Flow detection method

Abstract

The invention discloses a traffic detection method, and particularly relates to the technical field of traffic detection, which comprises the following steps of: screening unencrypted network traffic in all network traffic in equipment, preferentially detecting, extracting encrypted traffic after the unencrypted network traffic is detected, and acquiring the total number of encryption types corresponding to the encrypted traffic; obtaining a traffic quantity coefficient, a transmission frequency coefficient and a transmission instability coefficient of the corresponding encrypted traffic of each encryption type, and obtaining a detection priority index in combination with a preset decryption difficulty value corresponding to an own encryption mode; according to the method, the detection priority indexes are sequenced from large to small, and the encryption traffic corresponding to the encryption type with the maximum detection priority index is preferentially detected, so that decryption detection can be reasonably performed on the encryption traffic corresponding to different encryption modes, the bottleneck of a detection system is reduced, and the detection efficiency is improved. The traffic with a relatively large abnormal degree can be identified in time, and the overall network security and stability are further improved.

Description

Technical Field

[0001] The present invention relates to the technical field of flow detection, and in particular to a flow detection method. Background Art

[0002] Network traffic detection refers to the monitoring and analysis of data packets transmitted in the network to identify abnormal activities, potential threats or performance issues. By collecting and analyzing traffic data in real time, the detection system can identify unusual traffic patterns, malicious attacks, network congestion or data leakage, so as to take corresponding protective measures to ensure the security and stability of the network. This process usually involves a variety of technical means, such as deep packet inspection, traffic behavior analysis and machine learning, to improve the accuracy and efficiency of detection;

[0003] With the popularity of encrypted communications, network traffic detection is becoming more and more complicated. When devices detect encrypted traffic, they need to decrypt and detect the encrypted traffic one by one to ensure the security of network traffic and devices.

[0004] However, in actual encrypted traffic detection, the encrypted traffic corresponding to different encryption methods has different decryption difficulties and takes different times during the decryption process of the device. If the encrypted traffic corresponding to different encryption methods cannot be properly decrypted and detected, it may cause bottlenecks in the detection system and fail to identify abnormal traffic in a timely manner, further reducing the overall network security and stability. Summary of the invention

[0005] The purpose of the present invention is to solve the problem and to propose a flow detection method.

[0006] The present invention provides a flow detection method, the method comprising:

[0007] Obtain all network traffic in the device, filter out unencrypted network traffic in the device, and give priority to detection.

[0008] After detecting unencrypted network traffic in all network traffic in the device, extract encrypted traffic in all network traffic of the device, and obtain the total number of encryption types corresponding to the encrypted traffic;

[0009] Obtain the traffic quantity coefficient, transmission frequency coefficient, and transmission instability coefficient of the corresponding encrypted traffic of each encryption type, and obtain the detection priority index in combination with the preset decryption difficulty value corresponding to the encryption method itself;

[0010] The detection priority indexes are sorted in descending order, and the encrypted traffic corresponding to the encryption type with the largest detection priority index is detected first.

[0011] Optionally, the method for obtaining the flow quantity coefficient is:

[0012]

[0013] Where RF is the traffic quantity coefficient, TB is the total network traffic in the device; T is the total amount of encrypted traffic of each encryption type; RB is the average total traffic value in the historical record; C(t) is the rate of change of encrypted traffic at time t, α is the weight factor of the proportion of historical traffic to current traffic, and its value range is 0≤α≤1; β is the weight factor of the traffic change rate in the traffic quantity coefficient, and its value range is 0≤β≤1; γ is an adjustment factor used to control the final scale of the traffic quantity coefficient, which is a positive number.

[0014] Optionally, the transmission frequency coefficient includes:

[0015] Obtain the actual upload rate and the preset fastest upload rate threshold of each encryption type of encrypted traffic at different times within time T, and mark the actual upload rate and the preset fastest upload rate threshold as P respectively. 实 l and P 预 , l represents the number of the actual upload rate of encrypted traffic of each encryption type at different times, l = 1, 2, 3, 4, ..., L, L is a positive integer;

[0016] According to P 实 l and P 预 The transmission frequency coefficient DF is obtained, and the calculation formula is:

[0017] Optionally, the transmission instability coefficient includes:

