Behavior anomaly analysis method based on network port monitoring

Abstract

The invention discloses a behavior anomaly analysis method based on network port monitoring, and the method comprises the following steps: executing trend prediction based on traffic data in a recent period, and obtaining traffic trend prediction data; obtaining traffic historical prediction data based on the same historical time sequence traffic data; acquiring flow characteristic data based on the historical alarm set; matching the real-time traffic data with the traffic trend prediction data to obtain a first matching result; matching the real-time traffic data with the traffic historical prediction data to obtain a second matching result; matching the real-time traffic data with the traffic feature data to obtain a third matching result; and outputting a traffic anomaly judgment result based on the first matching result, the second matching result and the third matching result, and outputting a behavior anomaly analysis result of the network port according to the traffic anomaly judgment result. The method has the beneficial effects that the analysis efficiency is ensured while the accuracy is improved, dependence on an intrusion database is not needed, and the applicability is high.

Description

Technical Field

[0001] The present application relates to the technical field of network port anomaly analysis, and in particular to a behavior anomaly analysis method based on network port monitoring. Background Art

[0002] Existing network intrusion monitoring systems mostly collect network data packet information and compare it with known information in the network intrusion feature library to discover behaviors that violate security policies.

[0003] First, this technology needs to obtain the network data packets of the monitoring equipment, and there is a risk of data leakage from the security system; secondly, this technology identifies by comparing with the network intrusion feature library, and the network intrusion feature library can never identify unknown risks. It will be impossible to defend against network intrusions that have not been discovered and intrusion features that have not been updated to this system; finally, in view of the scattered and wide distribution of intranet services, the intrusion monitoring system is intelligently deployed before the service for key protection, and the cost is high.

[0004] The Chinese patent "A method and system for detecting abnormal traffic on a network port", publication number: CN108494746A, publication date: September 4, 2018, specifically discloses 1) reading the communication session log traffic in the target data platform and grouping and summarizing it according to the source port number and the destination port number, and then counting the traffic indicator data of each port to form a traffic sequence of the corresponding port; 2) constructing the input vector of the port according to the traffic sequence of each port, inputting the input vector into the LSTM network to obtain the traffic prediction value of the port at time t; comparing the traffic prediction value of the port at time t with the observed value; if the deviation between the two is greater than the set condition, determining that the traffic of the port is abnormal; 3) qualitatively characterizing the traffic anomaly of the port according to all recent traffic logs of the port and preset rules, and determining the traffic anomaly event of the port; if it cannot be determined, inputting the extracted traffic log into the trained machine learning model to classify the traffic anomaly of the port and identify the traffic anomaly event of the port. This solution uses all recent traffic to predict traffic. It is not very targeted when network traffic fluctuations are easily affected by time usage, and the accuracy of the predicted value is easily affected by other irrelevant traffic data.

[0005] The Chinese patent "A method for detecting and analyzing abnormal traffic", publication number: CN116405274A, publication date: July 7, 2023, specifically discloses the following steps: obtaining the number of historical abnormal traffic records for all ports within a preset period of time, determining the port to be detected based on the number of historical abnormal traffic records; obtaining the historical traffic records and current traffic records of the port to be detected, and performing baseline analysis to obtain the baseline value and baseline threshold of the traffic; judging whether there is a traffic anomaly based on the baseline threshold, if there is a traffic anomaly, obtaining the NetFlow record of the corresponding abnormal period, and finding the host that generates the abnormal traffic. Although this solution uses the baseline value and baseline threshold of the traffic to determine whether there is a traffic anomaly, thereby finding the corresponding host and port, multiple calculations based on time granularity and the construction of the state space obviously increase the computational complexity while improving the judgment accuracy, and reduce the efficiency of abnormal analysis, and is not suitable for application scenarios where network abnormalities require timely reminders. Summary of the invention

[0006] In view of the problem that the network port traffic anomaly monitoring in the prior art cannot balance accuracy and efficiency, the present application provides a behavior anomaly analysis method based on network port monitoring. By matching traffic trend prediction data, traffic history prediction data and traffic feature data with real-time traffic data, it is determined whether the real-time traffic data is abnormal in three cases. Although the number of judgments is increased, the judgment comparison data is reduced, and the analysis efficiency can still be ensured. The accuracy is improved while the analysis efficiency is ensured. There is no need to rely on an intrusion database, and the application is strong.

