Data flow detection method, device, computer equipment and storage medium

Abstract

The embodiment of the present application discloses a data flow detection method, device, computer equipment and storage medium. Among them, by obtaining the data flow in the network to be detected, the five-tuple information of the data flow is determined; the hash value of the data flow is determined according to the preset hash function, and the hash value is determined to determine the target hash bucket corresponding to the data flow in the preset hash bucket array; the five-tuple information is compared with the five-tuple information stored in the preset hash bucket array to obtain a comparison result, and the storage position corresponding to the data flow is determined in the target hash bucket according to the comparison result; the number of occurrence windows and the average network rate corresponding to the data flow are determined, and the number of occurrence windows, the average network rate and the five-tuple information corresponding to the data flow are stored in the storage position of the target hash bucket to update the saved hash bucket data; according to the hash bucket data, the target data flow whose average network rate and the number of occurrence windows do not meet the preset conditions is determined, and the target data flow is subjected to network security detection.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data flow detection method, device, computer equipment and storage medium. Background Art

[0002] With the explosive growth of network users and network scale, the huge amount of traffic in the network has become unpredictable, which has brought great challenges to the operation and management of network infrastructure. In the network data flow, there will be some network data flows used for network attacks, which will launch network attacks on servers, network infrastructure, etc., and eventually cause network security incidents.

[0003] Some network data streams are highly concealed, such as advanced persistent threats (APTs), which tend to continuously and secretly invade the target stream database. APT network attacks are difficult to detect due to their low frequency and persistence. In related technologies, when facing such network data streams, the weights of different network data streams are calculated. The higher the weight, the more likely it is a network data stream of an advanced persistent threat. However, the weight threshold for network data streams of advanced persistent threats is often set based on empirical parameters or manually set, which will lead to inaccurate detection of network data streams of advanced persistent threats, and may eventually lead to network security incidents such as the invasion of the target stream database. Summary of the invention

[0004] The embodiments of the present application provide a data flow detection method, apparatus, computer equipment, and storage medium, which can improve the accuracy of network security detection of data flows in a network.

[0005] In order to achieve the above object, an embodiment of the present application provides a data flow detection method, including:

[0006] Acquire a data flow in the network to be detected, and determine quintuple information of the data flow;

[0007] Determine a hash value of the data stream according to a preset hash function, and determine a target hash bucket corresponding to the data stream in a preset hash bucket array by using the hash value;

[0008] Comparing the five-tuple information with the five-tuple information stored in the preset hash bucket array to obtain a comparison result, and determining a storage location corresponding to the data stream in the target hash bucket according to the comparison result;

[0009] Determine the number of occurrence windows and the average network rate corresponding to the data flow, and store the number of occurrence windows, the average network rate and the five-tuple information corresponding to the data flow in the storage location of the target hash bucket to update the hash bucket data stored in the preset hash bucket array;

[0010] A target data stream whose average network rate and window occurrence times do not meet preset conditions is determined according to the hash bucket data, and a network security detection is performed on the target data stream.

[0011] In order to achieve the above-mentioned purpose, an embodiment of the present application provides a data flow detection device, including:

[0012] An acquisition module, used to acquire a data stream in a network to be detected and determine quintuple information of the data stream;

[0013] A determination module, configured to determine a hash value of the data stream according to a preset hash function, and determine a target hash bucket corresponding to the data stream in a preset hash bucket array by using the hash value;

[0014] A comparison module, used for comparing the five-tuple information with the five-tuple information stored in the preset hash bucket array to obtain a comparison result, and determining a storage location corresponding to the data stream in the target hash bucket according to the comparison result;

[0015] A storage module, used for determining the number of occurrence windows and the average network rate corresponding to the data stream, and storing the number of occurrence windows, the average network rate and the five-tuple information corresponding to the data stream in the storage location of the target hash bucket to update the hash bucket data stored in the preset hash bucket array;

[0016] The detection module is used to determine the target data flow whose average network rate and window occurrence times do not meet the preset conditions according to the hash bucket data, and perform network security detection on the target data flow.

[0017] In some implementations, the preset hash function includes a first hash function and a second hash function, and the preset hash bucket array includes a first hash bucket array and a second hash bucket array; and the determination module is used to:

[0018] Determine a first Hash value of the data stream according to the first Hash function, and determine a second Hash value of the data stream according to the second Hash function;

[0019] A first target hash bucket corresponding to the data stream is determined in the first hash bucket array according to the first hash value, and a second target hash bucket corresponding to the data stream is determined in the second hash bucket array according to the second hash value, and the first target hash bucket and the second target hash bucket are determined as target hash buckets corresponding to the data stream.

[0020] In some embodiments, the comparison module includes a comparison submodule for:

[0021] Determining the stored five-tuple information in the first hash bucket array and the second hash bucket array;

[0022] The five-tuple information is compared with the saved five-tuple information to obtain a comparison result.

[0023] In some embodiments, the comparison module includes a determination submodule for:

[0024] When the comparison result indicates that the five-tuple information matches the five-tuple information stored in the first hash bucket array, determining whether the current detection window corresponding to the data stream is the same as the previous detection window;

[0025] When the current detection window corresponding to the data stream is different from the previous detection window, determining a current storage position of the data stream sorted in the first target hash bucket;

[0026] Obtaining the average network rate and window occurrence times corresponding to the data flow;

[0027] Determine in the first target hash bucket a neighbor storage position sorted before the current storage position, and an average network rate and a window occurrence count of a neighbor data stream corresponding to the neighbor storage position;

[0028] A storage location corresponding to the data flow is determined in the first target hash bucket according to an average network rate and a window occurrence number corresponding to the data flow and an average network rate and a window occurrence number of the neighbor data flow.

[0029] In some embodiments, a submodule is determined to:

[0030] Obtain the historical average network rate and the number of historical occurrence windows of the data flow detected before the current detection window;

[0031] Determining the occurrence frequency of the data stream in the current detection window;

[0032] The historical average network rate and the historical window occurrence times are multiplied and then added to the occurrence frequency to obtain a first calculation result;

[0033] The first calculation result is divided by the number of occurrence windows corresponding to the data flow to obtain an average network rate corresponding to the data flow.

[0034] In some embodiments, a submodule is determined to:

[0035] When the number of occurrence windows corresponding to the data stream is greater than the number of occurrence windows corresponding to the neighbor data stream, exchanging storage positions between the data stream and the neighbor data stream;

[0036] Return to execute and determine the current storage position of the data stream sorted in the first target hash bucket until the number of occurrence windows corresponding to the data stream is less than the number of occurrence windows corresponding to the neighbor data stream, or the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighbor data stream, and the average network rate corresponding to the data stream is greater than or equal to the average network rate corresponding to the neighbor data stream, and the current storage position corresponding to the data stream in the first target hash bucket is determined as the storage position corresponding to the data stream.

[0037] In some embodiments, a submodule is determined to:

[0038] When the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighbor data stream, and the average network rate corresponding to the data stream is lower than the average network rate corresponding to the neighbor data stream, the data stream and the neighbor data stream are exchanged for storage position;

[0039] Return to execute and determine the current storage position of the data stream sorted in the first target hash bucket until the number of occurrence windows corresponding to the data stream is less than the number of occurrence windows corresponding to the neighbor data stream, or the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighbor data stream, and the average network rate corresponding to the data stream is greater than or equal to the average network rate corresponding to the neighbor data stream, and the current storage position corresponding to the data stream in the first target hash bucket is determined as the storage position corresponding to the data stream.

[0040] In some embodiments, a submodule is determined to:

[0041] When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and the five-tuple information matches the five-tuple information stored in the second hash bucket array, determining whether the current detection window corresponding to the data stream is the same as the previous detection window;

[0042] When the current detection window corresponding to the data stream is different from the previous detection window, determining a current storage position of the data stream sorted in the second target hash bucket;

[0043] Obtaining the average network rate and window occurrence times corresponding to the data flow;

[0044] Determine in the second target hash bucket a neighbor storage position sorted before the current storage position, and an average network rate and a window occurrence count of neighbor data flows stored in the neighbor storage position;

[0045] A storage location corresponding to the data flow is determined in the second target hash bucket according to an average network rate and a window occurrence number corresponding to the data flow and an average network rate and a window occurrence number of the neighbor data flow.

[0046] In some embodiments, a submodule is determined to:

[0047] When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and there is an empty storage position in the first target hash bucket, determining the empty storage position in the first target hash bucket as a candidate storage position corresponding to the data flow;

[0048] When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, there is no empty storage location in the first target hash bucket, and there is a candidate data stream in the first target hash bucket whose average network rate is greater than a preset average network rate threshold, the data in the storage location corresponding to the candidate data stream is cleared, and the storage location corresponding to the candidate data stream is determined as the candidate storage location corresponding to the data stream.

[0049] In some embodiments, a submodule is determined to:

[0050] When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, the five-tuple information does not match the five-tuple information stored in the second hash bucket array, and there is a candidate storage position corresponding to the data stream in the first target hash bucket, determine the candidate storage position in the first target hash bucket as the storage position corresponding to the data stream;

[0051] When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, the five-tuple information does not match the five-tuple information stored in the second hash bucket array, and the candidate storage position corresponding to the data stream does not exist in the first target hash bucket, and the candidate storage position corresponding to the data stream exists in the second target hash bucket, the candidate storage position in the second target hash bucket is determined as the storage position corresponding to the data stream;

[0052] When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, the quintuple information does not match the quintuple information stored in the second hash bucket array, the candidate storage position corresponding to the data flow does not exist in the first target hash bucket, and the candidate storage position corresponding to the data flow does not exist in the second target hash bucket, determine the number of occurrence windows and the average network rate of the first data flow corresponding to the last sorted storage position in the first target hash bucket, and determine the number of occurrence windows and the average network rate of the second data flow corresponding to the last sorted storage position in the second target hash bucket;

[0053] According to the number of occurrence windows and the average network rate of the first data stream and the number of occurrence windows and the average network rate of the second data stream, the storage position corresponding to the data stream is determined in the last storage position sorted in the first target hash bucket and the last storage position sorted in the second target hash bucket.

[0054] In some embodiments, a submodule is determined to:

[0055] When the number of occurrence windows of the first data stream is less than the number of occurrence windows of the second data stream, attenuating the average network rate of the first data stream to obtain an attenuated average network rate of the first data stream;

[0056] When the attenuated average network rate of the first data stream is less than a preset attenuated average network rate threshold, clearing the data of the last sorted storage position in the first target hash bucket and determining it as the storage position corresponding to the data stream;

[0057] When the number of occurrence windows of the first data stream is equal to the number of occurrence windows of the second data stream, and the average network rate of the first data stream is greater than the average network rate of the second data stream, attenuating the average network rate of the first data stream to obtain an attenuated average network rate of the first data stream;

[0058] When the attenuated average network rate of the first data stream is less than a preset attenuated average network rate threshold, the last sorted storage location data in the first target hash bucket is cleared and determined as the storage location corresponding to the data stream.

[0059] In some embodiments, a submodule is determined to:

[0060] Determine the inverse of the number of occurrence windows of the first data stream;

[0061] The reciprocal is subtracted from the average network rate of the first data stream to obtain the attenuated average network rate of the first data stream.