[0018] Get the actual number of uploaded data of each encryption type of encrypted traffic at different times in time T, and mark the actual number of uploaded data as X 实 p , p represents the sequence number of the number of encrypted traffic actually uploaded by each encryption type at different times within time T, p = 1, 2, 3, 4, ..., g, g is the total number of actually uploaded data, and g is a positive integer;

[0019] Calculate the actual number of uploaded data X at different times within T time 实 p The standard deviation of is taken as the transmission instability coefficient WD, and the calculation formula is:

[0020]

[0021] in, is the average value of the actual number of uploaded data at different times within time T, and the expression obtained is:

[0022] Optionally, the detection priority index includes:

[0023]

[0024] Wherein, QDF is the detection priority index, RF, DF, WD and DR are the flow quantity coefficient, transmission frequency coefficient, transmission instability coefficient and preset decryption difficulty value respectively, a1, a2, a3, a4 are the preset proportional coefficients of the flow quantity coefficient, transmission frequency coefficient, transmission instability coefficient and preset decryption difficulty value respectively, and a1, a2, a3, a4 are all greater than 0.

[0025] Optionally, the detection priority indexes are sorted in descending order, and the encrypted traffic corresponding to the encryption type with the largest detection priority index is detected first, including:

[0026] The detection priority indexes of the encrypted traffic corresponding to all encryption types are sorted in descending order. The larger the detection priority index, the greater the abnormality of the network traffic encrypted by the corresponding encryption type, and the higher the detection priority. When the detection of the encrypted traffic corresponding to each encryption type is completed, the detection of the encrypted traffic corresponding to the next encryption type will begin.

[0027] Beneficial effects of the present invention:

[0028] The present invention proposes a method for flow detection, which obtains all network flows in a device, screens unencrypted network flows in all network flows in the device, and gives priority to detection. After detecting the unencrypted network flows in all network flows in the device, the encrypted flows in all network flows of the device are extracted, and the total number of encryption types corresponding to the encrypted flows is obtained; the flow quantity coefficient, transmission frequency coefficient, and transmission instability coefficient of the encrypted flows corresponding to each encryption type are obtained, and a detection priority index is obtained in combination with a preset decryption difficulty value corresponding to the encryption method itself; the detection priority indexes are sorted in order from large to small, and the encrypted flows corresponding to the encryption type with the largest detection priority index are detected first. In this way, the encrypted flows corresponding to different encryption methods can be reasonably decrypted and detected, the bottleneck of the detection system can be reduced, the flows with a large degree of abnormality can be identified in time, and the overall network security and stability can be further improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The present invention will be further described below in conjunction with the accompanying drawings.

[0030] Figure 1A flow chart of a method for flow detection is provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making any creative work shall fall within the scope of protection of the present invention.

[0033] The embodiment of the present invention provides a method for flow detection. Figure 1 , Figure 1 A flow chart of a method for flow detection provided by an embodiment of the present invention. The method comprises the following steps:

[0034] Obtain all network traffic in the device, filter out unencrypted network traffic in the device, and give priority to detection.

[0035] After detecting unencrypted network traffic in all network traffic in the device, extract encrypted traffic in all network traffic of the device, and obtain the total number of encryption types corresponding to the encrypted traffic;

[0036] Obtain the traffic quantity coefficient, transmission frequency coefficient, and transmission instability coefficient of the corresponding encrypted traffic of each encryption type, and obtain the detection priority index in combination with the preset decryption difficulty value corresponding to the encryption method itself;

[0037] The detection priority indexes are sorted in descending order, and the encrypted traffic corresponding to the encryption type with the largest detection priority index is detected first.

[0038] Based on a traffic detection method provided in an embodiment of the present invention, through the above-mentioned method, the encrypted traffic corresponding to different encryption methods can be reasonably decrypted and detected, thereby reducing the bottleneck of the detection system, being able to timely identify traffic with a high degree of abnormality, and further improving the overall network security and stability.

[0039] It should be noted that obtaining all network traffic in the device and filtering unencrypted network traffic can be achieved by following the steps below:

[0040] Traffic monitoring tool deployment: First, network traffic monitoring tools need to be deployed on the target device. These tools can capture and analyze network data packets in real time and record detailed information of each data packet, such as source address, destination address, protocol type, packet size, etc.