[0007] To achieve the above technical purpose, the present application provides a technical solution, which is a behavior anomaly analysis method based on network port monitoring, comprising the following steps: performing trend prediction based on recent period traffic data to obtain traffic trend prediction data; obtaining traffic history prediction data based on historical same time series traffic data; obtaining traffic feature data based on historical alarm sets; matching real-time traffic data and traffic trend prediction data to obtain a first matching result; matching real-time traffic data and traffic history prediction data to obtain a second matching result; matching real-time traffic data and traffic feature data to obtain a third matching result; outputting traffic anomaly judgment results based on the first matching result, the second matching result and the third matching result, and outputting the behavior anomaly analysis results of the network port according to the traffic anomaly judgment results. Whether the current traffic is normal is judged by whether the real-time traffic data matches the recent period traffic trend, whether it matches the historical traffic data at the same time point, and whether the characteristics of the real-time traffic data meet the normal traffic characteristics, so that there is no need to read the network data packet, avoid the risk of transmission data leakage, and do not depend on whether the network intrusion feature library stores the corresponding abnormal situation, so as to improve the accuracy of the analysis of network intrusion anomalies, and take into account efficiency and applicability.

[0008] Furthermore, performing trend prediction based on recent time period traffic data and obtaining traffic trend prediction data includes: obtaining recent time period traffic data based on a preset time period, and obtaining traffic trend prediction data according to an interpolation method and recent time period traffic data.

[0009] Furthermore, matching the real-time traffic data and the traffic trend prediction data to obtain the first matching result includes: obtaining real-time traffic data; determining whether the difference between the real-time traffic data and the traffic trend prediction data is less than a difference threshold; or, determining whether the difference between the real-time traffic data and the traffic trend prediction reference value is less than a difference threshold; or, determining whether the real-time traffic data falls within the traffic trend prediction reference range; and using the determination result as the first matching result.

[0010] Furthermore, the method of obtaining traffic history prediction data based on historical same time series traffic data includes: obtaining the traffic data of the same time series corresponding to the current moment as the historical same time series traffic data; and obtaining traffic history prediction data based on the normal distribution of the historical same time series traffic data.

[0011] Furthermore, obtaining historical traffic prediction data based on historical identical time series traffic data also includes: taking the historical time point corresponding to the current time point as a reference time point; obtaining historical identical time series traffic data based on the reference time point and a preset window size; and obtaining historical traffic prediction data based on a normal distribution using historical identical time series traffic data.

[0012] Furthermore, matching the real-time traffic data and the traffic characteristic data to obtain the third matching result includes: obtaining the real-time traffic data and extracting the characteristics of the real-time traffic data; judging whether the characteristics of the real-time traffic data are consistent with the traffic characteristic data, and using the judgment result as the third matching result.

[0013] Further, outputting the traffic anomaly judgment result based on the first matching result, the second matching result and the third matching result includes: when any matching result among the first matching result, the second matching result and the third matching result is abnormal, the traffic anomaly judgment result is that an abnormality exists.

[0014] Furthermore, the acquiring of flow characteristic data based on the historical alarm set includes: acquiring alarm flow data that is normal after alarm screening in the historical alarm set, and extracting characteristics of the alarm flow data to obtain flow characteristic data.

[0015] Furthermore, the acquisition of traffic characteristic data based on the historical alarm set also includes: judging whether data cleaning needs to be performed based on the efficiency threshold and the traffic characteristic data; and when performing data cleaning, filtering out features in the traffic characteristic data based on the weight of the influencing factor.

