denial of service attack. It uses the adaptive mechanism in the network, especially the congestion control mechanism of TCP, to periodically send short, high-intensity attack data streams, causing a large number of normal TCP streams to be lost, causing the congestion control mechanism to frequently enter the slow start state, thereby reducing the network throughput and achieving the purpose of denial of service.

[0035] Information entropy: Information entropy is the entropy that Claude Elwood Shannon introduced into information theory as a measure of uncertainty in random events. Information entropy can be used to judge the complexity of a system. If a system is more complex and has more different types of situations, then its information entropy is relatively large. On the contrary, if a system is simpler and has fewer types of situations, then its information entropy is relatively small. Considering the existence of random experiments, n random states, and the probability of each state appearing is p 1 , p 2 ,……, p n , the probability change of each state will lead to different state certainty of the random test result, so the information entropy corresponding to the random test result is H n The calculation method is as follows: (1) In formula (1), K as a parameter.

[0036] Depthwise Separable Convolution (DSC): DSC is a technique used in convolutional neural networks to reduce the amount of computation and model parameters while maintaining model performance. It is achieved by decomposing the standard convolution operation into two independent steps, namely depthwise convolution and pointwise convolution, which significantly reduces the computational complexity.

[0037] Long Short Term Memory (LSTM) network: LSTM network is a special recurrent neural network architecture. By introducing a special structure and gating mechanism, it can learn long-term memory information and effectively capture long-term dependencies in time series data without causing gradient vanishing or gradient exploding problems due to the increase in sequence length.

[0038] The abnormal network traffic detection method and related hardware provided by the embodiment of the present invention are specifically described below in conjunction with the accompanying drawings.

[0039] In a first aspect, an embodiment of the present invention provides an abnormal network traffic detection system X. Figure 1-Figure 4 As shown, the abnormal network traffic detection system X includes a switch J and at least one of the following: an agent controller K1 (such as Figure 1 , Figure 2 , Figure 3 As shown), detection server F (as Figure 1 , Figure 2 , Figure 4 As shown). The switches J are respectively connected to the corresponding clients C, and are used to receive network data packets sent by the clients C. The proxy controller K1 is used to implement the abnormal network traffic detection method described in the second aspect below. The detection server is used to implement the abnormal network traffic detection method described in the third aspect below.

[0040] In some embodiments, Figure 1 , Figure 2 As shown, the abnormal network traffic detection system X also includes a centralized controller K2. The role of the centralized controller K2 will be described in the corresponding content of the abnormal network traffic detection method described in the second and third aspects below, and will not be expanded here.

[0041] In some embodiments, the abnormal network traffic detection system X may be part of an SDN network system. Figure 2 As shown, the SDN network system may include a hierarchical structure such as an application plane, a control plane, and a forwarding plane. Among them, the application plane may include an intrusion detection system, a network traffic control system, a load balancing system, an access policy system, etc. The control plane includes a centralized controller K2, an agent controller K1, etc. The application plane communicates with the control plane through a northbound interface. The control plane communicates internally through an east-west interface. The forwarding plane includes a switch J, a client C, etc. The control plane communicates with the forwarding plane through a southbound interface. The southbound interface can be implemented by the agent controller K1 using an application programming interface (Application Programming Interface, API) such as OpenFlow. Further, the SDN network can be divided into multiple subdomains for management, wherein each subdomain is provided with an agent controller K1, and for the agent controller K1 of any subdomain, the agent controller K1 is connected to at least one switch J of the subdomain, and each switch J is connected to at least one client C of the subdomain.

[0042] The specific implementation steps of the abnormal network traffic detection method provided in the embodiment of the present application are described in detail below.

[0043] In a second aspect, an embodiment of the present invention provides a method for detecting abnormal network traffic, which is applied to the proxy controller K1. Figure 5 As shown, the abnormal network traffic detection method includes: S510, obtaining a first communication data sequence sent by a corresponding target switch, wherein the first communication data sequence is determined according to a first network flow of the target switch. The network flow is a communication data sequence generated by the switch in response to receiving and sending network data packets generated by a corresponding client.

[0044] In a specific implementation process, the target switch may directly provide the first network traffic as the first communication data sequence to the proxy controller; the target switch may also extract necessary information from the first network traffic (for example, discarding message information of each network data packet in the first network traffic and retaining only header information, etc.) to obtain the first communication data sequence and provide it to the proxy controller; the present application does not make too many restrictions on this.

[0045] S520: Detect the first network traffic according to the first communication data sequence to determine whether the set condition is met.

[0046] If the first network traffic meets the set conditions, step S530 is executed; if the first network traffic does not meet the set conditions, subsequent business processing is performed normally.

[0047] In the specific implementation process, the proxy controller does not perform any operation after determining that the first network traffic is normal network traffic, and the target switch normally forwards the normal network traffic and performs other business processes. Since this part is not the focus of this application, it will not be elaborated.

[0048] Specifically, the setting conditions include at least one of the following: (1) The network traffic sending and receiving parameters meet the abnormal sending and receiving conditions.

[0049] In the absence of a network attack on the switch, the switch usually has corresponding forwarding rules for most of the data packets in the received network traffic, and can directly forward and divert the received data packets based on the existing forwarding rules. The number of data packets for which the switch lacks corresponding forwarding rules is relatively small. For network attacks such as DDoS and LDoS, the switch can be attacked by sending a large number of abnormal data packets for which the switch lacks corresponding forwarding rules to the network system, forcing the switch to occupy a large amount of performance resources to handle the diversion operation of abnormal data packets. Based on this, the target switch can determine the transceiver parameters of the first network traffic based on the first communication data sequence, and determine whether the first network traffic is abnormal based on the transceiver parameters of the first network traffic.

[0050] Specifically, the network traffic receiving and sending parameters may include at least one of the following: ①The total number of data packets received by the switch within a specified time period Num FlowInSwitch ②The total number of data packets sent by the switch within a specified time period Num FlowOutSwitch ③The number of forwarding rule query requests sent by the switch to the proxy controller within a specified time period Optionally, the forwarding rule query request may be implemented using a Packet_In message. Then the number of forwarding rule query requests sent by the switch to the proxy controller may be: the number of Packet_In message packets sent by the switch to the proxy controller Num PacketIn .

[0051] Accordingly, the abnormal transmission and reception condition can be set to at least one of the following: ①The total number of data packets received by the switch within a specified time period Num FlowInSwitch The total number of packets sent to the switch Num FlowOutSwitch Ratio Rate TransFlowSwitch , which is less than the preset first ratio threshold Rate TransNormalFlow .

[0052] Since it takes a certain amount of time for the switch to divert packets that lack forwarding rules (for example, the switch needs to query the proxy controller for the corresponding forwarding rules and then forward the packets according to the queried forwarding rules), the switch may not be able to complete the forwarding operation for some packets that lack forwarding rules within the specified time period. In the absence of attacks on the switch, the switch already has corresponding forwarding rules for most packets in the received network traffic, and can directly forward the received packets based on the existing forwarding rules. The number of packets that the switch lacks corresponding forwarding rules accounts for a relatively small proportion, so the total number of packets received by the switch within the specified time period is Num FlowInSwitc The total number of packets sent Num FlowOutSwitch Ratio Rate TransFlowSwitch When a network attack on a switch occurs, the attacker can send a large number of abnormal data packets that the switch lacks the corresponding forwarding rules. The switch cannot forward some data packets that lack the corresponding forwarding rules in a timely manner within the specified time period, and the proportion of data packets sent by the switch in the specified time period decreases, and the total number of data packets received by the switch in the specified time period increases. Num FlowInSwitch The total number of packets sent Num FlowOutSwitch Ratio Rate TransFlowSwitch Based on this, for the first network traffic, the total number of packets received by the switch within the specified time period can be Num FlowInSwitch The total number of packets sent to the switch Num FlowOutSwitchRatio Rate TransFlowSwitch The preset first ratio threshold Rate TransNormalFlow The first ratio threshold is preset to determine whether the first network traffic may be abnormal. Rate TransNormalFlow The total number of packets received by the switch when no network attack occurs can be used to calculate the total number of packets received by the switch when no network attack occurs. Num FlowInSwitch The total number of packets sent to the switch Num FlowOutSwitch ratio setting.