[0041] Packet parsing: Traffic monitoring tools should be able to parse captured packets and identify the encryption status of each packet. You can check the protocol field of the packet to determine whether it uses an encrypted protocol (such as HTTPS, SSL / TLS, etc.).

[0042] Filter unencrypted traffic: Based on the above analysis, filter out all unencrypted network traffic from the captured data. This can be achieved by setting filtering conditions, such as selecting only those packets that use plaintext protocols (such as HTTP, FTP, etc.).

[0043] Priority marking: For the filtered unencrypted traffic, priority marking can be performed to ensure that this traffic will be given priority in the subsequent detection process.

[0044] The benefits of doing this include:

[0045] Improve detection efficiency: Unencrypted network traffic is usually transmitted in plain text, which is easy to analyze and understand. Prioritizing the detection of this traffic can quickly identify potential security threats, such as malware propagation, data leakage or other abnormal activities. This efficiency is crucial for taking timely protective measures, especially in the early stages of a cyber attack.

[0046] Resource optimization: Prioritizing the inspection of unencrypted traffic can effectively utilize system resources, because the inspection of encrypted traffic usually requires more computing power and time to decrypt and analyze. By focusing on unencrypted traffic, the system is able to process large amounts of data faster, improving overall performance.

[0047] Risk identification: Unencrypted traffic often contains sensitive information, such as user credentials and private data. By timely detecting this traffic, potential security risks can be identified and responded to early, thereby reducing the possibility of data leakage.

[0048] Clear detection benchmark: Provides a clear detection benchmark for encrypted traffic, so that subsequent analysis of encrypted traffic can be based on a good understanding of network behavior. This foundation helps to enhance the accuracy of the detection system and reduce false positives.

[0049] In summary, by screening unencrypted traffic and prioritizing detection, we can not only improve the efficiency and effectiveness of network security protection, but also lay a good foundation for subsequent encrypted traffic analysis.

[0050] It should be noted that

[0051] After detecting all unencrypted network traffic in the device, extracting encrypted traffic and obtaining the total number of encryption types corresponding to encrypted traffic can be achieved through a series of systematic steps. First, continue to use network traffic monitoring tools that have real-time packet capture and analysis capabilities to carefully examine each captured packet. Specifically, the monitoring system automatically parses the header information of the packet to identify encrypted traffic. This process involves identifying common encryption protocols such as HTTPS, SSL, TLS, IPsec, etc., and the system will classify them by protocol identifiers or port numbers. For example, HTTPS usually uses port 443, and SSL / TLS can be identified through a specific handshake process. Once encrypted traffic is identified, the monitoring tool will classify each encryption type and calculate its frequency of occurrence. Specifically, the system will maintain an encrypted traffic counter, and each time a certain encryption protocol is detected, the counter will increase by the corresponding amount. In addition, the system can also collect traffic characteristic data for each encryption type, such as the total number of bytes of traffic, transmission frequency and duration, etc., which will help further analyze and evaluate the nature of the traffic. After the extraction and statistics are completed, the monitoring system will generate a detailed report listing the traffic statistics of each encryption type, which is convenient for network administrators to review and make decisions. This method can not only effectively identify and count encrypted traffic in the device, but also provide valuable data support for subsequent risk assessment and detection priority setting. Through in-depth analysis of encrypted traffic, network managers can better understand traffic patterns, identify potential security risks, and formulate corresponding protection strategies, thereby improving the overall network security level.

[0052] In one embodiment, the method for obtaining the flow quantity coefficient is:

[0053]

[0054] Where RF is the traffic quantity coefficient, TB is the total network traffic in the device (unit: byte / second or other units); T is the total amount of encrypted traffic of each encryption type (unit: byte / second or other units); RB is the average total traffic value in the historical record (used to consider the changing trend of encrypted traffic); C(t) is the rate of change of encrypted traffic at time t (unit: byte / second2, indicating the changing trend of traffic over time), α is the weight factor of the proportion of historical traffic to current traffic, and the value range is 0≤α≤1; β is the weight factor of the traffic change rate in the traffic quantity coefficient, and the value range is 0≤β≤1; γ is an adjustment factor used to control the final scale of the traffic quantity coefficient, which is usually a positive number.