[0062] In some embodiments, the detection module is used to:

[0063] In the hash bucket data, a data flow whose average network rate is less than or equal to a preset average rate threshold and whose window occurrence times is greater than or equal to a preset window occurrence times threshold is determined as a target data flow that does not meet the preset conditions.

[0064] In order to achieve the above-mentioned purpose, an embodiment of the present application provides a computer-readable storage medium on the one hand, wherein the computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for a processor to load to execute the data flow detection method provided in the embodiment of the present application.

[0065] In order to achieve the above-mentioned objectives, an embodiment of the present application provides a computer device on the one hand, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the data flow detection method provided in the embodiment of the present application when executing the computer program.

[0066] In an embodiment of the present application, a data flow in a network to be detected is obtained, and quintuple information of the data flow is determined; a hash value of the data flow is determined according to a preset hash function, and the hash value is determined in a preset hash bucket array to determine a target hash bucket corresponding to the data flow; the quintuple information is compared with the quintuple information stored in the preset hash bucket array to obtain a comparison result, and a storage position corresponding to the data flow is determined in the target hash bucket according to the comparison result; the number of occurrence windows and the average network rate corresponding to the data flow are determined, and the number of occurrence windows, the average network rate and the quintuple information corresponding to the data flow are stored in the storage position of the target hash bucket to update the hash bucket data stored in the preset hash bucket array; a target data flow whose average network rate and number of occurrence windows do not meet the preset conditions is determined according to the hash bucket data, and a network security detection is performed on the target data flow.

[0067] In this way, by obtaining the data flow in the network to be detected and calculating the hash value corresponding to the data flow, the corresponding target hash bucket is found in the preset hash bucket array through the hash value, and the five-tuple information is compared with the five-tuple information stored in the preset hash bucket array to obtain the comparison result. Finally, the storage position corresponding to the data flow is determined in the target hash bucket through the comparison result, and then the number of occurrence windows, average network rate and five-tuple information corresponding to the data flow are stored in the storage position to update the hash bucket data stored in the preset hash bucket array. This can greatly improve the information storage efficiency of the data flow in the network to be detected, and is also conducive to quickly finding the average network rate through the hash bucket data in the subsequent The target data stream whose network rate and window occurrence times do not meet the preset conditions is identified, and network security detection is performed on the target data stream. Compared with the related art, whether the network data stream is a network data stream of advanced persistent threat is analyzed by setting corresponding weights for different data streams, in the present application, the average network rate and window occurrence times of different data streams are firstly saved in a hash bucket array, and then the target data stream that does not meet the preset conditions is determined by the average network rate and window occurrence times. In this way, the target data stream with network security risks can be more accurately determined, and the target data stream can be security-tested, thereby improving the accuracy of network security detection of data streams in the network.

[0068] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0070] Figure 1 It is a schematic diagram of a scenario of network security detection provided by an embodiment of the present application;

[0071] Figure 2 It is a flowchart of a data flow detection method provided in an embodiment of the present application;

[0072] Figure 3 is a schematic diagram of the structure of the first target hash bucket provided in an embodiment of the present application;

[0073] Figure 4 is another flow chart of the data flow detection method provided in an embodiment of the present application;

[0074] Figure 5 It is a schematic diagram of the structure of a data flow detection device provided in an embodiment of the present application;

[0075] Figure 6 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0076] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0077] It can be understood that in the specific implementation of this application, information related to data flow is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards.

[0078] The data flow detection method provided in the embodiment of the present application relates to the field of artificial intelligence technology. The data flow detection method provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or it can be configured as a server cluster or a distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the data flow detection method, etc., but is not limited to the above forms.

[0079] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer computer devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0080] Before further describing the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are described. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations:

[0081] Hash Bucket Array: Hash Bucket Array is an important part of the data structure called Hash Table. Hash Table is a data structure used to store key-value pairs. It uses a hash function to calculate the storage location corresponding to the key. Hash Bucket Array is an array used to store these key-value pairs. Each element in the array is a Hash Bucket.

[0082] Hash Bucket: It is a basic storage unit in the hash bucket array. It is used to store data elements that are mapped to the same position (index) after the hash function is calculated. Buckets are used to store entries. When a hash conflict occurs, multiple entries may be stored in the same bucket. For example, in a bucket with a linked list structure, each entry (in the form of a key-value pair) is stored in the bucket as a node of the linked list. If two different keys are mapped to the same bucket after the hash function is calculated, the entries corresponding to the two keys will be stored in this bucket.

[0083] Entry: In the Hash Bucket structure, "Entry" usually refers to a basic unit stored in a hash bucket, which can also be called an entry, specifically a "Key-Value Pair". It consists of two parts: one is the key, which is used to calculate the index of the hash bucket through the hash function; the other is the value, which is the data content associated with the key. The storage location of the entry in the hash bucket array is indirectly determined by the bucket. Each entry is calculated by the hash function to obtain an index, which points to a bucket, and this bucket is located in the hash bucket array. Therefore, the entry is ultimately stored in a bucket in the hash bucket array.

[0084] Quintuple information: refers to the combination of five elements used to uniquely identify a network connection in the field of network communication or security. These five elements include source IP address, source port, destination IP address, destination port and protocol type.

[0085] First, let’s describe the technical problems existing in the relevant technologies:

[0086] With the explosive growth of network users and network scale, the huge amount of traffic in the network has become unpredictable, which has brought great challenges to the operation and management of network infrastructure. In the network data flow, there will be some network data flows used for network attacks, which will launch network attacks on servers, network infrastructure, etc., and eventually cause network security incidents.

[0087] Some network data streams are highly concealed, such as advanced persistent threats (APTs), which tend to continuously and secretly invade the target stream database. APT network attacks are difficult to detect due to their low frequency and persistence. In related technologies, when facing such network data streams, the weights of different network data streams are calculated. The higher the weight, the more likely it is a network data stream of an advanced persistent threat. However, the weight threshold for network data streams of advanced persistent threats is often set based on empirical parameters or manually set, which will lead to inaccurate detection of network data streams of advanced persistent threats, and may eventually lead to network security incidents such as the invasion of the target stream database.

[0088] In order to solve the technical problems existing in the related technology, in the present application, by obtaining the data flow in the network to be detected and calculating the hash value corresponding to the data flow, the corresponding target hash bucket is found in the preset hash bucket array through the hash value, and the five-tuple information is compared with the five-tuple information stored in the preset hash bucket array to obtain the comparison result, and finally the storage position corresponding to the data flow is determined in the target hash bucket through the comparison result, and then the number of occurrence windows, average network rate and five-tuple information corresponding to the data flow are stored in the storage position to update the hash bucket data stored in the preset hash bucket array, which can greatly improve the information storage efficiency of the data flow in the network to be detected, and is also conducive to the subsequent use of hash The hash bucket data quickly finds the target data stream whose average network rate and number of window occurrences do not meet the preset conditions, and performs network security detection on the target data stream. Compared with the related art, by setting corresponding weights for different data streams to analyze whether the network data stream is a network data stream of advanced persistent threats, in this application, the average network rate and number of window occurrences of different data streams are first saved in the hash bucket array, and then the target data stream that does not meet the preset conditions is determined by the average network rate and the number of window occurrences. In this way, the target data stream with network security risks can be more accurately determined, and the target data stream can be security-checked, thereby improving the accuracy of network security detection of data streams in the network.

[0089] To understand the data flow detection method provided by the embodiment of the present application as a whole, please refer to Figure 1 , Figure 1 It is a schematic diagram of a scenario of network security detection provided in an embodiment of the present application.

[0090] In this embodiment, for the network to be detected, two hash bucket arrays may be set, namely a first hash bucket array and a second hash bucket array, and the first hash bucket array and the second hash bucket array are preset hash bucket arrays.

[0091] The first hash bucket array contains multiple first hash buckets, each of which contains multiple entries. Each entry can be used to store network information corresponding to the data flow, such as five-tuple information, average network rate, number of occurrence windows of the data flow, frequency of occurrence of the data flow in the corresponding window, etc. These network information can be used as values, and the hash value of the data flow can be used as a key, thus forming a key-value pair data structure stored in the entry.

[0092] The second hash bucket array contains multiple second hash buckets, each of which contains multiple entries. Each entry can be used to store network information corresponding to the data flow, such as five-tuple information, average network rate, number of occurrence windows of the data flow, frequency of occurrence of the data flow in the corresponding window, etc. These network information can be used as values, and the hash value of the data flow can be used as a key, thus forming a key-value pair data structure stored in the entry.

[0093] The advantage of using two hash bucket arrays in this application is that hash conflicts between hash values ​​corresponding to different data streams can be reduced, thereby reducing the probability of hash conflicts. This method can reduce hash conflicts to a certain extent, because two different hash functions disperse the data into two different arrays, and the data distribution is more uniform compared to a single hash bucket array. When searching for data records, first search in the first hash bucket array, and if not found, search in the second hash bucket array. Since conflicts are reduced, the average search length will also be reduced accordingly, which can improve the efficiency of data search.

[0094] In the network to be detected, when a data flow is detected, the first hash value of the data flow, that is, hash value 1, can be determined according to the first hash function, and then the first target hash bucket can be found in multiple first hash buckets in the first hash bucket array according to hash value 1. The second hash value of the data flow, that is, hash value 2, can be determined according to the second hash function, and then the second target hash bucket can be found in multiple second hash buckets in the second hash bucket array according to hash value 2. The first target hash bucket and the second target hash bucket are target hash buckets, and both may store network information corresponding to the data flow.

[0095] Then the five-tuple information is compared with the five-tuple information stored in the preset hash bucket array to obtain a comparison result, and the storage location corresponding to the data stream is determined in the target hash bucket according to the comparison result.

[0096] Determine the number of occurrence windows and the average network rate corresponding to the data stream, and store the number of occurrence windows, the average network rate and the five-tuple information corresponding to the data stream in the storage location of the target hash bucket to update the hash bucket data stored in the preset hash bucket array;

[0097] According to the hash bucket data, the target data flow whose average network rate and window occurrence times do not meet the preset conditions is determined, and the target data flow is subjected to network security detection. For example, in the hash bucket data, the data flow whose average network rate is less than or equal to the preset average rate threshold and whose window occurrence times is greater than or equal to the preset window occurrence times threshold is determined as the target data flow that does not meet the preset conditions.

[0098] For these target data streams, the corresponding network security detection means can be used to perform security detection on the target data streams in the future to determine whether the network data stream has network offensiveness. Compared with the related art that sets corresponding weights for different data streams to analyze whether the network data stream is a data stream of advanced persistent threats, the present application can accurately determine the target data stream that may be an advanced persistent threat based on the number of occurrence windows of the data stream and the average network rate, and then perform security detection on the target data stream, which can greatly improve the accuracy of security detection of data streams of advanced persistent threats. Thereby improving the network security defense capability of the network to be detected and protecting the network security of the network to be detected.

[0099] It can be seen from the above content that the data flow detection method provided in the embodiment of the present application can be applied to the field of network security, such as cloud computing, cloud services and other application scenarios.