[0053] ②The total number of data packets received by the switch within the specified time period Num FlowInSwitch The ratio of the number of forwarding rule query requests sent by the switch to the proxy controller is less than a preset second ratio threshold.

[0054] For packets that lack forwarding rules, the switch can obtain the corresponding forwarding rules by sending forwarding rule query requests to the proxy controller, and then forward the packets based on the forwarding rules. In the absence of a network attack against the switch, the switch already has corresponding forwarding rules for most of the packets in the received network traffic. The number of packets that the switch lacks corresponding forwarding rules is small, so the number of forwarding rule query requests sent is small. Therefore, the total number of packets received by the switch in a specified time period is Num FlowInSwitch When a network attack on a switch occurs, the attacker can send a large number of abnormal data packets to the network system that do not have corresponding forwarding rules, which increases the number of forwarding rule query requests sent by the switch to the proxy controller. The total number of data packets received by the switch in a specified time period is Num FlowInSwitch The ratio of the number of forwarding rule query requests sent by the switch to the proxy controller is abnormally small. Based on this, the total number of packets received by the switch in the specified time period can be Num FlowInSwitch The ratio of the number of forwarding rule query requests sent by the switch to the proxy controller to the preset second ratio threshold is used to determine whether the first network traffic may be abnormal. The preset second ratio threshold can be based on the total number of data packets received by the switch when no network attack occurs. Num FlowInSwitch The ratio setting to the number of forwarding rule query requests sent by the switch to the proxy controller.

[0055] In the specific implementation process, the above two abnormal conditions of sending and receiving can be implemented one by one, or they can be implemented in combination. The pseudo code for combining the above two abnormal conditions of sending and receiving is given below:

[0056] (2) The destination address of the network traffic meets the information entropy anomaly condition.

[0057] For a larger-scale network system, in the absence of a network attack on a business device (such as a business server, a specific client, etc.), the distribution of the destination addresses corresponding to the network data generated by the client is relatively dispersed. For network attacks such as DDoS and LDoS, since they attack specific network devices, a large number of abnormal data packets will be sent to a small number of specific network devices to maliciously occupy the performance resources of specific network devices, thereby disrupting the normal operation of specific network devices. In this way, a large number of data packets in the network traffic are sent to a small number of specific network devices that are attacked, so the distribution of the destination addresses corresponding to the data packets in the network traffic is more concentrated than when no network attack occurs. The distribution of the destination addresses of the network traffic can be measured by information entropy. Based on this, the distribution of the destination addresses of each data packet in the first network traffic can be determined by the first communication data sequence to determine whether the first network traffic is abnormal. Specifically, the information entropy abnormality condition may include at least one of the following: ① In at least one monitoring window, the total information entropy of the destination address corresponding to the network traffic is less than the first information entropy threshold.

[0058] Network traffic in the monitoring window w The total information entropy of the corresponding destination address Satisfies the following relationship: (2) In formula (2), N ( w ) is the monitoring window w The total number of destination addresses involved in the data packets in the internal network traffic, d w ( i ) is the monitoring window w In-network traffic i The number of packets corresponding to the destination address, d w To monitor the window w The monitoring window is the time period during which the switch receives a preset number of packets.

[0059] Furthermore, the first information entropy threshold may be a preset value set according to expert experience.

[0060] ② In a preset number of consecutive monitoring windows, the average information entropy of the destination address of the network traffic is less than the second information entropy threshold. The monitoring window is the time period corresponding to the switch receiving the preset number of data packets.

[0061] For network traffic, monitor the window w The corresponding average information entropy of the destination address Satisfies the following relationship: (3) In formula (3), N ( w ) is the monitoring window w The total number of destination addresses involved in the data packets in the internal network traffic, H w For monitoring window w The total information entropy of the destination address of the internal network traffic. H w It can be determined by formula (2).

[0062] For example, if the preset number is 3, then if there are at least 3 consecutive monitoring windows, and the average information entropy of the destination address corresponding to each monitoring window is less than the second information entropy threshold, it is determined that the information entropy abnormality condition ② is met.

[0063] Compared with information entropy abnormal condition ①, information entropy abnormal condition ② can avoid the situation where normal network traffic is concentrated in a few destination addresses in a short period of time and is misjudged as abnormal network traffic.

[0064] As an optional implementation, the second information entropy threshold may be a preset value set according to expert experience.

[0065] As another optional implementation, the second information entropy threshold H 2 ' Determined by: (4) In formula (4), M is the preset quantity, For monitoring window w The corresponding average information entropy of the destination address. It can be determined by formula (3).

[0066] ③ In a preset number of consecutive monitoring windows, there are destination addresses in the network traffic whose information entropy of the destination addresses is less than the third information entropy threshold. The monitoring window is the time period corresponding to the switch receiving the preset number of data packets.

[0067] Among them, for the network traffic i Destination address, monitoring window w Destination address information entropy h w ( i ) satisfies the following relationship: (5) In formula (5), d w ( i ) is the monitoring window w In-network traffic i The number of packets corresponding to the destination address, d w To monitor the window w The total number of packets received by the internal switch.

[0068] For example, if the preset number is 3, then if there are at least 3 consecutive monitoring windows, there is at least one destination address that satisfies: the information entropy of the destination address corresponding to each monitoring window is less than the third information entropy threshold, then it is determined that the information entropy abnormality condition ③ is met.

[0069] As an optional implementation, the third information entropy threshold may be a preset value set according to expert experience.

[0070] As another optional implementation, the third information entropy threshold H 3 ' Determined by: (6) In formula (6), It can be determined by formula (4).

[0071] In the specific implementation process, the above three information entropy abnormal conditions can be implemented one by one or in combination. The following is a pseudo code for implementing information entropy abnormal condition ③ separately:

[0072] S530: Based on the result that the first network traffic meets the set condition, determine whether the first network traffic is abnormal network traffic.

[0073] In the specific implementation process, the proxy controller can directly determine that the first network traffic that meets the set conditions is abnormal network traffic, or it can further detect the first network traffic that meets the set conditions (for example, the abnormal network traffic detection method of the third aspect to be described in detail later, further detecting the first network traffic through the detection server) to determine whether the first network traffic is abnormal network traffic.

[0074] Further optionally, after the first network traffic is finally determined to be abnormal network traffic through the aforementioned steps, the proxy controller may further control the switch to perform corresponding network defense operations. Specifically, the operations may include at least one of the following: (1) Notifying the target switch to perform a first operation. The first operation is that the target switch closes a first input port within a target time period, where the first input port is an input port that receives a data packet with an abnormal destination address.

[0075] As an optional implementation, if the information entropy anomaly condition ③ described above is used to detect the first network traffic, then the destination address that meets the information entropy anomaly condition ③ (that is, the destination address whose information entropy is less than the third information entropy threshold in a continuous preset number of monitoring windows) can be used as the abnormal destination address.