[0055] It should be noted that the traffic ratio in the formula is: Represents the proportion of each encrypted traffic relative to the total traffic of the device at the current moment; this is a basic measurement standard that reflects the importance of the encrypted traffic in the overall traffic;

[0056] Historical proportion calibration: It is the integral of the rate of change of encrypted traffic, that is, the total amount of traffic change in a period of time; a rapidly changing traffic may mean a potential threat. This part controls the impact of the traffic change rate on the traffic quantity coefficient through the weight α;

[0057] Flow rate change: It is the integral of the rate of change of encrypted traffic, that is, the total amount of traffic change over a period of time; rapidly changing traffic may mean potential threats. This part controls the impact of the traffic change rate on the traffic quantity coefficient through the weight β.

[0058] The adjustment factor γ is used to adjust the scale of the entire coefficient to ensure that the flow quantity coefficient can obtain a reasonable value in actual use. Its value is usually determined through experiments.

[0059] It should be noted that to calculate the encrypted traffic ratio: first determine its relative importance to the entire network traffic by the encrypted traffic ratio at the current moment;

[0060] Historical comparison: Compare the traffic with the historical average traffic to identify whether the encrypted traffic has an abnormal growth trend;

[0061] Analyze the rate of change: Use the rate of change of the flow rate to determine whether the flow rate has drastic fluctuations, thereby determining possible abnormalities;

[0062] The weight α can be adjusted based on the importance of historical data compared to current traffic. For example, if the current traffic is significantly different from the historical traffic, the value of α can be increased to increase the weight of the current traffic in the formula;

[0063] The weight β can also be adjusted according to the importance of the flow rate change rate. If the flow rate changes dramatically, it may mean a greater threat. It is recommended to increase the value of β;

[0064] This complex traffic quantity coefficient calculation method can more accurately evaluate the priority of different encrypted traffic, thereby optimizing the process and resource allocation of network traffic detection;

[0065] It should be noted that the total amount of network traffic in the device, the total amount of encrypted traffic of each encryption type, the average total traffic value in the historical records, and the rate of change of the encrypted traffic at time t can all be obtained through network traffic monitoring tools and historical record systems, or other methods, which are not specifically limited or elaborated.

[0066] When the traffic quantity coefficient of the encrypted traffic corresponding to the encryption type is larger, the encrypted traffic priority detection index of the corresponding encryption type is larger. The reason is that when the traffic quantity coefficient of the encrypted traffic corresponding to the encryption type is larger, the priority detection index of the encrypted traffic is larger. This is because the traffic quantity coefficient combines the influence of multiple key factors, such as the proportion of traffic in the entire network traffic, the comparison between current traffic and historical traffic, and the rate of change of traffic over time. A larger traffic quantity coefficient usually means that the encrypted traffic occupies a higher proportion of the overall traffic, or there is a significant fluctuation in a short period of time, which may indicate potential abnormal behavior or security risks in the network. In addition, a sharp fluctuation in the rate of change of traffic may also indicate that the traffic has abnormal behavior, such as malicious communication or data leakage. Therefore, prioritizing the processing of this traffic helps to discover potential security threats at an early stage, improve the response efficiency of the detection system, and take protective measures in time to avoid greater impact or attack on the network.

[0067] In one embodiment, the transmission frequency coefficient includes:

[0068] Obtain the actual upload rate and the preset fastest upload rate threshold of each encryption type of encrypted traffic at different times within time T, and mark the actual upload rate and the preset fastest upload rate threshold as P respectively. 实 l and P 预 , l represents the number of the actual upload rate of encrypted traffic of each encryption type at different times, l = 1, 2, 3, 4, ..., L, L is a positive integer;

[0069] According to P 实 l and P 预 The transmission frequency coefficient DF is obtained, and the calculation formula is:

[0070] It should be noted that the actual upload rate of encrypted traffic of each encryption type in the device can be obtained through a network traffic monitoring tool or other methods, which are not limited or elaborated on in detail.