[0100] For a more detailed understanding of the data flow detection method provided in the embodiment of the present application, please refer to Figure 2 , Figure 2 : is a flow chart of a data flow detection method provided in an embodiment of the present application. The data flow detection method may include the following steps:

[0101] Step 110: Acquire the data flow in the network to be detected, and determine the five-tuple information of the data flow;

[0102] Step 120: determine a hash value of the data stream according to a preset hash function, and determine a target hash bucket corresponding to the data stream in a preset hash bucket array based on the hash value;

[0103] Step 130: Compare the five-tuple information with the five-tuple information stored in the preset hash bucket array to obtain a comparison result, and determine the storage location corresponding to the data stream in the target hash bucket according to the comparison result;

[0104] Step 140: determine the number of occurrence windows and the average network rate corresponding to the data flow, and store the number of occurrence windows, the average network rate and the five-tuple information corresponding to the data flow in the storage location of the target hash bucket to update the hash bucket data stored in the preset hash bucket array;

[0105] Step 150: Determine, based on the hash bucket data, the target data stream whose average network rate and window occurrence times do not meet the preset conditions, and perform network security detection on the target data stream.

[0106] Steps 110 to 150 will be described in detail below.

[0107] In step 110, a data flow in the network to be detected is obtained, and quintuple information of the data flow is determined.

[0108] There are massive data flows in the network to be detected. The corresponding data flows can be obtained at a certain acquisition frequency, and then the five-tuple information of the data flows can be determined, that is, the source IP address, source port, destination IP address, destination port and protocol type of the data flows can be determined.

[0109] The five-tuple information can be used for access control and intrusion detection. Firewalls can configure rules to allow or prohibit certain network connections based on the five-tuple information. For example, a company's firewall can set rules to only allow specific IP addresses in the company's internal network to access certain services on the external network through specific ports, which can prevent unauthorized external access. Intrusion detection systems (IDS) and intrusion prevention systems (IPS) can also use five-tuple information to analyze network traffic and detect abnormal network connections. For example, if a source IP address is found to frequently send a large amount of data to different destination IP addresses, and the ports and protocols used do not conform to normal business logic, it may be a malicious attack.

[0110] In step 120, a hash value of the data stream is determined according to a preset hash function, and a target hash bucket corresponding to the data stream is determined in a preset hash bucket array based on the hash value.

[0111] The preset hash function is a function that maps a data stream of any length to a hash value of a fixed length. It accepts a data block in the input data stream and outputs a fixed-length binary sequence, i.e., a hash value, through a series of mathematical and logical operations.

[0112] If the hash value corresponding to a hash bucket in the preset hash bucket array is the same as the hash value of the data stream, then the hash bucket is the target hash bucket corresponding to the hash value of the data stream. If there is no hash bucket in the preset hash bucket array that has the same hash value as the hash value of the data stream, a new target hash bucket corresponding to the data stream can be created.

[0113] In some implementations, the preset hash function includes a first hash function and a second hash function, and the preset hash bucket array includes a first hash bucket array and a second hash bucket array; determining a hash value of the data stream according to the preset hash function, and determining the hash value to determine a target hash bucket corresponding to the data stream in the preset hash bucket array, includes:

[0114] (1.1) determining a first hash value of the data stream according to a first hash function, and determining a second hash value of the data stream according to a second hash function;

[0115] (1.2) Determine a first target hash bucket corresponding to the data stream in the first hash bucket array according to the first hash value, determine a second target hash bucket corresponding to the data stream in the second hash bucket array according to the second hash value, and determine the first target hash bucket and the second target hash bucket as the target hash buckets corresponding to the data stream.

[0116] The first Hash function and the second Hash function may be different Hash functions, so for the same data stream, a first Hash value calculated by the first Hash function and a second Hash value calculated by the second Hash function are different.

[0117] Hash functions include MD5 (Message-Digest Algorithm 5), SHA-1 (Secure Hash Algorithm 1), and SHA-256. These hash functions perform complex operations on the input data, so that even if the input data is only slightly different, the output hash value will be very different. The first hash function and the second hash function can be determined from these hash functions.

[0118] After the first hash value is determined, if the hash value corresponding to a first hash bucket in the first hash bucket array is the same as the first hash value of the data stream, then the first hash bucket is the first target hash bucket corresponding to the hash value of the data stream. If there is no first hash bucket in the first hash bucket array that has the same hash value as the data stream, a new first target hash bucket corresponding to the data stream can be created.

[0119] After the second hash value is determined, if the hash value corresponding to a second hash bucket in the second hash bucket array is the same as the second hash value of the data stream, then the second hash bucket is the second target hash bucket corresponding to the hash value of the data stream. If there is no second hash bucket in the second hash bucket array that has the same hash value as the data stream, a new second target hash bucket corresponding to the data stream can be created. The target hash bucket includes the first target hash bucket and the second target hash bucket.

[0120] In step 130, the five-tuple information is compared with the five-tuple information stored in the preset hash bucket array to obtain a comparison result, and the storage location corresponding to the data stream is determined in the target hash bucket according to the comparison result.

[0121] In an embodiment of the present application, the preset hash bucket array includes a first hash bucket array and a second hash bucket array, and the five-tuple information of the corresponding data stream is retained in the first hash bucket array and the second hash bucket array respectively. The five-tuple information can be compared with the five-tuple information stored in the first hash bucket array to obtain a first comparison result.

[0122] If the first comparison result indicates that the five-tuple information matches the five-tuple information stored in the first hash bucket array, and the first target hash bucket in the first hash bucket array has a storage location corresponding to the data flow, then the network information corresponding to the data flow can be directly stored in the first hash bucket array.

[0123] If the first comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, then the five-tuple information is compared with the five-tuple information stored in the second hash bucket array to obtain a second comparison result, and then the storage location corresponding to the data flow is determined in the second target hash bucket based on the second comparison result. In other words, the five-tuple information corresponding to the data flow, the average network rate, the number of occurrence windows of the data flow, the frequency of occurrence of the data flow in the corresponding window, and other network information are stored in the first hash bucket array or the second hash bucket array.

[0124] The advantage of using two hash bucket arrays in this application is that hash conflicts between hash values ​​corresponding to different data streams can be reduced, thereby reducing the probability of hash conflicts. This method can reduce hash conflicts to a certain extent, because two different hash functions disperse the data into two different arrays, and the data distribution is more uniform compared to a single hash bucket array. When searching for data records, first search in the first hash bucket array, and if not found, search in the second hash bucket array. Since conflicts are reduced, the average search length will also be reduced accordingly, which can improve the efficiency of data search.

[0125] In some implementations, determining a storage location corresponding to the data stream in the target hash bucket according to the comparison result includes:

[0126] (1.1) when the comparison result indicates that the five-tuple information matches the five-tuple information stored in the first hash bucket array, determining whether the current detection window corresponding to the data stream is the same as the previous detection window;

[0127] (1.2) when the current detection window corresponding to the data stream is different from the previous detection window, determining the current storage position of the data stream sorted in the first target hash bucket;

[0128] (1.3) Obtain the average network rate and number of window occurrences corresponding to the data stream;

[0129] (1.4) determining in the first target hash bucket the neighbor storage position that is sorted before the current storage position, and the average network rate and the number of occurrence windows of the neighbor data flow corresponding to the neighbor storage position;

[0130] (1.5) Determine the storage location corresponding to the data stream in the first target hash bucket based on the average network rate and window occurrence times corresponding to the data stream and the average network rate and window occurrence times of neighboring data streams.

[0131] When analyzing the data stream, there will be multiple continuous time detection windows, and the detection window can be understood as a detection window within a period of time. When the comparison result indicates that the five-tuple information matches the five-tuple information stored in the first hash bucket array, it is determined whether the current detection window corresponding to the data stream is the same as the previous detection window, that is, whether the time corresponding to the data stream is within the time range of the window corresponding to the last detection.

[0132] When the current detection window corresponding to the data stream is different from the previous detection window, it means that the current detection window is a detection window within a new time period. At this time, the current storage position of the data stream sorted in the first target hash bucket is determined. For example, if there are multiple entries in the first target hash bucket, the first entry that does not store data can be found according to the arrangement order of the entries, and the storage position corresponding to the entry is determined as the current storage position of the data stream.

[0133] Then, the average network rate and the number of occurrence windows corresponding to the data flow are obtained, where the number of occurrence windows of the data flow can be counted by a counter. For example, as long as the data flow appears in a certain detection window, the counter only counts once. For example, if the data flow appears once in the current detection window, the counter counts once. If the data flow appears twice in the current detection window, the counter also only counts once, and the number of occurrence windows of the data flow is increased by one. The average network rate corresponding to the data flow can be calculated based on the historical average network rate detected before the current detection window and the frequency of occurrence of the data flow in the current detection window.

[0134] Then, the neighbor storage position that is sorted before the current storage position is determined in the first target hash bucket, as well as the average network rate and window occurrence count of the neighbor data flow corresponding to the neighbor storage position. Figure 3 , Figure 3 1 is a schematic diagram of the structure of the first target hash bucket provided by the embodiment of the present application. In the first target hash bucket, the entries can be sorted from high to low, and after the entry corresponding to the previous storage position stores data, the entry corresponding to the next storage position stores new data.

[0135] After determining the current storage position of the data stream sorting, the neighbor storage position sorted before the current storage position can be determined in the first target hash bucket. The average network rate and the number of window occurrences of the neighbor data stream are saved in the neighbor storage position, and the average network rate and the number of window occurrences of the neighbor data stream can be obtained.

[0136] Finally, the storage location corresponding to the data stream can be determined in the first target hash bucket according to the average network rate and window occurrence times corresponding to the data stream and the average network rate and window occurrence times of the neighboring data stream. For example, the average network rate and window occurrence times corresponding to the data stream and the average network rate and window occurrence times of the neighboring data stream can be compared accordingly to determine whether the data stream and the neighboring data stream exchange storage locations, so as to determine the storage location corresponding to the data stream in the first target hash bucket.

[0137] As can be seen from the above content, when the comparison result indicates that the five-tuple information matches the five-tuple information stored in the first hash bucket array, and the current detection window corresponding to the data flow is different from the previous detection window, the storage position corresponding to the data flow is determined in the first target hash bucket according to the average network rate and the number of occurrence windows corresponding to the data flow and the average network rate and the number of occurrence windows of the neighboring data flow. The advantage of this is that if the data flow appears more frequently than the neighboring data flow, and the average network rate of the data flow is lower than the average network rate of the neighboring data flow, then the data flow is more consistent with the characteristics of the network data flow of the continuous and low-frequency advanced persistent threat, that is, it meets the characteristics of the PI flow. By adopting the method of exchanging the storage position of the data flow and the front neighboring data flow, the storage position corresponding to the data flow can be made more forward, so that the network information corresponding to the data flow can be retained for a longer time, which is conducive to the subsequent determination of the data flow of the advanced persistent threat in the massive data flow, and network security detection, so as to improve the accuracy of network security detection of the network to be detected.

[0138] In some implementations, obtaining an average network rate corresponding to a data flow includes:

[0139] (1.3.1) Obtain the historical average network rate and historical window occurrence times of the data flow detected before the current detection window;

[0140] (1.3.2) Determine the frequency of occurrence of the data stream in the current detection window;

[0141] (1.3.3) Multiply the historical average network rate and the historical number of occurrence windows and add the occurrence frequency to obtain the first calculation result;

[0142] (1.3.4) Divide the first calculation result by the number of occurrence windows corresponding to the data flow to obtain the average network rate corresponding to the data flow.

[0143] The average network rate of the data flow is determined based on the global statistical rate, so it is necessary to obtain the historical average network rate and the number of historical occurrence windows of the data flow detected before the current detection window. The number of historical occurrence windows can be recorded as M, and the historical average network rate can be recorded as M-average. The number of occurrence windows of the data flow can be recorded as N.