[0076] As another optional implementation, the legal information items (such as source address, communication protocol, etc.) of the legal data packets received by each device can be pre-set, and then the data packet whose destination address does not correspond to the legal information item of the device pointed to by the destination address is determined as an abnormal data packet, and the destination address of the abnormal data packet is determined as an abnormal destination address.

[0077] Of course, the abnormal destination address may also be determined in other ways, and the embodiment of the present invention does not make too many limitations here.

[0078] (2) Notifying the target switch to perform a second operation. The second operation is that the target switch closes the second input port that has received the first network traffic within the target time period.

[0079] (3) Notify the target switch to perform a third operation. The third operation is that within the target time period, the target switch is prohibited from sending a forwarding rule query request to the corresponding proxy controller.

[0080] The above three network defense operations can be implemented separately or in combination.

[0081] Further optionally, for the SDN network system, if the detection server further detects the first network traffic and finally determines that the first network traffic is abnormal network traffic, the detection server can send a first notification message instructing the target switch to perform the target operation to the centralized controller, so that the centralized controller generates a second notification message instructing the target switch to perform the target operation according to the first notification message, and sends the second notification message to the proxy controller; then the proxy controller generates a third notification message instructing the target switch to perform the target operation according to the second notification message, and sends the third notification message to the target switch through the southbound interface. The target operation is at least one of the first operation, the second operation, and the third operation. The specific content of this part will be described in detail in the second aspect below, and will not be expanded here for the time being. The specific implementation method can be found in the corresponding implementation of the content below.

[0082] In a third aspect, an embodiment of the present invention further provides a method for detecting abnormal network traffic, which is applied to detecting server F. Figure 6 As shown, the abnormal network traffic detection method includes: S610: Obtain a second communication data sequence, wherein the second communication data sequence is determined according to a second network flow of the target switch. The network flow is a communication data sequence generated by the switch in response to receiving and sending network data packets generated by the corresponding client.

[0083] During the specific implementation process, the second network traffic can be directly provided to the detection server as the second communication data sequence; or features can be extracted from the second network traffic (for example, features of the communication protocol type, source port number, destination port number, data packet size, etc. of each data packet in the second network traffic) to obtain the original communication feature sequence, and the original communication feature sequence can be provided to the detection server as the second communication data sequence; the present application does not make too many restrictions on this.

[0084] When extracting features from the second traffic, considering that normal traffic usually comes from or points to known, trusted IP addresses, while abnormal traffic may come from or point to unusual IP addresses, such as geographic locations that are inconsistent with normal user behavior or known malicious IP addresses; normal traffic usually uses common port numbers, while abnormal traffic uses non-standard ports and inactive ports; normal traffic usually uses standard, expected network protocols, while abnormal traffic uses uncommon protocols or uses incorrect protocols on specific ports, the types of features to be extracted can be set to include the source address, destination address, port number, and protocol type of the data packet. In addition, considering that normal traffic usually has stable timing characteristics, such as stable traffic intensity, periodic traffic changes, and uniform time intervals for data packet arrival, while abnormal traffic will have abnormal traffic fluctuations, break the periodic pattern, have unusual traffic duration, abnormal data packet size or large changes in transmission rate, or the time interval for data packet arrival becomes irregular, that is, long intervals or short intervals appear in continuous time, the types of features to be extracted can be set to include the receiving time of the data packet, the size of the data packet, etc.

[0085] As an optional implementation, the step S610 specifically includes: acquiring a second communication data sequence sent by the target switch.

[0086] Further optionally, the second communication data sequence is a communication data sequence generated by the proxy controller when detecting the first network flow that meets the set condition, notifying the switch to use the first network flow that meets the set condition as the second network flow. The specific implementation process of the proxy controller detecting the first network flow to determine whether the set condition is met can be referred to the content of the second aspect, which will not be repeated here. Of course, the second network flow can also be network flow that has not been detected by the abnormal network flow detection method described in the second aspect.

[0087] As another optional implementation, the step S610 specifically includes: obtaining a second communication data sequence sent by the proxy controller. The second communication data sequence is a communication data sequence generated by the proxy controller based on the first network traffic that satisfies the set condition when the proxy controller detects the first network traffic that satisfies the set condition as the second network traffic. Similarly, the specific implementation process of the proxy controller detecting the first network traffic to determine whether the set condition is met can be referred to the content of the second aspect, which will not be repeated here.

[0088] If the second communication data sequence is a communication data sequence generated based on the first network traffic that meets the set condition detected by the proxy controller, the amount of data that needs to be detected by the detection server can be reduced, thereby reducing the computing pressure of the detection server.

[0089] S620: Preprocess the second communication data sequence.

[0090] Specifically, the preprocessing process may include deleting data items with duplicate data, format errors, and data items with most of the data missing in the second communication data sequence; and using a similar filling method to fill in data items with a small number of missing parts to achieve data cleaning of the second communication data sequence.

[0091] S630: Perform feature encoding on the second communication data sequence to obtain a target communication feature sequence.

[0092] In the specific implementation process, if the second communication data sequence is the original second network traffic, the second communication data sequence can be firstly subjected to feature extraction and converted into the original communication feature sequence. Afterwards, the original communication feature sequence is encoded for subsequent processing. Since the features directly extracted from network traffic are mainly in text format and Boolean format, the original communication feature sequence can be encoded using a one-hot encoding method to obtain a target communication feature sequence composed of features in a numerical format, and the one-hot encoding can also make the encoded feature values ​​sparse. Furthermore, the encoded target communication feature sequence can also be normalized for subsequent processing. The present application does not limit the specific implementation method of the normalization process. For example, the following formula can be used to normalize each feature in the target communication feature sequence: (7) In formula (7), X i For feature categories X The i eigenvalues, is the normalized eigenvalue. In this way, by scaling the eigenvalue to the unit norm, the relative difference of the features can be maintained, the feature scale can be balanced, the stability of the algorithm can be improved, and the convergence speed of the machine learning model algorithm in the subsequent steps can be accelerated.

[0093] S640, performing discrete wavelet transform on the target communication feature sequence to obtain multiple target communication feature subsequences of different frequency bands, and merging the target communication feature subsequences into a first feature graph.

[0094] Since the time correlation of time series data is related to frequency, and large time scale correlations such as long-term trends are usually at low frequencies, and small time scale correlations such as short-term interference and events are usually at high frequencies. Therefore, this application uses discrete wavelet transform to convert the input target communication feature sequence Decompose the frequency components into different frequency bands.

[0095] Specifically, Figure 7As shown, the discrete wavelet transform will perform multi-level decomposition on the sequence. Each level of decomposition will further decompose the low-frequency components obtained from the previous level of decomposition (the low-frequency components obtained from the previous level of decomposition corresponding to the first level of decomposition are the original sequence) into the current level of low-frequency components and the current level of high-frequency components. i Decomposition to obtain low frequency components and high frequency components for: (8) In the target communication feature sequence c After level decomposition, we finally obtain the same dimension as the target communication feature sequence c +1 target communication feature subsequence: .

[0096] Afterwards, each target communication feature sequence is used as a channel, and each target communication feature sequence is arranged in a certain order and merged into a dimensional feature map (for example, the dstack function is used to stack the target communication feature sequences along the third dimension to obtain the feature map). a The number of types of features; b The number of features contained in each category of features.

[0097] In this way, the discrete wavelet transform can capture the local and global features of the second network traffic by decomposing the multi-scale features of the target communication feature sequence to improve the algorithm performance and accuracy. At the same time, the computational complexity of the discrete wavelet transform is relatively low, which helps to improve the computational efficiency of the abnormal traffic detection method.

[0098] S650, performing DSC on the first characteristic graph to obtain a second characteristic graph.