[0071] It should be noted that when the transmission frequency coefficient of the encrypted traffic corresponding to the encryption type is larger, the priority detection index of the encrypted traffic corresponding to the encryption type is larger. The reason is that when the transmission frequency coefficient of the encrypted traffic corresponding to the encryption type is larger, it means that the transmission speed of the encrypted traffic is closer to or even exceeds the normal level relative to the preset fastest upload rate threshold. A larger transmission frequency coefficient means that the transmission speed of this traffic type has a higher abnormality, because an abnormally high transmission speed may mean unusual data upload or download activities, such as large amounts of data transmission, potential data leakage, malicious attacks or other suspicious behaviors. This abnormality may be a rapid data transfer in a short period of time, or it may be a traffic fluctuation that exceeds the normal traffic characteristics of the device or network. Therefore, the larger the transmission frequency coefficient, the higher the priority detection index of the encrypted traffic, which requires more attention and priority detection. By giving priority to these flows, potential network threats can be effectively identified and responded to, the negative impact of high-risk flows on the system can be reduced, and the stability and security of the network can be guaranteed. In addition, a larger transmission frequency coefficient also indicates that the system may have an abnormality in the rate of encrypted communication, and the reasons behind it need to be further analyzed to take necessary protective measures.

[0072] In one embodiment, the transmission instability coefficient includes:

[0073] Get the actual number of uploaded data of each encryption type of encrypted traffic at different times in time T, and mark the actual number of uploaded data as X 实 p , p represents the sequence number of the number of encrypted traffic actually uploaded by each encryption type at different times within time T, p = 1, 2, 3, 4, ..., g, g is the total number of actually uploaded data, and g is a positive integer;

[0074] Calculate the actual number of uploaded data X at different times within T time 实 p The standard deviation of is taken as the transmission instability coefficient WD, and the calculation formula is:

[0075]

[0076] in, is the average value of the actual number of uploaded data at different times within time T, and the expression obtained is:

[0077] It should be noted that the actual number of uploaded data of each encryption type of encrypted traffic at different times can be obtained through network traffic monitoring tools or other methods, which are not limited or elaborated in detail.

[0078] It should be noted that when the transmission instability coefficient of the encrypted traffic corresponding to the encryption type is larger, the priority detection index of the encrypted traffic corresponding to the encryption type is larger. The reason is that when the transmission instability coefficient of the encrypted traffic corresponding to the encryption type is larger, it means that the encrypted traffic has large fluctuations and inconsistencies at different times within the T time. This instability means that the transmission process of the encrypted traffic may not be smooth. Frequent fluctuations in the number of uploaded data may be a sign of potential abnormal activities, such as sudden peak data transmission or abnormal network behavior, which are often related to malicious attacks, data leakage or improper resource occupation. Therefore, the larger the transmission instability coefficient, the greater the instability and abnormal behavior of the encrypted traffic. This unstable transmission mode may pose a threat to the security and normal operation of the network. In order to prevent possible security risks, the system should give priority to the detection of encrypted traffic with a large transmission instability coefficient, so as to timely discover and deal with potential risks. In addition, the analysis of the transmission instability coefficient can also help network administrators better understand the behavior pattern of encrypted traffic, determine whether abnormal fluctuations are related to malicious activities, and adopt corresponding defense strategies to ensure that the network remains safe and stable when facing complex encrypted traffic.

[0079] In one embodiment, the detection priority index includes:

[0080]

[0081] Wherein, QDF is the detection priority index, RF, DF, WD and DR are the flow quantity coefficient, transmission frequency coefficient, transmission instability coefficient and preset decryption difficulty value respectively, a1, a2, a3, a4 are the preset proportional coefficients of the flow quantity coefficient, transmission frequency coefficient, transmission instability coefficient and preset decryption difficulty value respectively, and a1, a2, a3, a4 are all greater than 0.

[0082] It should be noted that a1, a2, a3, and a4 are set by professionals according to actual conditions. Generally, the sum of a1, a2, a3, and a4 is 1. For example, a1, a2, a3, and a4 can be 0.25, 0.25, 0.25, and 0.25, respectively, or other numbers, without specific limitation.

[0083] It should be noted that the preset decryption difficulty value is set by professionals according to actual conditions, and no specific limitation or elaboration is made.

[0084] In one embodiment, sorting the detection priority indexes in descending order and prioritizing the detection of encrypted traffic corresponding to the encryption type with the largest detection priority index includes:

[0085] The detection priority indexes of the encrypted traffic corresponding to all encryption types are sorted in descending order. The larger the detection priority index, the greater the abnormality of the network traffic encrypted by the corresponding encryption type, and the higher the detection priority. When the detection of the encrypted traffic corresponding to each encryption type is completed, the detection of the encrypted traffic corresponding to the next encryption type will begin.