[0016] Furthermore, filtering out features in the traffic feature data based on the influencing factor weights includes: obtaining the influencing factor and the influencing factor weight corresponding to the feature, performing weighted summation based on the influencing factor weights of each feature, and filtering out the feature with the smallest sum value until the determination efficiency threshold is met.

[0017] The beneficial effects of this application are: by only monitoring the flow value to identify the network anomaly monitoring corresponding to the port, the possibility of data leakage is reduced, the scope of network abnormal behavior monitoring is expanded, and the deployment cost of network abnormal behavior monitoring is reduced. At the same time, it solves the problem that the original network threat monitoring relies on the feature library, especially in special scenarios, such as the intranet environment, which has high requirements for the timeliness and convenience of feature library updates. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flow chart of a behavior anomaly analysis method based on network port monitoring in this application.

[0019] Figure 2 This is a normal distribution diagram of a behavior anomaly analysis method based on network port monitoring in this application. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solutions and advantages of the present application more clear, the present application is further described in detail below in conjunction with the drawings and examples. It should be understood that the specific implementation method described here is only an optimal embodiment of the present application, which is only used to explain the present application and does not limit the scope of protection of the present application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0021] like Figure 1 As shown, a behavior anomaly analysis method based on network port monitoring includes the following steps: Perform trend prediction based on recent time period traffic data to obtain traffic trend prediction data; Obtain historical traffic forecast data based on historical traffic data of the same time series; Obtain traffic characteristic data based on historical alarm collection; Matching the real-time traffic data and the traffic trend forecast data to obtain a first matching result; Matching the real-time traffic data and the historical traffic prediction data to obtain a second matching result; Matching the real-time traffic data and the traffic characteristic data to obtain a third matching result; A flow anomaly determination result is output based on the first matching result, the second matching result, and the third matching result, and a behavior anomaly analysis result of the network port is output according to the flow anomaly determination result.

[0022] In this embodiment, whether the current traffic is normal is judged by whether the real-time traffic data matches the traffic trend of the recent period, whether it matches the traffic data at the same time point in history, and whether the characteristics of the real-time traffic data conform to the normal traffic characteristics. Therefore, there is no need to read the network data packets, avoiding the risk of transmission data leakage, and it does not depend on whether the network intrusion feature library stores the corresponding abnormal conditions. The accuracy of the analysis of network intrusion anomalies is improved, and both efficiency and applicability are taken into account.

[0023] Specifically, the recent time period traffic data is the traffic data of the preset time period before the current time point. Since network traffic is affected by many factors (such as user behavior, holidays, special events, etc.), these factors may change significantly in different time periods. The recent time period traffic data can show the traffic trend of the network port when it is used recently, and these changes can be captured more accurately, avoiding the impact of no longer applicable or less influential information on trend prediction, and improving the accuracy of the prediction results. Compared with using all historical traffic data for trend prediction, the recent time period traffic data processes a smaller amount of data, which can more accurately capture short-term network traffic fluctuations while improving the efficiency of trend prediction. For example, network traffic fluctuations caused by factors such as emergencies, special events or changes in user behavior make network traffic trends more targeted, more in line with actual conditions, and more accurate.

[0024] In the switch network port application, you can obtain the switch read permission (including but not limited to through the telnet protocol, snmp protocol, etc.) to read the real-time flow value of the switch port (the switch flow value is divided into two values, input and output, similar to the water meter and electricity meter values ​​that gradually increase) to obtain real-time flow data.

[0025] Perform trend forecast based on recent period traffic data, and obtain traffic trend forecast data including: Based on the preset time period, recent period traffic data is obtained, and traffic trend forecast data is obtained based on the interpolation method and recent period traffic data.