[0144] And determine the occurrence frequency of the data stream in the current detection window, and the occurrence frequency of the data stream in the current detection window is recorded as w_counter.

[0145] Finally, the historical average network rate is multiplied by the number of historical window occurrences and then added to the occurrence frequency to obtain the first calculation result. The first calculation result is divided by the number of window occurrences corresponding to the data stream to obtain the average network rate corresponding to the data stream. The specific calculation formula is as follows:

[0146] Average = (M * M-average + w_counter) / N. Average is the average network rate corresponding to the latest calculated data flow.

[0147] The frequency of occurrence corresponding to each detection window has a common preset frequency threshold. When the frequency of occurrence of a data stream in a detection window is greater than the preset frequency threshold, the counter no longer accumulates the frequency of occurrence of the data stream, that is, the frequency of occurrence of the data stream in the detection window no longer increases. The advantage of this is that it can avoid misjudgment of some normal data streams, so that the frequency of occurrence of a data stream in a single detection window has a greater impact on the average network rate of the data stream in the detection period, while increasing the calculation accuracy of the average network rate of the data stream. This is equivalent to taking into account both the local characteristics of a single window of the data stream and the overall characteristics of the entire detection period of the data stream, which can improve the accuracy of the determined average network rate of the data stream.

[0148] The advantage of doing this is that the current average network rate of the data flow can be determined more accurately through the historical average network rate, the historical number of occurrence windows, the frequency of occurrence of the data flow in the current detection window, and the number of occurrence windows of the data flow. This is conducive to the subsequent analysis of network data flows of advanced persistent threats in massive data flows.

[0149] In some implementations, determining a storage location corresponding to the data stream in the first target hash bucket according to an average network rate and a window occurrence count corresponding to the data stream and an average network rate and a window occurrence count of neighboring data streams includes:

[0150] (1.5.1) When the number of occurrence windows corresponding to a data stream is greater than the number of occurrence windows corresponding to a neighboring data stream, the data stream and the neighboring data stream are exchanged in storage position;

[0151] (1.5.2) Return to execute and determine the current storage position of the data stream sorted in the first target hash bucket until the number of occurrence windows corresponding to the data stream is less than the number of occurrence windows corresponding to the neighboring data stream, or the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighboring data stream, and the average network rate corresponding to the data stream is greater than or equal to the average network rate corresponding to the neighboring data stream, and the current storage position corresponding to the data stream in the first target hash bucket is determined as the storage position corresponding to the data stream.

[0152] When the number of occurrence windows corresponding to a data stream is greater than the number of occurrence windows corresponding to a neighboring data stream, it indicates that the data stream appears more frequently in the network. In this case, the data stream and the neighboring data stream exchange storage locations.

[0153] Then determine the current storage position of the data stream sorted in the first target hash bucket. That is to say, after exchanging storage positions with the neighbor data stream, the current storage position of the data stream is one step forward. At this time, the storage position before the current storage position in the first target hash bucket is determined as the neighbor storage position, and the data stream at the neighbor storage position is determined as the neighbor data stream. Finally, according to the average network rate and the number of window occurrences corresponding to the data stream and the average network rate and the number of window occurrences of the neighbor data stream, the storage position corresponding to the data stream is determined in the first target hash bucket.

[0154] The advantage of doing this is that it enables comparison between the data stream and the neighboring data streams of the neighboring storage locations at the front storage locations. If the data stream is more in line with the characteristics of a persistent, low-frequency network data stream of an advanced persistent threat, the storage location corresponding to the data stream can be moved forward, thereby retaining the network information corresponding to the data stream for a longer period of time.

[0155] If the number of occurrence windows corresponding to the data stream is less than the number of occurrence windows corresponding to the neighboring data stream, or the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighboring data stream, and the average network rate corresponding to the data stream is greater than or equal to the average network rate corresponding to the neighboring data stream, it means that the current storage position of the data stream cannot be exchanged with the neighboring storage position with a forward storage position, and the current storage position corresponding to the data stream in the first target hash bucket is determined as the storage position corresponding to the data stream.

[0156] In some implementations, determining a storage location corresponding to the data stream in the first target hash bucket according to an average network rate and a window occurrence count corresponding to the data stream and an average network rate and a window occurrence count of neighboring data streams includes:

[0157] (1.5.3) When the number of occurrence windows corresponding to a data stream is equal to the number of occurrence windows corresponding to a neighboring data stream, and the average network rate corresponding to the data stream is less than the average network rate corresponding to the neighboring data stream, the data stream and the neighboring data stream are exchanged in storage position;

[0158] (1.5.4) Return to execute and determine the current storage position of the data stream sorted in the first target hash bucket until the number of occurrence windows corresponding to the data stream is less than the number of occurrence windows corresponding to the neighboring data stream, or the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighboring data stream, and the average network rate corresponding to the data stream is greater than or equal to the average network rate corresponding to the neighboring data stream, and the current storage position corresponding to the data stream in the first target hash bucket is determined as the storage position corresponding to the data stream.

[0159] Among them, when the number of occurrence windows corresponding to a data stream is equal to the number of occurrence windows corresponding to a neighboring data stream, and the average network rate corresponding to the data stream is less than the average network rate corresponding to the neighboring data stream, the data stream is more in line with the characteristics of a persistent, low-frequency advanced persistent threat network data stream relative to the neighboring data stream, so the storage position corresponding to the data stream can be moved forward, thereby retaining the network information corresponding to the data stream for a longer period of time.

[0160] If the number of occurrence windows corresponding to the data stream is less than the number of occurrence windows corresponding to the neighboring data stream, or the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighboring data stream, and the average network rate corresponding to the data stream is greater than or equal to the average network rate corresponding to the neighboring data stream, it means that the current storage position of the data stream cannot be exchanged with the neighboring storage position with a forward storage position, and the current storage position corresponding to the data stream in the first target hash bucket is determined as the storage position corresponding to the data stream.

[0161] From the above content, it can be seen that the method of comparing the data flow with the neighbor data flow of the front neighbor storage position to determine the storage position of the data flow in the first target hash bucket is conducive to the subsequent determination of the data flow of advanced persistent threats in massive data streams and network security detection to improve the accuracy of network security detection of the network to be detected.

[0162] In some embodiments, when the comparison result indicates that the five-tuple information matches the five-tuple information stored in the first hash bucket array, and the current detection window corresponding to the data stream is the same as the previous detection window, then it is only necessary to count the frequency of occurrence of the data stream in the current detection window through the counter, that is, to accumulate the frequency of occurrence of the current detection window. The frequency of occurrence corresponding to each detection window has a common preset frequency threshold. When the frequency of occurrence of the data stream in the detection window is greater than the preset frequency threshold, the counter no longer accumulates the frequency of occurrence of the data stream, that is, the frequency of occurrence of the data stream in the detection window no longer increases. The advantage of this is that it can avoid misjudgment of some normal data streams, so that the frequency of occurrence of the data stream in a single detection window has a greater impact on the average network rate of the data stream in the detection period, while increasing the calculation accuracy of the average network rate of the data stream.

[0163] In some implementations, determining a storage location corresponding to the data stream in the target hash bucket according to the comparison result includes:

[0164] (2.1) when the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and the five-tuple information matches the five-tuple information stored in the second hash bucket array, determining whether the current detection window corresponding to the data stream is the same as the previous detection window;

[0165] (2.2) when the current detection window corresponding to the data stream is different from the previous detection window, determining the current storage position of the data stream sorted in the second target hash bucket;

[0166] (2.3) Obtain the average network rate and number of window occurrences corresponding to the data stream;

[0167] (2.4) determining in the second target hash bucket the neighbor storage position sorted before the current storage position, and the average network rate and the number of occurrence windows of the neighbor data flow stored in the neighbor storage position;

[0168] (2.5) According to the average network rate and window occurrence times corresponding to the data stream and the average network rate and window occurrence times of the neighboring data streams, the storage location corresponding to the data stream is determined in the second target hash bucket.

[0169] Among them, when analyzing the data flow, there will be multiple continuous time detection windows, and the detection window can be understood as a detection window within a period of time. When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and the five-tuple information matches the five-tuple information stored in the second hash bucket array, it means that the second hash bucket array has stored historical data flows with the same five-tuple information as the data flow, then the network information of the data flow can be stored in the second hash bucket array. The advantage of doing so is that data flows of the same type can be in one hash bucket array, which is conducive to accurately determining the data flows that meet the persistence and low-frequency advanced persistent threats in the massive data flow in the future.

[0170] Then determine whether the current detection window corresponding to the data stream is the same as the previous detection window, that is, determine whether the time corresponding to the data stream is within the time range of the window corresponding to the last detection.

[0171] When the current detection window corresponding to the data stream is different from the previous detection window, it means that the current detection window is a detection window within a new time period. At this time, the current storage position of the data stream in the second target hash bucket is determined. For example, if there are multiple entries in the second target hash bucket, the first entry without stored data can be found according to the order of the entries, and the storage position corresponding to the entry is determined as the current storage position of the data stream. Among them, the sorting and structure of the second target hash bucket are the same as Figure 3 The ordering and structure of the first target hash bucket in are the same.

[0172] Then, the average network rate and the number of occurrence windows corresponding to the data flow are obtained, where the number of occurrence windows of the data flow can be counted by a counter, and the average network rate corresponding to the data flow can be calculated based on the historical average network rate detected before the current detection window and the frequency of occurrence of the data flow in the current detection window.

[0173] Then, the neighbor storage positions sorted before the current storage position, and the average network rate and the number of occurrence windows of the neighbor data streams corresponding to the neighbor storage positions are determined in the second target hash bucket.

[0174] After determining the current storage position of the data stream sorting, the neighbor storage position sorted before the current storage position can be determined in the second target hash bucket. The neighbor storage position stores the average network rate and the number of window occurrences of the neighbor data stream, and the average network rate and the number of window occurrences of the neighbor data stream can be obtained.

[0175] Finally, the storage location corresponding to the data stream can be determined in the second target hash bucket according to the average network rate and window occurrence times corresponding to the data stream and the average network rate and window occurrence times of the neighboring data stream. For example, the average network rate and window occurrence times corresponding to the data stream and the average network rate and window occurrence times of the neighboring data stream can be compared accordingly to determine whether the data stream and the neighboring data stream exchange storage locations, so as to determine the storage location corresponding to the data stream in the second target hash bucket.

[0176] As can be seen from the above content, when the comparison result indicates that the five-tuple information matches the five-tuple information stored in the second hash bucket array, and the current detection window corresponding to the data flow is different from the previous detection window, the storage position corresponding to the data flow is determined in the second target hash bucket according to the average network rate and the number of occurrence windows corresponding to the data flow and the average network rate and the number of occurrence windows of the neighboring data flow. The advantage of this is that if the data flow appears more frequently than the neighboring data flow, and the average network rate of the data flow is lower than the average network rate of the neighboring data flow, then the data flow is more consistent with the characteristics of the network data flow of the continuous and low-frequency advanced persistent threat, that is, it meets the characteristics of the PI flow. By adopting the method of exchanging storage positions of the data flow and the front neighboring data flow, the storage position corresponding to the data flow can be made more forward, so that the network information corresponding to the data flow can be retained for a longer time, which is conducive to the subsequent determination of the data flow of the advanced persistent threat in the massive data flow, and network security detection, so as to improve the accuracy of network security detection of the network to be detected.