[0099] DSC decomposes the standard convolution operation into a depthwise convolution operation and a pointwise convolution operation, where the depthwise convolution operation performs a convolution operation on each input channel separately to extract the spatial features of the data, and the pointwise convolution operation combines features from different channels to extract the channel features of the data.

[0100] like Figure 7 As shown, in the deep convolution operation, the discrete wavelet transform is obtained The first feature map of dimension is used as the input tensor of DSC. Each target communication feature subsequence in the first feature map corresponds to an input channel. For each input channel, a deep convolution is applied. K × K The convolution kernel slides in the spatial dimension to extract the spatial features of the data in each input channel. After the deep convolution operation, we get feature map.

[0101] Specifically, In the feature map, Channels at position Output characteristics It can be expressed as: (9) In formula (9), It is The corresponding channels K × K The convolution kernel is at position The value at It is The channel is located on the first feature map The value of It is The offset term for each channel.

[0102] Point-by-point convolution operation extracts the depth convolution operation The feature map is used 1×1 convolution kernels are used to aggregate information to obtain Specifically, In the second feature map of Channel output characteristics It can be expressed as: (10) In formula (10), It is The 1×1 convolution kernel corresponding to each channel, yes On the feature map k The characteristics of the channels, It is The offset term for each channel.

[0103] DSC extracts the spatial features of the data through deep convolution, and aggregates each channel after point-by-point convolution operation to output the final feature map. Through decomposition operations, DSC greatly reduces the number of parameters and computational complexity, making the model lightweight; at the same time, DSC can effectively extract data-rich spatial features and channel features, and aggregate these features to form new feature maps, thereby improving feature extraction and generalization capabilities.

[0104] S660: Input the second feature map into the LSTM for processing to determine the abnormal traffic probability, wherein the abnormal traffic probability is used to indicate whether the second network traffic is abnormal network traffic.

[0105] Specifically, Figure 8As shown, the above process specifically includes: S661. Input each channel feature of the second feature map into the LSTM unit respectively to obtain the classification evaluation sub-feature corresponding to each channel feature.

[0106] For example, the previous DSC operation yields After the second feature map is obtained, the second feature map is divided into indivual The features are input in sequence into In the LSTM units, each LSTM unit outputs a classification evaluation sub-feature corresponding to a channel, and a total of Classification evaluation sub-features.

[0107] The LSTM unit consists of an input gate, a forget gate, and an output gate, which work together to selectively discard old information and incorporate new input to ultimately form a comprehensive output state. In this application, the input gate first determines which values ​​to update through a Sigmoid layer before deciding which new information to store, and then creates a new candidate value vector through a tanh layer: (11) In formula (11), I t represents the input of the input gate, s represents the Sigmoid activation function, w I represents the weight matrix of the input gate, represents the hidden state at the previous time step, x t represents the input of the current time step, b I represents the bias term of the input gate, represents the new candidate value vector, w c represents the weight matrix of the input gate, b c A bias term that represents the cell state.

[0108] The forget gate determines which information to discard. The calculation formula is as follows: (12) In formula (12), f t represents the output of the forget gate, w f represents the weight matrix of the input gate, b f represents the bias term of the forget gate, s Represents the Sigmoid activation function.

[0109] The cell state is the core of the LSTM cell and carries information about the observed sequence. The cell state is updated as follows: (13) In formula (13), C t represents the cell state at the current time step, f t represents the output of the forget gate, indicating the cell state of the previous time step, I t represents the input of the input gate, Represents a new candidate value vector.

[0110] The output gate determines the value of the next hidden state. The output part is first determined by the Sigmoid layer, and then clipped by the tanh layer, as shown below: (14) In formula (14), represents the output of the output gate, s represents the Sigmoid activation function, w o represents the weight matrix of the output gate, represents the bias term of the input gate, represents the hidden state at the current time step, Represents the cell state at the current time step.

[0111] The input gate of the LSTM unit stores the output information of the DSC and determines which information can be retained in the unit state of the current time step. The forget gate determines which long-term memories to retain and discards part of the unit state of the previous time step. The output gate combines the previous short-term memory and the long-term memory of the current time step to generate a new short-term memory. Due to the gating mechanism of LSTM, it can effectively capture long-term dependencies, allowing the network to retain information in long sequences and improve classification performance.

[0112] S662. Input each classification evaluation sub-feature into the fully connected layer to obtain the classification evaluation total feature output by the fully connected layer.

[0113] S663. Input the total features of the classification evaluation into the classification activation layer to obtain the abnormal traffic probability output by the classification activation layer.

[0114] In the specific implementation process, Figure 7 As shown, the classification activation layer can be a Softmax layer, that is, the classification activation function of the classification activation layer adopts the Softmax function.

[0115] The fully connected layer integrates the classification evaluation sub-features extracted from the second communication data sequence by discrete wavelet transform-DSC-LSTM to obtain a fixed-length classification evaluation total feature. Each element of the classification evaluation total feature corresponds to a type of raw score. The classification activation function converts these raw scores into probability values ​​between 0 and 1, and the sum of all elements is set to 1. According to the abnormal traffic probability output by the classification activation layer, it is finally determined whether the classification type of the second network traffic is abnormal network traffic. For example, the classification evaluation total feature includes 2 elements, one of which indicates that the classification type of the second network traffic is the raw score of abnormal network traffic, and the other element indicates that the classification type of the second network traffic is the raw score of normal network traffic. The probability that the classification type of the second network traffic is abnormal network traffic and the probability of normal network traffic are output through the Softmax layer, and the second network traffic is finally determined to be abnormal network traffic or normal network traffic based on the two probabilities.

[0116] Normal network traffic usually has stable time-frequency characteristics, while abnormal network traffic will have abnormal peaks or absences in certain frequency domains, or high traffic in certain inactive periods. Therefore, the time-frequency characteristics of traffic data reflect the distribution and changes of traffic in different frequency domains. In this way, by using discrete wavelet transform-DSC-LSTM to analyze the communication data sequence corresponding to network traffic, abnormal network traffic can be effectively detected based on the time-frequency characteristics corresponding to network traffic.

[0117] Further optionally, after the second network traffic is finally determined to be abnormal network traffic according to the abnormal traffic probability through the aforementioned steps, the detection server may further control the switch to perform corresponding network defense operations. Specifically, it may include at least one of the following: (1) Notifying the target switch to perform a first operation. The first operation is that the target switch closes a first input port within a target time period, where the first input port is an input port that receives a data packet with an abnormal destination address.

[0118] As an optional implementation, if the second network traffic is network traffic detected by the abnormal network traffic detection method described in the first aspect, and the second network traffic is detected using information entropy abnormal condition ③, then the destination address that meets information entropy abnormal condition ③ (i.e., the destination address whose information entropy is less than the third information entropy threshold in a continuous preset number of monitoring windows) can be used as an abnormal destination address.

[0119] As another optional implementation, the legal information items (such as source address, communication protocol, etc.) of the legal data packets received by each device can be pre-set, and then the data packet whose destination address does not correspond to the legal information item of the device pointed to by the destination address is determined as an abnormal data packet, and the destination address of the abnormal data packet is determined as an abnormal destination address.

[0120] Of course, the abnormal destination address may also be determined in other ways, and the embodiment of the present invention does not make too many limitations here.

[0121] (2) Notifying the target switch to perform a second operation. The second operation is that the target switch closes the second input port that has received the second network traffic within the target time period.

[0122] (3) Notify the target switch to perform a third operation. The third operation is that within the target time period, the target switch is prohibited from sending a forwarding rule query request to the corresponding proxy controller.

[0123] Furthermore, the detection server may directly notify the target switch to perform a target operation, or indirectly notify the target switch to perform a target operation by forwarding a message through other devices, wherein the target operation is at least one of the first operation, the second operation, and the third operation described above.