[0026] Interpolation is also called "interpolation". It uses the function values ​​of the function f(x) at several known points in a certain interval to make an appropriate specific function, and uses the value of this specific function as the approximate value of the function f(x) at other points in the interval. The preset time period can be set based on usage, such as the past week or the past 24 hours as the preset time period. The traffic trend forecast data obtained based on the interpolation method and the recent time period traffic data includes: Select the flow value in the recent period flow data as the data point according to the preset data interval; Construct trend functions with data points; Obtain traffic trend forecast data using trend function and current time point.

[0027] The preset data interval is the preset time interval for selecting data points. For example, if the past 24 hours is used as the preset time period and the preset data interval is 1 hour, the data points are the traffic values ​​of the port every hour in the past 24 hours. This is used to construct a trend function to obtain the traffic trend forecast data at the current time point. The forecast value at the current time point is obtained by directly constructing a trend function based on the interpolation method, which ensures accuracy while improving efficiency.

[0028] In this embodiment, the interpolation method is Newton interpolation method. Newton interpolation method introduces the concept of difference quotient, takes N data points, that is, before the current time point t, takes the flow values ​​of N moments as data points, and then uses Newton interpolation method to calculate the trend value of the current time point t as the flow trend prediction data.

[0029] Matching real-time traffic data and traffic trend forecast data, obtaining the first matching result includes: Real-time traffic data is obtained, and it is determined whether the difference between the real-time traffic data and the traffic trend prediction data is less than a first difference threshold, and the determination result is used as a first matching result.

[0030] The difference value between the real-time traffic data and the traffic trend prediction data is calculated. If the difference value is less than the first difference threshold, it is considered that the real-time traffic data conforms to the normal traffic trend. If the difference value is greater than or equal to the first difference threshold, it is considered that the real-time traffic data does not conform to the normal traffic trend, that is, there is an abnormality in the network port traffic. The judgment result is output as the first matching result, such as match or mismatch, less than or greater than or equal to, yes or no, abnormal or normal, etc.

[0031] In some other embodiments, obtaining traffic trend prediction data based on the interpolation method and recent time period traffic data also includes: Set a number of preset data intervals; Selecting flow values ​​in the recent time period flow data as data points according to each preset data interval; Construct trend functions corresponding to each preset data interval with data points; Output the traffic trend forecast value of the corresponding trend function based on each trend function and the current time point; All traffic trend prediction values ​​are used as traffic trend prediction data.

[0032] In this case, there are multiple preset data intervals, and data points are selected corresponding to the preset data intervals to construct trend functions corresponding to the preset data intervals, and the traffic trend prediction value corresponding to each trend function is obtained, thereby avoiding the neglect of short-term fluctuations or the error influence of occasional fluctuations, and achieving higher accuracy.

[0033] When the traffic trend prediction data includes several traffic trend prediction values, the traffic trend prediction reference value can be obtained based on the weighted average, such as assigning a higher weight to smaller intervals. Alternatively, the traffic trend prediction reference range can be obtained based on all traffic trend prediction values. In this case, matching the real-time traffic data and the traffic trend prediction data, obtaining the first matching result includes: Acquire real-time traffic data, determine whether the difference between the real-time traffic data and the traffic trend prediction reference value is less than a first difference threshold, and use the determination result as a first matching result; or, Acquire real-time traffic data, determine whether the real-time traffic data falls within a traffic trend prediction reference range, and use the determination result as the first matching result.

[0034] By obtaining the traffic trend prediction reference range through all traffic trend prediction values, it is determined whether the real-time traffic data is normal. The threshold range can be adaptively changed according to the actual fluctuation of the network, avoiding the adaptation error caused by the fixed threshold, and further improving the accuracy of abnormal analysis. At this time, if the difference between the real-time traffic data and the traffic trend prediction reference value is greater than or equal to the first difference threshold or the real-time traffic data does not fall into the traffic trend prediction reference range, it is considered that the real-time traffic data does not conform to the normal traffic trend, that is, the network port traffic is abnormal, and the judgment result is output as the first matching result, such as match or mismatch, less than or greater than or equal to, yes or no, abnormal or normal, etc.