[0177] In some implementations, determining a storage location corresponding to the data stream in the target hash bucket according to the comparison result includes:

[0178] (3.1) when the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and there is an empty storage location in the first target hash bucket, determining the empty storage location in the first target hash bucket as a candidate storage location corresponding to the data stream;

[0179] (3.2) When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, there is no empty storage location in the first target hash bucket, and there is a candidate data stream in the first target hash bucket whose average network rate is greater than a preset average network rate threshold, the data in the storage location corresponding to the candidate data stream is cleared, and the storage location corresponding to the candidate data stream is determined as the candidate storage location corresponding to the data stream.

[0180] Among them, when the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, and there is an empty storage location in the first target hash bucket, the empty storage location in the first target hash bucket is determined as the candidate storage location corresponding to the data stream, and it is also necessary to determine whether the quintuple information matches the quintuple information stored in the second hash bucket array. When the quintuple information matches the quintuple information stored in the second hash bucket array, the above step "(2.1) When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, and the quintuple information matches the quintuple information stored in the second hash bucket array, determine whether the current detection window corresponding to the data stream is the same as the previous detection window" is executed.

[0181] The advantage of doing this is that data streams of the same type can be placed in a hash bucket array, which helps to accurately identify data streams that meet the requirements of persistent, low-frequency advanced persistent threats in massive data streams.

[0182] When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and there is no empty storage position in the first target hash bucket, it can be determined in the first target hash bucket whether there is a candidate data stream with an average network rate greater than the preset average network rate threshold. If there is a candidate data stream with an average network rate greater than the preset average network rate threshold in the first target hash bucket, the data in the storage position corresponding to the candidate data stream is cleared, and the storage position corresponding to the candidate data stream is determined as the candidate storage position corresponding to the data stream. It is also necessary to determine whether the five-tuple information matches the five-tuple information stored in the second hash bucket array. When the five-tuple information matches the five-tuple information stored in the second hash bucket array, the above step "(2.1) When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and the five-tuple information matches the five-tuple information stored in the second hash bucket array, determine whether the current detection window corresponding to the data stream is the same as the previous detection window" is executed.

[0183] The advantage of doing this is that the data stored in the first target hash bucket can be a data flow with an average network rate no greater than a preset average network rate threshold as much as possible, thereby realizing the preservation of network information for continuous, low-frequency advanced persistent threat data flows.

[0184] In some embodiments, when the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, and there is no empty storage location in the first target hash bucket, if there is no candidate data flow in the first target hash bucket whose average network rate is greater than a preset average network rate threshold, then it means that there is no storage location in the first target hash bucket to retain the network information corresponding to the data flow. At this time, the storage location of the data flow in the first target hash bucket can be set to empty.

[0185] In some implementations, determining a storage location corresponding to the data stream in the target hash bucket according to the comparison result includes:

[0186] (4.1) when the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, the five-tuple information does not match the five-tuple information stored in the second hash bucket array, and there is a candidate storage location corresponding to the data stream in the first target hash bucket, the candidate storage location in the first target hash bucket is determined as the storage location corresponding to the data stream;

[0187] (4.2) When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, the five-tuple information does not match the five-tuple information stored in the second hash bucket array, and the candidate storage location corresponding to the data stream does not exist in the first target hash bucket, and the candidate storage location corresponding to the data stream exists in the second target hash bucket, the candidate storage location in the second target hash bucket is determined as the storage location corresponding to the data stream;

[0188] (4.3) When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, the quintuple information does not match the quintuple information stored in the second hash bucket array, there is no candidate storage position corresponding to the data flow in the first target hash bucket, and there is no candidate storage position corresponding to the data flow in the second target hash bucket, determine the number of occurrence windows and the average network rate of the first data flow corresponding to the last sorted storage position in the first target hash bucket, and determine the number of occurrence windows and the average network rate of the second data flow corresponding to the last sorted storage position in the second target hash bucket;

[0189] (4.4) According to the number of occurrence windows and the average network rate of the first data stream and the number of occurrence windows and the average network rate of the second data stream, the storage position corresponding to the data stream is determined from the last storage position sorted in the first target hash bucket and the last storage position sorted in the second target hash bucket.

[0190] Among them, when the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, and the quintuple information does not match the quintuple information stored in the second hash bucket array, if there is a candidate storage location corresponding to the data flow in the first target hash bucket, the candidate storage location in the first target hash bucket is determined as the storage location corresponding to the data flow, so that there is no need to find a storage location from the second target hash bucket to store the network information of the data flow.

[0191] When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, the five-tuple information does not match the five-tuple information stored in the second hash bucket array, there is no candidate storage location corresponding to the data flow in the first target hash bucket, and there is a candidate storage location corresponding to the data flow in the second target hash bucket, the candidate storage location in the second target hash bucket is determined as the storage location corresponding to the data flow. In other words, the candidate storage location corresponding to the data flow in the first target hash bucket is empty, and there is no extra storage location to store the network information of the data flow. At this time, the candidate storage location in the second target hash bucket can be determined as the storage location corresponding to the data flow to store the network information of the data flow.

[0192] When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, the quintuple information does not match the quintuple information stored in the second hash bucket array, the candidate storage position corresponding to the data stream does not exist in the first target hash bucket, and the candidate storage position corresponding to the data stream does not exist in the second target hash bucket, then the first data stream corresponding to the last storage position sorted in the first target hash bucket and the second data corresponding to the last storage position sorted in the second target hash bucket determine the first data stream or the second data stream whose average network rate needs to be attenuated. If the attenuated average network rate corresponding to the first data stream or the attenuated average network rate corresponding to the second data stream is less than the preset attenuated average network rate, the data corresponding to the first data stream or the second data stream can be used, and the vacated storage position can be used to store the network information of the data stream.

[0193] If the attenuated average network rate corresponding to the first data stream or the attenuated average network rate corresponding to the second data stream is not less than the preset attenuated average network rate, and the network information of the data stream has no storage location in the preset hash bucket array, the network information of the data stream will not be stored.

[0194] The advantage of doing this is that when there is no storage location in the preset hash bucket array, the average network rate of the data flow at the last position in the preset hash bucket array is attenuated until the attenuated average network rate is less than the preset attenuated average network rate. This can eliminate the old data flow and introduce the network information of the new data flow for storage. In this way, in the process of continuous generation of data flow in the network, the network information of the new data flow can be captured for subsequent network security detection.

[0195] Specifically, when the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, the quintuple information does not match the quintuple information stored in the second hash bucket array, there is no candidate storage position corresponding to the data stream in the first target hash bucket, and there is no candidate storage position corresponding to the data stream in the second target hash bucket, determine the number of occurrence windows and the average network rate of the first data stream corresponding to the last sorted storage position in the first target hash bucket, and determine the number of occurrence windows and the average network rate of the second data stream corresponding to the last sorted storage position in the second target hash bucket;

[0196] According to the number of occurrence windows and the average network rate of the first data stream and the number of occurrence windows and the average network rate of the second data stream, the storage position corresponding to the data stream is determined in the last storage position sorted in the first target hash bucket and the last storage position sorted in the second target hash bucket.

[0197] Specifically, according to the number of occurrence windows and the average network rate of the first data stream and the number of occurrence windows and the average network rate of the second data stream, the storage position corresponding to the data stream is determined in the last storage position sorted in the first target hash bucket and the last storage position sorted in the second target hash bucket, including:

[0198] (4.4.1) When the number of occurrence windows of the first data stream is less than the number of occurrence windows of the second data stream, attenuate the average network rate of the first data stream to obtain an attenuated average network rate of the first data stream;

[0199] (4.4.2) When the attenuated average network rate of the first data stream is less than a preset attenuated average network rate threshold, clear the data of the last sorted storage position in the first target hash bucket and determine it as the storage position corresponding to the data stream;

[0200] (4.4.3) When the number of occurrence windows of the first data stream is equal to the number of occurrence windows of the second data stream, and the average network rate of the first data stream is greater than the average network rate of the second data stream, attenuate the average network rate of the first data stream to obtain an attenuated average network rate of the first data stream;

[0201] (4.4.4) When the attenuated average network rate of the first data stream is less than the preset attenuated average network rate threshold, the last sorted storage location data in the first target hash bucket is cleared and determined as the storage location corresponding to the data stream.

[0202] Among them, when the number of appearance windows of the first data stream is less than the number of appearance windows of the second data stream, it means that the appearance frequency of the first data stream is lower than the appearance frequency of the second data stream, and the average network rate of the first data stream is attenuated to obtain the attenuated average network rate of the first data stream.

[0203] When the attenuated average network rate of the first data stream is less than the preset attenuated average network rate threshold, the last sorted storage position data in the first target hash bucket is cleared and determined as the storage position corresponding to the data stream. For example, if the preset attenuated average network rate threshold is 0.01KB / s, and the attenuated average network rate of the first data stream is lower than the preset attenuated average network rate threshold, the storage position corresponding to the first data stream is cleared, and the cleared storage position is determined as the storage position corresponding to the data stream.

[0204] When the number of occurrence windows of the first data stream is equal to the number of occurrence windows of the second data stream, and the average network rate of the first data stream is greater than the average network rate of the second data stream, the average network rate of the first data stream is attenuated to obtain the attenuated average network rate of the first data stream.

[0205] When the attenuated average network rate of the first data stream is less than the preset attenuated average network rate threshold, the last sorted storage position data in the first target hash bucket is cleared and determined as the storage position corresponding to the data stream. For example, if the preset attenuated average network rate threshold is 0.01KB / s, and the attenuated average network rate of the first data stream is lower than the preset attenuated average network rate threshold, the storage position corresponding to the first data stream is cleared, and the cleared storage position is determined as the storage position corresponding to the data stream.

[0206] In some implementations, attenuating the average network rate of the first data stream to obtain the attenuated average network rate of the first data stream includes:

[0207] (4.4.2.1) Determine the inverse of the number of occurrence windows of the first data stream;

[0208] (4.4.2.2) Subtract the reciprocal from the average network rate of the first data stream to obtain the attenuated average network rate of the first data stream.

[0209] The specific calculation formula is as follows:

[0210] NAverage = average - 1 / N. Where average is the average network rate, N is the number of windows that appear, and NAverage is the attenuated average network rate.

[0211] From the above, it can be seen that the advantage of doing this is that it can clear out some data flows with low window occurrence times and high average network rate in the preset hash bucket array, thereby preserving data flows with low average network rate and high window occurrence times as much as possible, while also preserving the network information of the latest data flow that needs to be detected.

[0212] In step 140, the number of occurrence windows and the average network rate corresponding to the data stream are determined, and the number of occurrence windows, the average network rate and the five-tuple information corresponding to the data stream are stored in the storage location of the target hash bucket to update the hash bucket data stored in the preset hash bucket array.

[0213] In an embodiment of the present application, through the various implementation methods described in step 130, the storage location of the data flow in the target hash bucket in the preset hash bucket array can be determined, and then the five-tuple information corresponding to the data flow, the average network rate, the number of occurrence windows of the data flow, the frequency of occurrence of the data flow in the corresponding window and other network information are saved in the storage location, wherein the hash value of the data flow is used as the key, and the network information of the data flow is used as the value, to form a key-value pair data structure saved in the storage location of the target hash bucket to update the hash bucket data saved in the preset hash bucket array.