[0086] In one implementation, the above method can effectively optimize the allocation and use of detection resources and give priority to processing encrypted traffic with higher risks. By giving priority to the encrypted traffic with the largest detection priority index, the system can quickly lock in the encryption type with greater potential threats, thereby maximizing detection efficiency within limited time and resources. This sorting method ensures a rapid response to high-risk traffic, helps to promptly detect abnormal communications or potential security vulnerabilities, and reduces security risks caused by delayed detection. At the same time, this phased, one-by-one detection method also avoids waste of resources, focuses more computing and analysis capabilities on traffic that needs to be focused on, and ensures that the network security monitoring system can maintain efficient operation when faced with large amounts of complex encrypted traffic. Through this orderly detection process, the accuracy and effectiveness of overall detection can be improved, preventing potential threats from continuing to spread in the network.

[0087] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A method for flow detection, characterized in that: The following steps are involved: Obtain all network traffic in the device, filter out unencrypted network traffic in the device, and give priority to detection; After detecting unencrypted network traffic in all network traffic in the device, extract encrypted traffic in all network traffic of the device, and obtain the total number of encryption types corresponding to the encrypted traffic; Obtain the traffic quantity coefficient, transmission frequency coefficient, and transmission instability coefficient of the corresponding encrypted traffic of each encryption type, and obtain the detection priority index in combination with the preset decryption difficulty value corresponding to the encryption method itself; The detection priority indexes are sorted in descending order, and the encrypted traffic corresponding to the encryption type with the largest detection priority index is detected first.

2. A flow detection method according to claim 1, characterized in that: The method for obtaining the flow quantity coefficient is: In the formula, RF is the flow quantity coefficient, and TB is the total network flow in the device; T is the total amount of encrypted traffic of each encryption type; RB is the average total traffic value in the historical records; C(t) is the rate of change of the encrypted traffic at time t; α is the weight factor of the historical traffic and the current traffic, and the value range is 0≤α≤1; β is the weight factor of the flow change rate in the flow quantity coefficient, and its value range is 0≤β≤1; γ is an adjustment factor used to control the final scale of the flow quantity coefficient, which is a positive number.

3. A flow detection method according to claim 1, characterized in that: The transmission frequency coefficients include: Obtain the actual upload rate and the preset fastest upload rate threshold of each encryption type of encrypted traffic at different times within time T, and mark the actual upload rate and the preset fastest upload rate threshold as P respectively. 实 l and P 预 , l represents the number of the actual upload rate of encrypted traffic of each encryption type at different times, l = 1, 2, 3, 4, ..., L, L is a positive integer; According to P 实 l and P 预 The transmission frequency coefficient DF is obtained, and the calculation formula is:

4. A flow detection method according to claim 1, characterized in that: The transmission instability coefficient includes: Get the actual number of uploaded data of each encryption type of encrypted traffic at different times in time T, and mark the actual number of uploaded data as X 实 p , p represents the sequence number of the number of encrypted traffic actually uploaded by each encryption type at different times within time T, p = 1, 2, 3, 4, ..., g, g is the total number of actually uploaded data, and g is a positive integer; Calculate the actual number of uploaded data X at different times within T time 实 p The standard deviation of is taken as the transmission instability coefficient WD, and the calculation formula is: in, is the average value of the actual number of uploaded data at different times within time T, and the expression obtained is:

5. A flow detection method according to claim 1, characterized in that: The detection priority index includes: Wherein, QDF is the detection priority index, RF, DF, WD and DR are the flow quantity coefficient, transmission frequency coefficient, transmission instability coefficient and preset decryption difficulty value respectively, a1, a2, a3, a4 are the preset proportional coefficients of the flow quantity coefficient, transmission frequency coefficient, transmission instability coefficient and preset decryption difficulty value respectively, and a1, a2, a3, a4 are all greater than 0.

6. A flow detection method according to claim 1, characterized in that: The detection priority index is sorted from large to small, and the encrypted traffic corresponding to the encryption type with the largest detection priority index is detected first, including: The detection priority indexes of the encrypted traffic corresponding to all encryption types are sorted in descending order. The larger the detection priority index, the greater the abnormality of the network traffic encrypted by the corresponding encryption type, and the higher the detection priority. When the detection of the encrypted traffic corresponding to each encryption type is completed, the detection of the encrypted traffic corresponding to the next encryption type will begin.

Images