[0035] Obtaining historical traffic forecast data based on historical traffic data of the same time series includes: Obtain the historical time series traffic data corresponding to the current time point as the historical same time series traffic data; The historical traffic forecast data is obtained based on the normal distribution using the historical time series traffic data.

[0036] Normal distribution, also known as "normal distribution" or Gaussian distribution, is a continuous probability distribution whose shape is determined by the mean (μ) and standard deviation (σ). By using the mean and standard deviation of historical traffic data of the same time series, the distribution characteristics of the traffic in the same period of history are obtained, and then this distribution characteristic is used to estimate the possible range or probability distribution of future traffic data. When using normal distribution for prediction, more attention is paid to the trend of mainstream data, thereby reducing the interference of outliers on traffic prediction data, and improving prediction accuracy while improving prediction efficiency.

[0037] In this embodiment, obtaining historical traffic prediction data based on historical same time series traffic data also includes: The historical time point corresponding to the current time point is used as the reference time point; Obtain historical traffic data of the same time series based on the benchmark time point and the preset window size; The historical traffic forecast data is obtained based on the normal distribution using the historical time series traffic data.

[0038] The preset window size is the preset number of data points selected from the reference time point to both sides. The historical time point corresponding to the current time point is used as the reference time point, and the data points of the preset window size in the past and future directions of the reference time point are selected as the historical traffic data of the same time series. Through the local window extraction of time series data, the traffic changes at the corresponding historical time points are revealed, thereby improving the accuracy of historical traffic prediction data.

[0039] like Figure 2 As shown, n flow values ​​are selected in both the past and future directions using the reference time point, including the flow value corresponding to this reference time point, for a total of 2n+1 flow values. Then, the midpoint and the 2n+1 flow values ​​on both sides are obtained using the normal distribution curve. These are given corresponding weights or proportions according to the positions of the flow values ​​on the normal distribution curve to obtain the historical flow forecast data.

[0040] In this embodiment, a total of M historical time points are taken as reference time points, and the 2n+1 values ​​of the normal distribution of each reference time point are evenly divided into 2n+1 values ​​in -3δ--3δ, and the M reference time points are taken from far to near, and the M values ​​of the normal distribution are evenly divided into M values ​​in -3δ--0. Then, the corresponding historical traffic values ​​are weighted and summed by the proportion of M values ​​and the proportion of 2n+1 to obtain the historical traffic prediction data at the current time point. This reduces the amount of calculation while ensuring the accuracy of the calculation.

[0041] Matching the real-time traffic data and the historical traffic prediction data to obtain the second matching result includes: Real-time traffic data is obtained, and it is determined whether the difference between the real-time traffic data and the historical traffic prediction data is less than a second difference threshold, and the determination result is used as the second matching result.

[0042] In this embodiment, by judging whether the real-time traffic data is within the range of historical prediction values ​​at that time point, targeted prediction comparison is performed at a specific time point to avoid errors in long-term prediction caused by specific influencing factors at that time point, improve prediction accuracy, and thus improve the accuracy of anomaly analysis.

[0043] The traffic characteristic data obtained based on the historical alarm set includes: Acquire alarm traffic data in the historical alarm set, extract features of the alarm traffic data to obtain traffic feature data.

[0044] Matching the real-time traffic data and the traffic characteristic data to obtain the third matching result includes: Acquire real-time traffic data and extract features of the real-time traffic data; It is determined whether the characteristics of the real-time traffic data are consistent with the traffic characteristic data, and the determination result is used as the third matching result.

[0045] Through traffic feature matching, we can determine whether the characteristics of real-time traffic data match the traffic characteristics that need to be alarmed, and then determine whether the current traffic situation needs an alarm, so as to avoid the situation where the traffic trend is normal but the traffic exceeds the standard or the abnormal value is ignored, and further improve the accuracy of abnormal analysis.

[0046] Outputting the traffic anomaly judgment result based on the first matching result, the second matching result, and the third matching result includes: when any matching result among the first matching result, the second matching result, and the third matching result is abnormal, the traffic anomaly judgment result is that an abnormality exists.