[0214] The number of occurrences of a data flow in a corresponding detection window is divided by the sum of the number of occurrences of all data flows in the window to obtain the frequency of occurrence of the data flow in the detection window. The calculation method of the average network rate corresponding to the data flow is also described above and will not be repeated here.

[0215] Step 150: Determine the target data flow whose average network rate and window occurrence times do not meet the preset conditions according to the hash bucket data, and perform network security detection on the target data flow.

[0216] The preset condition is that the average network rate of the data flow is less than or equal to a preset average rate threshold and the number of window occurrences is greater than or equal to a preset window occurrence threshold.

[0217] In the hash bucket data, the data flow with an average network rate less than or equal to the preset average rate threshold and a window occurrence number greater than or equal to the preset window occurrence number threshold is determined as a target data flow that does not meet the preset conditions. In other words, the data flow with a low average network rate and a large number of window occurrences is determined as the target data flow. These target data flows meet the characteristics of network data flows of persistent, low-frequency advanced persistent threats, and network security detection of the target data flows is required later.

[0218] In this way, the target data stream that meets the preset conditions can be screened out from the hash bucket data through two relatively objective factors, namely, the number of window occurrences and the average network rate, which can improve the accuracy of the target data stream screening. This is conducive to improving the accuracy of network security detection of network data streams of advanced persistent threats.

[0219] It should be noted that the network data flow of advanced persistent threats is only a type of low-frequency, continuous target data flow. The target data flow can be understood as a low-frequency, continuous network data flow.

[0220] In an embodiment of the present application, a data flow in a network to be detected is obtained, and quintuple information of the data flow is determined; a hash value of the data flow is determined according to a preset hash function, and the hash value is determined in a preset hash bucket array to determine a target hash bucket corresponding to the data flow; the quintuple information is compared with the quintuple information stored in the preset hash bucket array to obtain a comparison result, and a storage position corresponding to the data flow is determined in the target hash bucket according to the comparison result; the number of occurrence windows and the average network rate corresponding to the data flow are determined, and the number of occurrence windows, the average network rate and the quintuple information corresponding to the data flow are stored in the storage position of the target hash bucket to update the hash bucket data stored in the preset hash bucket array; a target data flow whose average network rate and number of occurrence windows do not meet the preset conditions is determined according to the hash bucket data, and a network security detection is performed on the target data flow.

[0221] In this way, by obtaining the data flow in the network to be detected and calculating the hash value corresponding to the data flow, the corresponding target hash bucket is found in the preset hash bucket array through the hash value, and the five-tuple information is compared with the five-tuple information stored in the preset hash bucket array to obtain the comparison result. Finally, the storage position corresponding to the data flow is determined in the target hash bucket through the comparison result, and then the number of occurrence windows, average network rate and five-tuple information corresponding to the data flow are stored in the storage position to update the hash bucket data stored in the preset hash bucket array. This can greatly improve the information storage efficiency of the data flow in the network to be detected, and is also conducive to quickly finding the average network rate through the hash bucket data in the subsequent The target data stream whose network rate and window occurrence times do not meet the preset conditions is identified, and network security detection is performed on the target data stream. Compared with the related art, whether the network data stream is a network data stream of advanced persistent threat is analyzed by setting corresponding weights for different data streams, in the present application, the average network rate and window occurrence times of different data streams are firstly saved in a hash bucket array, and then the target data stream that does not meet the preset conditions is determined by the average network rate and window occurrence times. In this way, the target data stream with network security risks can be more accurately determined, and the target data stream can be security-tested, thereby improving the accuracy of network security detection of data streams in the network.

[0222] See also Figure 4 , Figure 4 1 is another flow chart of the data flow detection method provided in the embodiment of the present application. The data flow detection method may include the following steps:

[0223] Step 201: Acquire a data flow in the network to be detected, and determine the five-tuple information of the data flow;

[0224] Step 202: Determine a first Hash value of the data stream according to the first Hash function, and determine a second Hash value of the data stream according to the second Hash function;

[0225] Step 203: Determine a first target hash bucket corresponding to the data flow in the first hash bucket array according to the first hash value, determine a second target hash bucket corresponding to the data flow in the second hash bucket array according to the second hash value, and determine the first target hash bucket and the second target hash bucket as target hash buckets corresponding to the data flow;

[0226] Step 204: Determine the stored five-tuple information in the first hash bucket array and the second hash bucket array, and compare the five-tuple information with the stored five-tuple information to obtain a comparison result;

[0227] Step 205: When the comparison result indicates that the five-tuple information matches the five-tuple information stored in the first hash bucket array, determine whether the current detection window corresponding to the data stream is the same as the previous detection window;

[0228] Step 206: When the current detection window corresponding to the data stream is different from the previous detection window, determine the current storage position of the data stream sorted in the first target hash bucket;

[0229] Step 207: Obtain the average network rate and window occurrence times corresponding to the data flow;

[0230] Step 208: Determine in the first target hash bucket the neighbor storage position that is sorted before the current storage position, and the average network rate and window occurrence count of the neighbor data stream corresponding to the neighbor storage position;

[0231] Step 209: Determine the storage location corresponding to the data flow in the first target hash bucket according to the average network rate and window occurrence times corresponding to the data flow and the average network rate and window occurrence times of the neighboring data flow;

[0232] Step 210: When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and there is an empty storage position in the first target hash bucket, the empty storage position in the first target hash bucket is determined as a candidate storage position corresponding to the data flow;

[0233] Step 211: when the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, there is no empty storage position in the first target hash bucket, and there is a candidate data flow in the first target hash bucket whose average network rate is greater than a preset average network rate threshold, clear the data in the storage position corresponding to the candidate data flow, and determine the storage position corresponding to the candidate data flow as the candidate storage position corresponding to the data flow;

[0234] Step 212: when the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and the five-tuple information matches the five-tuple information stored in the second hash bucket array, determine whether the current detection window corresponding to the data stream is the same as the previous detection window;

[0235] Step 213: When the current detection window corresponding to the data stream is different from the previous detection window, determine the current storage position of the data stream sorted in the second target hash bucket;

[0236] Step 214: Obtain the average network rate and window occurrence times corresponding to the data stream;

[0237] Step 215: Determine in the second target hash bucket the neighbor storage location that is sorted before the current storage location, and the average network rate and window occurrence count of the neighbor data stream stored in the neighbor storage location;

[0238] Step 216: Determine the storage location corresponding to the data flow in the second target hash bucket according to the average network rate and window occurrence times corresponding to the data flow and the average network rate and window occurrence times of the neighboring data flow;

[0239] Step 217: When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, the quintuple information does not match the quintuple information stored in the second hash bucket array, and there is a candidate storage location corresponding to the data stream in the first target hash bucket, the candidate storage location in the first target hash bucket is determined as the storage location corresponding to the data stream;

[0240] Step 218: When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, the quintuple information does not match the quintuple information stored in the second hash bucket array, and there is no candidate storage position corresponding to the data stream in the first target hash bucket, and there is a candidate storage position corresponding to the data stream in the second target hash bucket, determine the candidate storage position in the second target hash bucket as the storage position corresponding to the data stream;

[0241] Step 219, when the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, the quintuple information does not match the quintuple information stored in the second hash bucket array, and there is no candidate storage position corresponding to the data flow in the first target hash bucket, and there is no candidate storage position corresponding to the data flow in the second target hash bucket, determine the number of occurrence windows and the average network rate of the first data flow corresponding to the last sorted storage position in the first target hash bucket, and determine the number of occurrence windows and the average network rate of the second data flow corresponding to the last sorted storage position in the second target hash bucket;

[0242] Step 220: According to the number of occurrence windows and the average network rate of the first data stream and the number of occurrence windows and the average network rate of the second data stream, the storage position corresponding to the data stream is determined from the last storage position sorted in the first target hash bucket and the last storage position sorted in the second target hash bucket;

[0243] Step 221, determining the number of occurrence windows and the average network rate corresponding to the data flow, and storing the number of occurrence windows, the average network rate and the five-tuple information corresponding to the data flow in the storage location of the target hash bucket to update the hash bucket data stored in the preset hash bucket array;

[0244] Step 222: In the hash bucket data, determine the data flow whose average network rate is less than or equal to the preset average rate threshold and whose number of window occurrences is greater than or equal to the preset window occurrence number threshold as the target data flow that does not meet the preset conditions, and perform network security detection on the target data flow.

[0245] In the above embodiments, the description of each embodiment has its own emphasis. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the data flow detection method above, and will not be repeated here.

[0246] See also Figure 5 , Figure 5 1 is a schematic diagram of the structure of a data flow detection device provided in an embodiment of the present application. The data flow detection device can execute the data flow detection method described in the above embodiment.

[0247] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0248] An aspect of an embodiment of the present application provides a data flow detection device 300, including:

[0249] The acquisition module 310 is used to acquire the data flow in the network to be detected and determine the five-tuple information of the data flow;

[0250] A determination module 320 is used to determine a hash value of the data stream according to a preset hash function, and determine a target hash bucket corresponding to the data stream in a preset hash bucket array based on the hash value;

[0251] A comparison module 330 is used to compare the five-tuple information with the five-tuple information stored in the preset hash bucket array to obtain a comparison result, and determine the storage location corresponding to the data stream in the target hash bucket according to the comparison result;

[0252] A storage module 340 is used to determine the number of occurrence windows and the average network rate corresponding to the data flow, and store the number of occurrence windows, the average network rate and the five-tuple information corresponding to the data flow in the storage location of the target hash bucket to update the hash bucket data stored in the preset hash bucket array;

[0253] The detection module 350 is used to determine the target data flow whose average network rate and window occurrence times do not meet the preset conditions according to the hash bucket data, and perform network security detection on the target data flow.

[0254] In some implementations, the preset hash function includes a first hash function and a second hash function, and the preset hash bucket array includes a first hash bucket array and a second hash bucket array; the determination module 320 is used to:

[0255] Determine a first Hash value of the data stream according to the first Hash function, and determine a second Hash value of the data stream according to the second Hash function;

[0256] A first target hash bucket corresponding to the data stream is determined in the first hash bucket array according to the first hash value, and a second target hash bucket corresponding to the data stream is determined in the second hash bucket array according to the second hash value, and the first target hash bucket and the second target hash bucket are determined as the target hash buckets corresponding to the data stream.

[0257] In some embodiments, the comparison module 330 includes a comparison submodule for:

[0258] Determining the stored five-tuple information in the first hash bucket array and the second hash bucket array;

[0259] The five-tuple information is compared with the saved five-tuple information to obtain a comparison result.

[0260] In some embodiments, the comparison module 330 includes a determination submodule configured to:

[0261] When the comparison result indicates that the five-tuple information matches the five-tuple information stored in the first hash bucket array, determining whether the current detection window corresponding to the data stream is the same as the previous detection window;

[0262] When the current detection window corresponding to the data stream is different from the previous detection window, determining the current storage position of the data stream sorted in the first target hash bucket;

[0263] Get the average network rate and window occurrence count corresponding to the data stream;

[0264] Determine in the first target hash bucket the neighbor storage position sorted before the current storage position, and the average network rate and the number of occurrence windows of the neighbor data stream corresponding to the neighbor storage position;

[0265] According to the average network rate and the number of window occurrences corresponding to the data flow and the average network rate and the number of window occurrences of neighboring data flows, a storage location corresponding to the data flow is determined in the first target hash bucket.