[0124] For example, for an SDN network system, the detection server can send a first notification message instructing the target switch to perform a target operation to a centralized controller, so that the centralized controller generates a second notification message instructing the target switch to perform the target operation based on the first notification message, and sends the second notification message to a target proxy controller corresponding to the target switch; further, the target proxy controller generates a third notification message instructing the target switch to perform the target operation based on the second notification message, and sends the third notification message to the target switch through the southbound interface.

[0125] Furthermore, the program instructions for the target switch to implement the target operation can be pre-stored in the target switch, and the first notification information, the second notification information, and the third notification information can only carry notification messages for executing the program instructions for the target operation; or, the program instructions for the target switch to implement the target operation are generated by the detection server / centralized controller / proxy controller, and when the detection server generates the first notification information / the centralized controller generates the second notification information / the proxy controller generates the third notification information, the program instructions for implementing the target operation are added to the first notification information / the second notification information / the third notification information. The program instructions for implementing the target operation generated by the detection server / centralized controller / proxy controller can facilitate the maintenance of the program instructions for the target operation by the operation and maintenance personnel. Considering that the detection server and the proxy controller in the technical solution of the present application undertake a large number of abnormal traffic detection operations, it is preferred that the program instructions for the target operation are generated by the centralized controller to reduce the pressure on the detection server and the proxy controller.

[0126] The above three network defense operations can be implemented separately or in combination.

[0127] For example, the pseudo code for implementing the first operation alone is as follows:

[0128] For another example, the pseudo code for combining the second operation and the third operation is as follows:

[0129] In a fourth aspect, based on the above-mentioned inventive concept, the present application embodiment also provides a method for detecting abnormal network traffic, such as Fig. 9 As shown, including: S910: The target proxy controller obtains a first communication data sequence sent by the target switch, wherein the first communication data sequence is determined according to the target network traffic of the target switch. The network traffic is the communication data sequence generated by the switch when sending and receiving network data packets generated by the corresponding client.

[0130] S920: The target proxy controller determines whether the target network traffic meets a set condition according to the first communication data sequence.

[0131] The setting conditions include: the receiving and sending parameters of the network traffic meet the abnormal receiving and sending conditions, and / or the destination address of the network traffic meets the abnormal information entropy conditions.

[0132] If the set conditions are met, step S930 is executed; if the set conditions are not met, other devices perform subsequent business operations normally.

[0133] Optionally, the abnormal sending and receiving condition includes at least one of the following: (1) When the receiving and sending parameters include the total number of data packets received by the switch and the total number of data packets sent by the switch: within a specified time period, a ratio of the total number of data packets received by the switch to the total number of data packets sent by the switch is less than a preset first ratio threshold.

[0134] (2) When the receiving and sending parameters include the total number of data packets received by the switch and the number of forwarding rule query requests sent by the switch to the proxy controller: within a specified time period, a ratio of the total number of data packets received by the switch to the number of forwarding rule query requests sent by the switch to the proxy controller is less than a preset second ratio threshold.

[0135] Optionally, the information entropy abnormal condition includes at least one of the following: (1) In at least one monitoring window, the total information entropy of the destination address of the network traffic is less than a first information entropy threshold.

[0136] in:

[0137] H w For monitoring window w The total information entropy of the destination address of the internal network traffic, N ( w ) is the monitoring window w The total number of destination addresses involved in the data packets in the internal network traffic, For monitoring window w In-network traffic i The number of packets corresponding to the destination address, d w To monitor the window w The total number of packets received by the internal switch.

[0138] (2) In a preset number of consecutive monitoring windows, the average information entropy of the destination address of the network traffic is less than a second information entropy threshold; wherein:

[0139] For monitoring window w The average information entropy of the destination address of the internal network traffic, N ( w ) is the monitoring window w The total number of destination addresses involved in the data packets in the internal network traffic, H w For monitoring window w The total information entropy of the destination address of the internal network traffic.

[0140] (3) In a preset number of consecutive monitoring windows, there are destination addresses in the network traffic whose information entropy of the destination addresses is less than a third information entropy threshold; wherein:

[0141] h w ( i ) is the first i Destination address in the monitoring window w The destination address information entropy within For monitoring window w In-network traffic i The number of packets corresponding to the destination address, d w To monitor the window w The total number of packets received by the internal switch.

[0142] The monitoring window is the time period corresponding to the switch receiving a preset number of data packets.

[0143] Further optionally, the second information entropy threshold Determined by:

[0144] in, M The preset quantity.

[0145] Further optionally, the third information entropy threshold Determined by: .

[0146] S930: The detection server obtains a second communication data sequence, where the second communication data sequence is determined according to target network traffic of the target switch.

[0147] As an optional implementation manner, the second communication data sequence is a communication data sequence generated by the target switch according to the target network traffic and sent to the detection server.

[0148] As another optional implementation, the second communication data sequence is a communication data sequence generated by the target proxy controller according to the first communication data sequence and sent to the detection server.

[0149] S940: After feature encoding the second communication data sequence, the detection server performs discrete wavelet transform to obtain a plurality of target communication feature subsequences of different frequency bands, and merges each target communication feature subsequence into a first feature graph.

[0150] S950. The detection server performs DSC on the first feature map to obtain a second feature map.

[0151] S960: The detection server inputs the second feature map into the LSTM for processing to obtain an abnormal traffic probability. The abnormal traffic probability is used to indicate whether the second network traffic is abnormal network traffic.

[0152] Specifically, the detection server inputs the second feature map into a long short-term memory network LSTM for processing to obtain an abnormal traffic probability, including: The detection server inputs each channel feature of the second feature map into the LSTM unit respectively to obtain the classification evaluation sub-feature corresponding to each channel feature; inputs each classification evaluation sub-feature into the fully connected layer to obtain the classification evaluation total feature output by the fully connected layer; inputs the classification evaluation total feature into the classification activation layer to obtain the abnormal traffic probability output by the classification activation layer.

[0153] Further optionally, if the abnormal traffic probability indicates that the second network traffic is abnormal traffic, the method further includes at least one of the following: The detection server notifies the target switch to perform a first operation. The first operation is that within a target time period, the target switch closes a first input port, where the first input port is an input port that receives a data packet with an abnormal destination address.

[0154] The detection server notifies the target switch to perform a second operation. The second operation is that the target switch closes the second input port that has received the second network traffic within the target time period.

[0155] The detection server notifies the target switch to perform a third operation. The third operation is that within a target time period, the target switch is prohibited from sending a forwarding rule query request to the proxy controller.

[0156] Further optionally, the detection server notifies the target switch to perform a target operation, specifically including: The detection server sends first notification information instructing the target switch to perform the target operation to the centralized controller; The centralized controller generates second notification information instructing the target switch to perform the target operation according to the first notification information, and sends the second notification information to the target proxy controller; The target proxy controller generates third notification information instructing the target switch to perform the target operation according to the second notification information, and sends the third notification information to the target switch through the southbound interface.

[0157] The target operation includes at least one of the following: a first operation, a second operation, and a third operation.

[0158] Since the abnormal network traffic detection method provided in the fourth aspect is the same or similar to the inventive concepts of the first to third aspects, the specific implementation methods can be implemented by referring to the corresponding contents of the first to third aspects and will not be repeated here.

[0159] In this way, through the abnormal network traffic detection method provided by the fourth aspect, the network traffic can be first detected by the proxy controller, and when the proxy controller preliminarily determines that there may be an abnormality, it is handed over to the detection server for further judgment, thereby effectively reducing the amount of data that the detection server needs to detect and improving detection efficiency.