[0047] At this time, when the difference between the real-time traffic data and the traffic trend prediction data is greater than or equal to the first difference threshold, the first matching result is abnormal; when the difference between the real-time traffic data and the traffic history prediction data is greater than or equal to the second difference threshold, the second matching result is abnormal; when the characteristics of the real-time traffic data are consistent with the traffic characteristic data, the third matching result is abnormal.

[0048] As a second embodiment of the present application, obtaining traffic characteristic data based on a historical alarm set includes: Obtain the alarm traffic data that is normal after alarm troubleshooting in the historical alarm collection, and extract the features of the alarm traffic data to obtain traffic feature data.

[0049] In this embodiment, feature extraction is performed on the alarm traffic data that is manually checked as normal in the historical alarm set to obtain traffic feature data. At this time, matching the real-time traffic data and the traffic feature data to obtain the third matching result includes: Acquire real-time traffic data and extract features of the real-time traffic data; When the characteristics of the real-time traffic data match the traffic characteristic data, outputting normal as the third matching result; When the characteristics of the real-time traffic data do not match the traffic characteristic data, an exception is output as the third matching result.

[0050] In this embodiment, outputting a traffic anomaly judgment result based on the first matching result, the second matching result, and the third matching result includes: When the third matching result is normal, the traffic anomaly judgment result is normal.

[0051] If the real-time traffic data does not match the traffic trend forecast data and the traffic historical forecast data, determine whether its characteristic curve matches the characteristic curve of any alarm traffic data that is normal in the historical alarm set, so as to avoid the traffic value that has been manually judged as normal from being identified as abnormal, and further improve the accuracy of abnormal analysis. The feature is the traffic curve for the period of time T before the current time point. For each port, there is a feature set of alarm traffic data that is normal in the alarm check. If the feature curve can find the corresponding feature curve in the feature set to match it, then the judgment will also be considered normal.

[0052] In this embodiment, acquiring traffic characteristic data based on the historical alarm set further includes: Determine whether data cleaning needs to be performed based on the efficiency threshold and traffic characteristic data; When performing data cleaning, features in the traffic feature data are screened out based on the impact factor weights.

[0053] Judging whether data cleaning needs to be performed based on the efficiency threshold and traffic characteristic data includes: When the feature matching efficiency between the traffic feature data and the real-time traffic data is lower than the determination efficiency threshold, it is considered that data cleaning needs to be performed; When the feature matching efficiency between the traffic feature data and the real-time traffic data is higher than or equal to the determination efficiency threshold, it is considered that data cleaning does not need to be performed.

[0054] When the number of features in the traffic feature data reaches a value that affects the judgment efficiency (the time used for matching judgment will increase as the number of features increases), the features in the traffic feature data will be cleaned up. The judgment efficiency threshold can be a judgment execution time threshold or a judgment call data volume threshold.

[0055] The features in the traffic feature data that are screened out based on the weight of the impact factor include: Obtain the impact factor and impact factor weight corresponding to the feature, perform weighted sum based on the impact factor weight of each feature, and filter out the feature with the smallest sum value until the determination efficiency threshold is met.

[0056] In this embodiment, the influencing factors include hit count and recent hit time attributes. When performing data cleaning, features that do not have hit count and recent hit time are screened out, thereby improving the accuracy of features and further improving the accuracy of abnormal analysis.

[0057] Matching the real-time traffic data and the traffic characteristic data, obtaining the third matching result also includes: Obtain the characteristic curve of real-time traffic data, and match the characteristic curve of real-time traffic data with the characteristic curve of traffic characteristic data. If the traffic difference is less than the third difference threshold and the difference in the slopes of the traffic values ​​at adjacent moments is less than the fourth difference slope, it is considered that the real-time traffic data and the traffic characteristic data match, and the third matching result is output as normal.