[0266] In some embodiments, a submodule is determined to:

[0267] Get the historical average network rate and historical window occurrence times of the data flow detected before the current detection window;

[0268] Determine the frequency of occurrence of the data stream in the current detection window;

[0269] The first calculation result is obtained by multiplying the historical average network rate and the historical window occurrence times and adding the occurrence frequency;

[0270] The first calculation result is divided by the number of occurrence windows corresponding to the data flow to obtain an average network rate corresponding to the data flow.

[0271] In some embodiments, a submodule is determined to:

[0272] When the number of occurrence windows corresponding to the data stream is greater than the number of occurrence windows corresponding to the neighboring data stream, the data stream and the neighboring data stream are exchanged for storage positions;

[0273] Return to execute and determine the current storage position of the data stream sorted in the first target hash bucket until the number of occurrence windows corresponding to the data stream is less than the number of occurrence windows corresponding to the neighboring data stream, or the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighboring data stream, and the average network rate corresponding to the data stream is greater than or equal to the average network rate corresponding to the neighboring data stream, and the current storage position corresponding to the data stream in the first target hash bucket is determined as the storage position corresponding to the data stream.

[0274] In some embodiments, a submodule is determined to:

[0275] When the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighboring data stream, and the average network rate corresponding to the data stream is less than the average network rate corresponding to the neighboring data stream, the data stream and the neighboring data stream are exchanged in storage position;

[0276] Return to execute and determine the current storage position of the data stream sorted in the first target hash bucket until the number of occurrence windows corresponding to the data stream is less than the number of occurrence windows corresponding to the neighboring data stream, or the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighboring data stream, and the average network rate corresponding to the data stream is greater than or equal to the average network rate corresponding to the neighboring data stream, and the current storage position corresponding to the data stream in the first target hash bucket is determined as the storage position corresponding to the data stream.

[0277] In some embodiments, a submodule is determined to:

[0278] When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and the five-tuple information matches the five-tuple information stored in the second hash bucket array, determining whether the current detection window corresponding to the data stream is the same as the previous detection window;

[0279] When the current detection window corresponding to the data stream is different from the previous detection window, determining the current storage position of the data stream sorted in the second target hash bucket;

[0280] Get the average network rate and window occurrence count corresponding to the data stream;

[0281] Determine in the second target hash bucket a neighbor storage position sorted before the current storage position, and an average network rate and a window occurrence number of neighbor data flows stored in the neighbor storage position;

[0282] According to the average network rate and the number of window occurrences corresponding to the data flow and the average network rate and the number of window occurrences of neighboring data flows, a storage location corresponding to the data flow is determined in the second target hash bucket.

[0283] In some embodiments, a submodule is determined to:

[0284] When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and there is an empty storage position in the first target hash bucket, determining the empty storage position in the first target hash bucket as a candidate storage position corresponding to the data stream;

[0285] When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, there is no empty storage location in the first target hash bucket, and there is a candidate data stream in the first target hash bucket whose average network rate is greater than the preset average network rate threshold, the data in the storage location corresponding to the candidate data stream is cleared, and the storage location corresponding to the candidate data stream is determined as the candidate storage location corresponding to the data stream.

[0286] In some embodiments, a submodule is determined to:

[0287] When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, the quintuple information does not match the quintuple information stored in the second hash bucket array, and there is a candidate storage position corresponding to the data stream in the first target hash bucket, the candidate storage position in the first target hash bucket is determined as the storage position corresponding to the data stream;

[0288] When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, the five-tuple information does not match the five-tuple information stored in the second hash bucket array, and there is no candidate storage position corresponding to the data stream in the first target hash bucket, and there is a candidate storage position corresponding to the data stream in the second target hash bucket, the candidate storage position in the second target hash bucket is determined as the storage position corresponding to the data stream;

[0289] When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, the quintuple information does not match the quintuple information stored in the second hash bucket array, there is no candidate storage position corresponding to the data stream in the first target hash bucket, and there is no candidate storage position corresponding to the data stream in the second target hash bucket, determine the number of occurrence windows and the average network rate of the first data stream corresponding to the last sorted storage position in the first target hash bucket, and determine the number of occurrence windows and the average network rate of the second data stream corresponding to the last sorted storage position in the second target hash bucket;

[0290] According to the number of occurrence windows and the average network rate of the first data stream and the number of occurrence windows and the average network rate of the second data stream, the storage position corresponding to the data stream is determined in the last storage position sorted in the first target hash bucket and the last storage position sorted in the second target hash bucket.

[0291] In some embodiments, a submodule is determined to:

[0292] When the number of occurrence windows of the first data stream is less than the number of occurrence windows of the second data stream, attenuating the average network rate of the first data stream to obtain an attenuated average network rate of the first data stream;

[0293] When the attenuated average network rate of the first data stream is less than the preset attenuated average network rate threshold, clear the data of the last sorted storage position in the first target hash bucket and determine it as the storage position corresponding to the data stream;

[0294] When the number of occurrence windows of the first data stream is equal to the number of occurrence windows of the second data stream, and the average network rate of the first data stream is greater than the average network rate of the second data stream, the average network rate of the first data stream is attenuated to obtain the attenuated average network rate of the first data stream;

[0295] When the attenuated average network rate of the first data stream is less than the preset attenuated average network rate threshold, the last sorted storage location data in the first target hash bucket is cleared and determined as the storage location corresponding to the data stream.

[0296] In some embodiments, a submodule is determined to:

[0297] Determine the inverse of the number of occurrence windows of the first data stream;

[0298] The reciprocal is subtracted from the average network rate of the first data stream to obtain the attenuated average network rate of the first data stream.

[0299] In some embodiments, the detection module 350 is used to:

[0300] In the hash bucket data, a data flow whose average network rate is less than or equal to a preset average rate threshold and whose window occurrence times is greater than or equal to a preset window occurrence times threshold is determined as a target data flow that does not meet the preset conditions.

[0301] In the above embodiments, the description of each embodiment has its own emphasis. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the data flow detection method above, and will not be repeated here.

[0302] In an embodiment of the present application, the acquisition module 310 acquires the data flow in the network to be detected and determines the quintuple information of the data flow; the determination module 320 determines the hash value of the data flow according to a preset hash function, and determines the hash value to determine the target hash bucket corresponding to the data flow in the preset hash bucket array; the comparison module 330 compares the quintuple information with the quintuple information stored in the preset hash bucket array to obtain a comparison result, and determines the storage position corresponding to the data flow in the target hash bucket according to the comparison result; the storage module 340 determines the number of occurrence windows and the average network rate corresponding to the data flow, and stores the number of occurrence windows, the average network rate and the quintuple information corresponding to the data flow in the storage position of the target hash bucket to update the hash bucket data stored in the preset hash bucket array; the detection module 350 determines the target data flow whose average network rate and number of occurrence windows do not meet the preset conditions according to the hash bucket data, and performs network security detection on the target data flow.

[0303] In this way, by obtaining the data flow in the network to be detected and calculating the hash value corresponding to the data flow, the corresponding target hash bucket is found in the preset hash bucket array through the hash value, and the five-tuple information is compared with the five-tuple information stored in the preset hash bucket array to obtain the comparison result. Finally, the storage position corresponding to the data flow is determined in the target hash bucket through the comparison result, and then the number of occurrence windows, average network rate and five-tuple information corresponding to the data flow are stored in the storage position to update the hash bucket data stored in the preset hash bucket array. This can greatly improve the information storage efficiency of the data flow in the network to be detected, and is also conducive to quickly finding the average network rate through the hash bucket data in the subsequent The target data stream whose network rate and window occurrence times do not meet the preset conditions is identified, and network security detection is performed on the target data stream. Compared with the related art, whether the network data stream is a network data stream of advanced persistent threat is analyzed by setting corresponding weights for different data streams, in the present application, the average network rate and window occurrence times of different data streams are firstly saved in a hash bucket array, and then the target data stream that does not meet the preset conditions is determined by the average network rate and window occurrence times. In this way, the target data stream with network security risks can be more accurately determined, and the target data stream can be security-tested, thereby improving the accuracy of network security detection of data streams in the network.

[0304] The embodiment of the present application also provides a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the above data flow detection method when executing the computer program. The computer device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0305] See also Figure 6 , Figure 6 The hardware structure of a computer device according to another embodiment is shown, and the computer device includes:

[0306] The processor 401 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0307] The memory 402 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 402 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 402, and the processor 401 calls and executes the data flow detection method of the embodiment of this application;

[0308] Input / output interface 403, used to implement information input and output;

[0309] Communication interface 404, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0310] A bus 405 that transmits information between various components of the device (e.g., processor 401, memory 402, input / output interface 403, and communication interface 404);

[0311] The processor 401 , the memory 402 , the input / output interface 403 and the communication interface 404 are connected to each other in communication within the device via the bus 405 .

[0312] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned data flow detection method is implemented.

[0313] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0314] The data flow detection method, device, computer equipment and storage medium provided by the embodiments of the present application are as follows: a data flow in a network to be detected is obtained, and five-tuple information of the data flow is determined; a hash value of the data flow is determined according to a preset hash function, and the hash value is determined to determine a target hash bucket corresponding to the data flow in a preset hash bucket array; the five-tuple information is compared with the five-tuple information stored in the preset hash bucket array to obtain a comparison result, and a storage position corresponding to the data flow is determined in the target hash bucket according to the comparison result; the number of occurrence windows and the average network rate corresponding to the data flow are determined, and the number of occurrence windows, the average network rate and the five-tuple information corresponding to the data flow are stored in the storage position of the target hash bucket to update the hash bucket data stored in the preset hash bucket array; a target data flow whose average network rate and number of occurrence windows do not meet the preset conditions is determined according to the hash bucket data, and network security detection is performed on the target data flow.

[0315] In this way, by obtaining the data flow in the network to be detected and calculating the hash value corresponding to the data flow, the corresponding target hash bucket is found in the preset hash bucket array through the hash value, and the five-tuple information is compared with the five-tuple information stored in the preset hash bucket array to obtain the comparison result. Finally, the storage position corresponding to the data flow is determined in the target hash bucket through the comparison result, and then the number of occurrence windows, average network rate and five-tuple information corresponding to the data flow are stored in the storage position to update the hash bucket data stored in the preset hash bucket array. This can greatly improve the information storage efficiency of the data flow in the network to be detected, and is also conducive to quickly finding the average network rate through the hash bucket data in the subsequent The target data stream whose network rate and window occurrence times do not meet the preset conditions is identified, and network security detection is performed on the target data stream. Compared with the related art, whether the network data stream is a network data stream of advanced persistent threat is analyzed by setting corresponding weights for different data streams, in the present application, the average network rate and window occurrence times of different data streams are firstly saved in a hash bucket array, and then the target data stream that does not meet the preset conditions is determined by the average network rate and window occurrence times. In this way, the target data stream with network security risks can be more accurately determined, and the target data stream can be security-tested, thereby improving the accuracy of network security detection of data streams in the network.