[0160] In a fifth aspect, based on the same inventive concept, the embodiment of the present application also provides an abnormal network traffic detection device, such as Fig.10 Shown, including The first detection data acquisition module M100 is used to acquire a first communication data sequence sent by a target switch, wherein the first communication data sequence is determined according to a first network flow of the target switch; the network flow is a communication data sequence generated by the switch when sending and receiving network data packets generated by a corresponding client; A first detection module M110 is configured to determine whether the first network traffic is abnormal network traffic based on the result that the first network traffic satisfies the set condition if it is determined according to the first communication data sequence that the first network traffic satisfies the set condition; Among them, the set conditions include: the receiving and sending parameters of the network traffic meet the abnormal receiving and sending conditions, and / or the destination address of the network traffic meets the abnormal information entropy conditions.

[0161] Optionally, the determining whether the first network traffic is abnormal network traffic based on the result that the first network traffic satisfies a set condition specifically includes: Instruct the detection server to obtain a second communication data sequence, where the second communication data sequence is determined according to the first network traffic; enable the detection server to perform discrete wavelet transform on the second communication data sequence after feature encoding to obtain multiple target communication feature subsequences of different frequency bands, and merge each target communication feature subsequence into a first feature graph; perform DSC on the first feature graph to obtain a second feature graph; input the second feature graph into LSTM for processing to obtain an abnormal traffic probability; the abnormal traffic probability is used to indicate whether the second network traffic is abnormal network traffic.

[0162] Optionally, the instructing the detection server to obtain the second communication data sequence specifically includes any one of the following: Determine the second communication data sequence according to the first communication data sequence, and send the second communication data sequence to the detection server; The target switch is notified to determine the second communication data sequence according to the first network traffic and send the second communication data sequence to the detection server.

[0163] Optionally, the abnormal sending and receiving condition includes at least one of the following: When the transceiver parameter includes the total number of data packets received by the switch and the total number of data packets sent by the switch: within the specified time period, the ratio of the total number of data packets received by the switch to the total number of data packets sent by the switch is less than a preset first ratio threshold; When the receiving and sending parameters include the total number of data packets received by the switch and the number of forwarding rule query requests sent by the switch to the proxy controller: within a specified time period, a ratio of the total number of data packets received by the switch to the number of forwarding rule query requests sent by the switch to the proxy controller is less than a preset second ratio threshold.

[0164] Optionally, the information entropy abnormal condition includes at least one of the following: (1) In at least one monitoring window, the total information entropy of the destination address of the network traffic is less than a first information entropy threshold; wherein:

[0165] H w For monitoring window w The total information entropy of the destination address of the internal network traffic, N ( w ) is the monitoring window w The total number of destination addresses involved in the data packets in the internal network traffic, For monitoring window w In-network traffic i The number of packets corresponding to the destination address, d w To monitor the window w The total number of packets received by the internal switch.

[0166] (2) In a preset number of consecutive monitoring windows, the average information entropy of the destination address of the network traffic is less than a second information entropy threshold; wherein:

[0167] For monitoring window w The average information entropy of the destination address of the internal network traffic, N ( w ) is the monitoring window w The total number of destination addresses involved in the data packets in the internal network traffic, H w For monitoring window wThe total information entropy of the destination address of the internal network traffic.

[0168] (3) In a preset number of consecutive monitoring windows, there are destination addresses in the network traffic whose information entropy of the destination addresses is less than a third information entropy threshold; wherein:

[0169] The network traffic i Destination address in the monitoring window w The destination address information entropy within For monitoring window w In-network traffic i The number of packets corresponding to the destination address, d w To monitor the window w The total number of packets received by the internal switch.

[0170] The monitoring window is the time period corresponding to the switch receiving a preset number of data packets.

[0171] Optionally, the second information entropy threshold H 2 ' Determined by:

[0172] in, M The preset quantity.

[0173] Optionally, the third information entropy threshold Determined by:

[0174] Optionally, the abnormal network traffic detection device further includes a first processing module M120, configured to implement at least one of the following: Notify the target switch to perform a first operation; the first operation is that the target switch closes a first input port within a target time period, and the first input port is an input port that receives a data packet with an abnormal destination address; Notify the target switch to perform a second operation; the second operation is that the target switch closes a second input port that has received the second network traffic within a target time period; The target switch is notified to perform a third operation; the third operation is that within a target time period, the target switch is prohibited from sending a forwarding rule query request to the proxy controller.

[0175] Optionally, notifying the target switch to perform a target operation specifically includes: receiving second notification information sent by the centralized controller for instructing the target switch to perform the target operation, generating third notification information instructing the target switch to perform the target operation according to the second notification information, and sending the third notification information to the target switch through the southbound interface; The second notification information is information generated by the centralized controller according to the first notification information, and the first notification information is information generated by the detection server for instructing the target switch to perform the target operation; Wherein, the centralized controller corresponds to a plurality of proxy controllers, and each proxy controller corresponds to at least one switch; The target operation includes at least one of the following: the first operation, the second operation, and the third operation.

[0176] In a sixth aspect, based on the same inventive concept, the present application embodiment also provides an abnormal network traffic detection device, such as Fig.11 As shown, including: The second detection data acquisition module M200 is used to acquire a second communication data sequence, wherein the second communication data sequence is determined according to a second network flow of the target switch; the network flow is a communication data sequence generated by the switch sending and receiving network data packets generated by the corresponding client; The second detection module M210 is used to perform discrete wavelet transform on the second communication data sequence after feature encoding to obtain multiple target communication feature subsequences of different frequency bands, and merge the target communication feature subsequences into a first feature map; perform deep separable convolution DSC on the first feature map to obtain a second feature map; input the second feature map into a long short-term memory network LSTM for processing to obtain an abnormal traffic probability; the abnormal traffic probability is used to indicate whether the second network traffic is abnormal network traffic.

[0177] Optionally, the step of inputting the second feature map into a long short-term memory network (LSTM) for processing to obtain an abnormal traffic probability specifically includes: Inputting each channel feature of the second feature map into the LSTM unit respectively to obtain the classification evaluation sub-feature corresponding to each channel feature; Input each of the classification evaluation sub-features into a fully connected layer to obtain a classification evaluation total feature output by the fully connected layer; The total classification evaluation feature is input into the classification activation layer to obtain the abnormal traffic probability output by the classification activation layer.

[0178] Optionally, the acquiring the second communication data sequence specifically includes any one of the following: Receiving a second communication data sequence sent by the target switch; Receive a second communication data sequence sent by a target proxy controller; wherein the second communication data sequence is a communication data sequence generated according to a first network flow that satisfies a set condition and is detected by the target proxy controller, using the first network flow as the second network flow.

[0179] Optionally, the abnormal network traffic detection device further includes a second processing module M220, configured to implement at least one of the following: Notify the target switch to perform a first operation; the first operation is that the target switch closes a first input port within a target time period, and the first input port is an input port that receives a data packet whose destination address is the abnormal destination address; Notify the target switch to perform a second operation; the second operation is that the target switch closes a second input port that has received the second network traffic within a target time period; The target switch is notified to perform a third operation; the third operation is that within a target time period, the target switch is prohibited from sending a forwarding rule query request to the proxy controller.

[0180] Optionally, notifying the target switch to perform a target operation specifically includes: Sending first notification information instructing the target switch to perform the target operation to a centralized controller; causing the centralized controller to generate second notification information instructing the target switch to perform the target operation according to the first notification information, and sending the second notification information to a target proxy controller corresponding to the target switch; causing the target proxy controller to generate third notification information instructing the target switch to perform the target operation according to the second notification information, and sending the third notification information to the target switch through a southbound interface; Wherein, the centralized controller corresponds to a plurality of proxy controllers, and each proxy controller corresponds to at least one switch; The target operation includes at least one of the following: the first operation, the second operation, and the third operation.