[0316] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0317] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0318] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0319] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0320] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0321] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0322] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0323] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0324] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0325] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0326] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A data flow detection method, characterized in that: include: Acquire a data flow in the network to be detected, and determine quintuple information of the data flow; Determine a first Hash value of the data stream according to a first Hash function, and determine a second Hash value of the data stream according to a second Hash function; Determine a first target hash bucket corresponding to the data flow in a first hash bucket array according to the first hash value, determine a second target hash bucket corresponding to the data flow in a second hash bucket array according to the second hash value, and determine the first target hash bucket and the second target hash bucket as target hash buckets corresponding to the data flow; Comparing the five-tuple information with the five-tuple information stored in a preset hash bucket array to obtain a comparison result, and determining a storage location corresponding to the data stream in the target hash bucket according to the comparison result, wherein the preset hash bucket array includes a first hash bucket array and a second hash bucket array; Determine the number of occurrence windows and the average network rate corresponding to the data flow, and store the number of occurrence windows, the average network rate and the five-tuple information corresponding to the data flow in the storage location of the target hash bucket to update the hash bucket data stored in the preset hash bucket array; Determine, based on the hash bucket data, a target data flow whose average network rate and window occurrence times do not meet preset conditions, and perform network security detection on the target data flow; Wherein, determining the storage location corresponding to the data stream in the target hash bucket according to the comparison result includes: When the comparison result indicates that the five-tuple information matches the five-tuple information stored in the first hash bucket array, determining whether the current detection window corresponding to the data stream is the same as the previous detection window; When the current detection window corresponding to the data stream is different from the previous detection window, determining a current storage position of the data stream sorted in the first target hash bucket; Obtaining the average network rate and window occurrence times corresponding to the data flow; Determine in the first target hash bucket a neighbor storage position sorted before the current storage position, and an average network rate and a window occurrence count of a neighbor data stream corresponding to the neighbor storage position; A storage location corresponding to the data flow is determined in the first target hash bucket according to an average network rate and a window occurrence number corresponding to the data flow and an average network rate and a window occurrence number of the neighbor data flow.

2. The data flow detection method according to claim 1, characterized in that: The comparing the five-tuple information with the five-tuple information stored in the preset hash bucket array to obtain a comparison result includes: Determining the stored five-tuple information in the first hash bucket array and the second hash bucket array; The five-tuple information is compared with the saved five-tuple information to obtain a comparison result.

3. The data flow detection method according to claim 1, characterized in that: The obtaining the average network rate corresponding to the data flow includes: Obtain the historical average network rate and the number of historical occurrence windows of the data flow detected before the current detection window; Determining the occurrence frequency of the data stream in the current detection window; The historical average network rate and the historical window occurrence times are multiplied and then added to the occurrence frequency to obtain a first calculation result; The first calculation result is divided by the number of occurrence windows corresponding to the data flow to obtain an average network rate corresponding to the data flow.

4. The data flow detection method according to claim 1, characterized in that: The step of determining, in the first target hash bucket, a storage location corresponding to the data flow according to an average network rate and a window occurrence number corresponding to the data flow and an average network rate and a window occurrence number of the neighboring data flow, comprising: When the number of occurrence windows corresponding to the data stream is greater than the number of occurrence windows corresponding to the neighbor data stream, exchanging storage positions between the data stream and the neighbor data stream; Return to execute and determine the current storage position of the data stream sorted in the first target hash bucket until the number of occurrence windows corresponding to the data stream is less than the number of occurrence windows corresponding to the neighbor data stream, or the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighbor data stream, and the average network rate corresponding to the data stream is greater than or equal to the average network rate corresponding to the neighbor data stream, and the current storage position corresponding to the data stream in the first target hash bucket is determined as the storage position corresponding to the data stream.

5. The data flow detection method according to claim 1, characterized in that: The step of determining, in the first target hash bucket, a storage location corresponding to the data flow according to an average network rate and a window occurrence number corresponding to the data flow and an average network rate and a window occurrence number of the neighboring data flow, comprising: When the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighbor data stream, and the average network rate corresponding to the data stream is lower than the average network rate corresponding to the neighbor data stream, the data stream and the neighbor data stream are exchanged for storage position; Return to execute and determine the current storage position of the data stream sorted in the first target hash bucket until the number of occurrence windows corresponding to the data stream is less than the number of occurrence windows corresponding to the neighbor data stream, or the number of occurrence windows corresponding to the data stream is equal to the number of occurrence windows corresponding to the neighbor data stream, and the average network rate corresponding to the data stream is greater than or equal to the average network rate corresponding to the neighbor data stream, and the current storage position corresponding to the data stream in the first target hash bucket is determined as the storage position corresponding to the data stream.

6. The data flow detection method according to claim 1, characterized in that: Determining a storage location corresponding to the data stream in the target hash bucket according to the comparison result includes: When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and the five-tuple information matches the five-tuple information stored in the second hash bucket array, determining whether the current detection window corresponding to the data stream is the same as the previous detection window; When the current detection window corresponding to the data stream is different from the previous detection window, determining a current storage position of the data stream sorted in the second target hash bucket; Obtaining the average network rate and window occurrence times corresponding to the data flow; Determine in the second target hash bucket a neighbor storage position sorted before the current storage position, and an average network rate and a window occurrence count of neighbor data flows stored in the neighbor storage position; A storage location corresponding to the data flow is determined in the second target hash bucket according to an average network rate and a window occurrence number corresponding to the data flow and an average network rate and a window occurrence number of the neighbor data flow.

7. The data flow detection method according to claim 1, characterized in that: Determining a storage location corresponding to the data stream in the target hash bucket according to the comparison result includes: When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, and there is an empty storage position in the first target hash bucket, determining the empty storage position in the first target hash bucket as a candidate storage position corresponding to the data flow; When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, there is no empty storage location in the first target hash bucket, and there is a candidate data stream in the first target hash bucket whose average network rate is greater than a preset average network rate threshold, the data in the storage location corresponding to the candidate data stream is cleared, and the storage location corresponding to the candidate data stream is determined as the candidate storage location corresponding to the data stream.

8. The data flow detection method according to claim 1, characterized in that: Determining a storage location corresponding to the data stream in the target hash bucket according to the comparison result includes: When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, the five-tuple information does not match the five-tuple information stored in the second hash bucket array, and there is a candidate storage position corresponding to the data stream in the first target hash bucket, determine the candidate storage position in the first target hash bucket as the storage position corresponding to the data stream; When the comparison result indicates that the five-tuple information does not match the five-tuple information stored in the first hash bucket array, the five-tuple information does not match the five-tuple information stored in the second hash bucket array, and the candidate storage position corresponding to the data stream does not exist in the first target hash bucket, and the candidate storage position corresponding to the data stream exists in the second target hash bucket, the candidate storage position in the second target hash bucket is determined as the storage position corresponding to the data stream; When the comparison result indicates that the quintuple information does not match the quintuple information stored in the first hash bucket array, the quintuple information does not match the quintuple information stored in the second hash bucket array, the candidate storage position corresponding to the data flow does not exist in the first target hash bucket, and the candidate storage position corresponding to the data flow does not exist in the second target hash bucket, determine the number of occurrence windows and the average network rate of the first data flow corresponding to the last sorted storage position in the first target hash bucket, and determine the number of occurrence windows and the average network rate of the second data flow corresponding to the last sorted storage position in the second target hash bucket; According to the number of occurrence windows and the average network rate of the first data stream and the number of occurrence windows and the average network rate of the second data stream, the storage position corresponding to the data stream is determined in the last storage position sorted in the first target hash bucket and the last storage position sorted in the second target hash bucket.

9. The data flow detection method according to claim 8, characterized in that: The method of determining the storage position corresponding to the data stream from the last sorted storage position in the first target hash bucket and the last sorted storage position in the second target hash bucket according to the number of occurrence windows and the average network rate of the first data stream and the number of occurrence windows and the average network rate of the second data stream comprises: When the number of occurrence windows of the first data stream is less than the number of occurrence windows of the second data stream, attenuating the average network rate of the first data stream to obtain an attenuated average network rate of the first data stream; When the attenuated average network rate of the first data stream is less than a preset attenuated average network rate threshold, clearing the data of the last sorted storage position in the first target hash bucket and determining it as the storage position corresponding to the data stream; When the number of occurrence windows of the first data stream is equal to the number of occurrence windows of the second data stream, and the average network rate of the first data stream is greater than the average network rate of the second data stream, attenuating the average network rate of the first data stream to obtain an attenuated average network rate of the first data stream; When the attenuated average network rate of the first data stream is less than a preset attenuated average network rate threshold, the last sorted storage location data in the first target hash bucket is cleared and determined as the storage location corresponding to the data stream.

10. The data flow detection method according to claim 9, characterized in that: The attenuating the average network rate of the first data stream to obtain the attenuated average network rate of the first data stream includes: Determine the inverse of the number of occurrence windows of the first data stream; The reciprocal is subtracted from the average network rate of the first data stream to obtain the attenuated average network rate of the first data stream.

11. The data flow detection method according to claim 1, characterized in that: The step of determining, according to the hash bucket data, a target data flow whose average network rate and window occurrence times do not meet preset conditions comprises: In the hash bucket data, a data flow whose average network rate is less than or equal to a preset average rate threshold and whose window occurrence times is greater than or equal to a preset window occurrence times threshold is determined as a target data flow that does not meet the preset conditions.

12. A data flow detection device, characterized in that: include: An acquisition module, used to acquire a data stream in a network to be detected and determine quintuple information of the data stream; a determination module, configured to determine a first Hash value of the data stream according to a first Hash function, and to determine a second Hash value of the data stream according to a second Hash function; Determine a first target hash bucket corresponding to the data flow in a first hash bucket array according to the first hash value, determine a second target hash bucket corresponding to the data flow in a second hash bucket array according to the second hash value, and determine the first target hash bucket and the second target hash bucket as target hash buckets corresponding to the data flow; a comparison module, configured to compare the five-tuple information with the five-tuple information stored in a preset hash bucket array to obtain a comparison result, and determine a storage location corresponding to the data stream in the target hash bucket according to the comparison result, wherein the preset hash bucket array includes a first hash bucket array and a second hash bucket array; A storage module, used for determining the number of occurrence windows and the average network rate corresponding to the data stream, and storing the number of occurrence windows, the average network rate and the five-tuple information corresponding to the data stream in the storage location of the target hash bucket to update the hash bucket data stored in the preset hash bucket array; A detection module, used to determine, based on the hash bucket data, a target data flow whose average network rate and window occurrence times do not meet preset conditions, and perform network security detection on the target data flow; The comparison module includes a determination submodule, which is used to: When the comparison result indicates that the five-tuple information matches the five-tuple information stored in the first hash bucket array, determining whether the current detection window corresponding to the data stream is the same as the previous detection window; When the current detection window corresponding to the data stream is different from the previous detection window, determining a current storage position of the data stream sorted in the first target hash bucket; Obtaining the average network rate and window occurrence times corresponding to the data flow; Determine in the first target hash bucket a neighbor storage position sorted before the current storage position, and an average network rate and a window occurrence count of a neighbor data stream corresponding to the neighbor storage position; A storage location corresponding to the data flow is determined in the first target hash bucket according to an average network rate and a window occurrence number corresponding to the data flow and an average network rate and a window occurrence number of the neighbor data flow.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the data flow detection method according to any one of claims 1 to 11.

14. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the data flow detection method according to any one of claims 1 to 11 is implemented.

Images