[0181] It should be understood that the abnormal flow detection device embodiment provided in the embodiment of the present invention is only schematic. For example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms. The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, each functional module in the embodiment of the present application can be integrated in a processing module, or each module can exist physically separately, or two or more modules can be integrated in one module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software functional modules. If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a readable storage medium.

[0182] Since the working principles of the abnormal flow detection devices described in the fifth and sixth aspects are consistent with the abnormal flow detection methods described in the second and third aspects respectively, the specific implementation process of the devices can refer to the implementation of the corresponding methods and will not be repeated here.

[0183] In a seventh aspect, based on the same inventive concept, the present application embodiment further provides an electronic device, such as Fig.12 As shown, a processor 110 and a memory 120 for storing instructions executable by the processor 110 .

[0184] The processor 110 is configured to execute the instructions to implement the abnormal network traffic detection method as described in the second aspect or the third aspect.

[0185] In the specific implementation process, the device may have relatively large differences due to different configurations or performances. For example, the device may include one or more processors 110 and a memory 120, and the memory 120 includes one or more applications or data. The processor 110 may include a central processing unit (CPU), a graphics processing unit (GPU), a neural network processor (NPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a complex programmable logic device (CPLD), a field programmable gate array (FPGA), etc. The memory 120 may also include one or more operating systems, such as Windows, MacOS, Linux, IOS, Android, Unix, FreeBSD, etc. The memory 120 may be a short-term storage or a persistent storage. The application may include one or more of the modules ( Fig.12 Each module may include a series of instruction operations. Furthermore, the device also includes one or more communication interfaces 130.

[0186] In the eighth aspect, based on the same inventive concept, an embodiment of the present application provides a readable storage medium, wherein the readable storage medium stores a computer program code, and the computer program code is used to implement the abnormal network traffic detection method as described in any one of the second to fourth aspects.

[0187] In the specific implementation process, any combination of one or more programming languages ​​can be used to write computer program codes for implementing the abnormal network traffic detection method as described above. The programming languages ​​include object-oriented programming languages ​​such as Java, C++, C#, etc., and conventional procedural programming languages ​​such as "C" language, assembly language or similar programming languages.

[0188] In the specific implementation process, the readable storage medium can be any available medium that can be stored by a computer or a data storage device such as a configuration server, data center, etc. that includes one or more available media integrated. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (such as a high-density digital video disc (DVD), a video compact disc (VCD)), or a semiconductor medium (such as a solid state disk (SSD)).

[0189] Since the principle of solving the problem by the above-mentioned readable storage medium corresponds to the abnormal network traffic detection method described in the second to fourth aspects above, the implementation of the above-mentioned readable storage medium can refer to the implementation of the corresponding method, and the repeated parts will not be repeated.

[0190] In the ninth aspect, based on the same inventive concept, the embodiment of the present application also provides a computer program product, which includes: a computer program code, when the computer program code is run on a computer, the computer implements the abnormal network traffic detection method described in any one of the second to fourth aspects above.

[0191] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a readable storage medium, or transmitted from one readable storage medium to another readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, configuration server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method to another website site, computer, configuration server or data center.

[0192] Since the principle of solving the problem by the above-mentioned computer program product corresponds to the abnormal network traffic detection method described in the second to fourth aspects above, the implementation of the above-mentioned computer program product can refer to the implementation of the corresponding method, and the repeated parts will not be repeated.

[0193] The abnormal network traffic detection method and related hardware provided in the embodiment of the present invention analyze the characteristics of network traffic by adopting discrete wavelet transform-DSC-LSTM, and comprehensively analyze from the perspectives of whether the receiving and sending parameters of the network traffic meet the abnormal receiving and sending conditions, whether the destination address of the network traffic meets the abnormal information entropy conditions, etc., so as to effectively and accurately identify abnormal network traffic, thereby facilitating the implementation of subsequent network protection and evidence collection work.

[0194] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0195] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0196] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0197] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0198] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting abnormal network traffic, characterized in that: include: Acquire a second communication data sequence, wherein the second communication data sequence is determined according to a second network flow of the target switch; the network flow is a communication data sequence generated by the switch corresponding to the network data packet generated by the corresponding client; After feature encoding the second communication data sequence, discrete wavelet transform is performed to obtain a plurality of target communication feature subsequences of different frequency bands, and each target communication feature subsequence is merged into a first feature graph; Performing depthwise separable convolution (DSC) on the first feature map to obtain a second feature map; The second feature map is input into a long short-term memory network (LSTM) for processing to obtain an abnormal traffic probability; the abnormal traffic probability is used to indicate whether the second network traffic is abnormal network traffic.

2. The method according to claim 1, characterized in that The step of inputting the second feature graph into a long short-term memory network LSTM for processing to obtain an abnormal traffic probability specifically includes: Inputting each channel feature of the second feature map into the LSTM unit respectively to obtain the classification evaluation sub-feature corresponding to each channel feature; Input each of the classification evaluation sub-features into a fully connected layer to obtain a classification evaluation total feature output by the fully connected layer; The total classification evaluation feature is input into the classification activation layer to obtain the abnormal traffic probability output by the classification activation layer.

3. The method according to claim 1, characterized in that The acquiring of the second communication data sequence specifically includes any one of the following: Receiving a second communication data sequence sent by the target switch; Receive a second communication data sequence sent by the target proxy controller; wherein the second communication data sequence is a communication data sequence generated according to the first network traffic that meets the set conditions when the target proxy controller detects the first network traffic as the second network traffic.

4. The method according to claim 1, characterized in that If the abnormal traffic probability indicates that the second network traffic is abnormal traffic, the method further includes at least one of the following: Notify the target switch to perform a first operation; the first operation is that the target switch closes a first input port within a target time period, and the first input port is an input port that receives a data packet with an abnormal destination address; Notify the target switch to perform a second operation; the second operation is that the target switch closes a second input port that has received the second network traffic within a target time period; The target switch is notified to perform a third operation; the third operation is that within a target time period, the target switch is prohibited from sending a forwarding rule query request to the proxy controller.

5. The method according to claim 4, characterized in that Notifying the target switch to perform a target operation, specifically including: Sending first notification information instructing the target switch to perform the target operation to a centralized controller; causing the centralized controller to generate second notification information instructing the target switch to perform the target operation according to the first notification information, and sending the second notification information to a target proxy controller corresponding to the target switch; causing the target proxy controller to generate third notification information instructing the target switch to perform the target operation according to the second notification information, and sending the third notification information to the target switch through a southbound interface; Wherein, the centralized controller corresponds to a plurality of proxy controllers, and each proxy controller corresponds to at least one switch; The target operation includes at least one of the following: the first operation, the second operation, and the third operation.

6. A method for detecting abnormal network traffic, characterized in that: include: Acquire a first communication data sequence sent by the target switch, wherein the first communication data sequence is determined according to a first network flow of the target switch; the network flow is a communication data sequence generated by the switch in response to receiving and sending a network data packet generated by a corresponding client; If it is determined according to the first communication data sequence that the first network traffic meets the set condition, then based on the result that the first network traffic meets the set condition, determining whether the first network traffic is abnormal network traffic; Among them, the set conditions include: the receiving and sending parameters of the network traffic meet the abnormal receiving and sending conditions, and / or the destination address of the network traffic meets the abnormal information entropy conditions.

7. The method according to claim 6, characterized in that The determining whether the first network traffic is abnormal network traffic based on the result that the first network traffic satisfies the set condition specifically includes: Instruct the detection server to obtain a second communication data sequence, where the second communication data sequence is determined according to the first network traffic; so that the detection server performs feature encoding on the second communication data sequence, and then performs discrete wavelet transform to obtain multiple target communication feature subsequences of different frequency bands, and merges each target communication feature subsequence into a first feature graph; performs DSC on the first feature graph to obtain a second feature graph; inputs the second feature graph into LSTM for processing to obtain an abnormal traffic probability; the abnormal traffic probability is used to indicate whether the first network traffic is abnormal network traffic.

8. The method according to claim 7, characterized in that: The step of instructing the detection server to obtain the second communication data sequence specifically includes any one of the following: Determine the second communication data sequence according to the first communication data sequence, and send the second communication data sequence to the detection server; The target switch is notified to determine the second communication data sequence according to the first network traffic, and send the second communication data sequence to the detection server.

9. The method according to claim 6, characterized in that The abnormal transmission and reception conditions include at least one of the following: When the transceiver parameter includes the total number of data packets received by the switch and the total number of data packets sent by the switch: within the specified time period, the ratio of the total number of data packets received by the switch to the total number of data packets sent by the switch is less than a preset first ratio threshold; When the receiving and sending parameters include the total number of data packets received by the switch and the number of forwarding rule query requests sent by the switch to the proxy controller: within a specified time period, a ratio of the total number of data packets received by the switch to the number of forwarding rule query requests sent by the switch to the proxy controller is less than a preset second ratio threshold.

10. The method according to claim 6, characterized in that The information entropy abnormal condition includes at least one of the following: (1) In at least one monitoring window, the total information entropy of the destination address of the network traffic is less than a first information entropy threshold; wherein: ; H w For monitoring window w The total information entropy of the destination address of the internal network traffic, N ( w ) is the monitoring window w The total number of destination addresses involved in the data packets in the internal network traffic, d w ( i ) is the monitoring window w In-network traffic i The number of packets corresponding to the destination address, d w To monitor the window w The total number of packets received by the internal switch; (2) In a preset number of consecutive monitoring windows, the average information entropy of the destination address of the network traffic is less than a second information entropy threshold; wherein: ; For monitoring window w The average information entropy of the destination address of the internal network traffic, N ( w ) is the monitoring window w The total number of destination addresses involved in the data packets in the internal network traffic, H w For monitoring window w The total information entropy of the destination address of the internal network traffic; (3) In a preset number of consecutive monitoring windows, there are destination addresses in the network traffic whose information entropy of the destination addresses is less than a third information entropy threshold; wherein: ; h w ( i ) is the first i Destination address in the monitoring window w The destination address information entropy within d w ( i ) is the monitoring window w In-network traffic i The number of packets corresponding to the destination address, d w To monitor the window w The total number of packets received by the internal switch; The monitoring window is the time period corresponding to the switch receiving a preset number of data packets.

11. The method according to claim 10, characterized in that The second information entropy threshold Determined by: ; in, M is the preset quantity; The third information entropy threshold Determined by: 。 12. The method according to claim 6 or 7, characterized in that: If it is determined that the first network traffic is abnormal network traffic, the method further includes at least one of the following: Notify the target switch to perform a first operation; the first operation is that the target switch closes a first input port within a target time period, and the first input port is an input port that receives a data packet with an abnormal destination address; Notify the target switch to perform a second operation; the second operation is that the target switch closes a second input port that has received the first network traffic within a target time period; The target switch is notified to perform a third operation; the third operation is that within a target time period, the target switch is prohibited from sending a forwarding rule query request to the proxy controller.

13. The method according to claim 12, characterized in that Notifying the target switch to perform a target operation, specifically including: receiving second notification information sent by the centralized controller for instructing the target switch to perform the target operation, generating third notification information instructing the target switch to perform the target operation according to the second notification information, and sending the third notification information to the target switch through the southbound interface; The second notification information is information generated by the centralized controller according to the first notification information, and the first notification information is information generated by the detection server for instructing the target switch to perform the target operation; Wherein, the centralized controller corresponds to a plurality of proxy controllers, and each proxy controller corresponds to at least one switch; The target operation includes at least one of the following: the first operation, the second operation, and the third operation.

14. An abnormal network traffic detection system, characterized in that: It includes a switch, and at least one of the following: an agent controller, a detection server; in: The proxy controller is used to implement the abnormal network traffic detection method according to any one of claims 6 to 13; The detection server is used to implement the abnormal network traffic detection method as described in any one of claims 1-5.

15. The system of claim 14, wherein: The system includes: a switch, an agent controller, a centralized controller, and a detection server; Wherein, the centralized controller corresponds to a plurality of proxy controllers, and each proxy controller corresponds to at least one switch; The centralized controller is used to receive the first notification information sent by the detection server and instructing the target switch to perform the target operation, generate the second notification information instructing the target switch to perform the target operation according to the first notification information, and send the second notification information to the target proxy controller corresponding to the target switch; so that the target proxy controller generates the third notification information instructing the target switch to perform the target operation according to the second notification information, and sends the third notification information to the target switch through the southbound interface; The target operation includes at least one of a first operation, a second operation, and a third operation; The first operation is that within the target time period, the target switch closes the first input port, the first input port being the input port that receives the data packet with the destination address being an abnormal destination address; The second operation is that within the target time period, the target switch closes the second input port that has received the second network traffic; The third operation is that within the target time period, the target switch is prohibited from sending a forwarding rule query request to the proxy controller.

16. An abnormal network traffic detection device, characterized in that: include: A first detection data acquisition module is used to acquire a first communication data sequence sent by a target switch, wherein the first communication data sequence is determined according to a first network flow of the target switch; the network flow is a communication data sequence generated by the switch in response to the network data packets generated by the corresponding client; A first detection module, configured to determine whether the first network traffic is abnormal network traffic based on the result that the first network traffic satisfies the set condition if it is determined according to the first communication data sequence that the first network traffic satisfies the set condition; Among them, the set conditions include: the receiving and sending parameters of the network traffic meet the abnormal receiving and sending conditions, and / or the destination address of the network traffic meets the abnormal information entropy conditions.

17. An abnormal network traffic detection device, characterized in that: include: A second detection data acquisition module is used to acquire a second communication data sequence, wherein the second communication data sequence is determined according to a second network flow of the target switch; the network flow is a communication data sequence generated by the switch corresponding to the network data packets generated by the corresponding client; The second detection module is used to perform discrete wavelet transform on the second communication data sequence after feature encoding to obtain multiple target communication feature subsequences of different frequency bands, and merge the target communication feature subsequences into a first feature map; perform deep separable convolution DSC on the first feature map to obtain a second feature map; input the second feature map into a long short-term memory network LSTM for processing to obtain an abnormal traffic probability; the abnormal traffic probability is used to indicate whether the second network traffic is abnormal network traffic.

18. An electronic device, characterized in that: include: a processor and a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the abnormal network traffic detection method as described in any one of claims 1 to 5, or to implement the abnormal network traffic detection method as described in any one of claims 6 to 13.

19. A readable storage medium, characterized in that: The readable storage medium stores computer program codes, and the computer program codes are used to implement the abnormal network traffic detection method as described in any one of claims 1-5, or to implement the abnormal network traffic detection method as described in any one of claims 6-13.

20. A computer program product, characterized in that The computer program product comprises: a computer program code, which, when executed on a computer, enables the computer to implement the abnormal network traffic detection method as claimed in any one of claims 1 to 5, or to implement the abnormal network traffic detection method as claimed in any one of claims 6 to 13.

Images