[0058] The flow rates at each moment in the two characteristic curves are compared. When the difference is less than or equal to the preset flow difference, i.e., the third difference threshold, and the slope difference of the flow values ​​at each two adjacent moments is less than or equal to the preset slope difference, i.e., the fourth difference threshold, the match is judged to be successful, otherwise the match fails.

[0059] In this application, by only monitoring the traffic value to identify the network anomaly monitoring corresponding to the port, the possibility of data leakage is reduced, the scope of network abnormal behavior monitoring is expanded, and the deployment cost of network abnormal behavior monitoring is reduced. At the same time, it solves the problem that the original network threat monitoring relies on the feature library, especially in special scenarios, such as the intranet environment, which has high requirements for the timeliness and convenience of feature library updates.

[0060] It is understandable that the present application can be implemented in switches, routers and other devices that can provide port traffic data, and even terminals can provide traffic plug-ins to monitor terminal network behavior.

[0061] In this application, a behavior anomaly analysis method based on network port monitoring also includes: Matching the real-time traffic data and the traffic trend forecast data to obtain a first matching result; When the first matching result is abnormal, execute: Matching the real-time traffic data and the historical traffic prediction data to obtain a second matching result; When the second matching result is abnormal, execute: The real-time traffic data and the traffic characteristic data are matched to obtain a third matching result.

[0062] This makes it suitable for application scenarios with different efficiency and accuracy requirements.

[0063] The specific implementation described above is a preferred implementation of a behavioral anomaly analysis method based on network port monitoring in the present application, and is not intended to limit the specific implementation scope of the present application. The scope of the present application includes but is not limited to the specific implementation embodiment. All equivalent changes made in accordance with the shape and structure of the present application are within the protection scope of the present application.

Claims

1. A behavior anomaly analysis method based on network port monitoring, characterized in that: The steps include: Perform trend prediction based on recent time period traffic data to obtain traffic trend prediction data; Obtain historical traffic forecast data based on historical traffic data of the same time series; Obtain traffic characteristic data based on historical alarm collection; Matching the real-time traffic data and the traffic trend forecast data to obtain a first matching result; Matching the real-time traffic data and the historical traffic prediction data to obtain a second matching result; Matching the real-time traffic data and the traffic characteristic data to obtain a third matching result; A flow anomaly determination result is output based on the first matching result, the second matching result, and the third matching result, and a behavior anomaly analysis result of the network port is output according to the flow anomaly determination result.

2. A behavior anomaly analysis method based on network port monitoring as claimed in claim 1, characterized in that: The performing trend prediction based on the recent period traffic data and obtaining the traffic trend prediction data comprises: Based on the preset time period, recent period traffic data is obtained, and traffic trend forecast data is obtained based on the interpolation method and recent period traffic data.

3. A behavior anomaly analysis method based on network port monitoring as claimed in claim 2, characterized in that: The matching of the real-time traffic data and the traffic trend prediction data to obtain the first matching result includes: Get real-time traffic data; Determine whether the difference between the real-time traffic data and the traffic trend forecast data is less than a difference threshold; or, Determine whether the difference between the real-time traffic data and the traffic trend prediction reference value is less than a difference threshold; or, Determine whether the real-time traffic data falls within the reference range of traffic trend prediction; The judgment result is taken as the first matching result.

4. The behavior anomaly analysis method based on network port monitoring according to claim 1, characterized in that: The method of obtaining historical traffic prediction data based on historical same time series traffic data includes: Obtain the historical flow data of the same time series corresponding to the current moment as the historical flow data of the same time series; The historical traffic forecast data is obtained based on the normal distribution using the historical time series traffic data.

5. The behavior anomaly analysis method based on network port monitoring according to claim 1, characterized in that: Acquiring historical traffic forecast data based on historical traffic data of the same time series also includes: The historical time point corresponding to the current time point is used as the reference time point; Obtain historical traffic data of the same time series based on the benchmark time point and the preset window size; The historical traffic forecast data is obtained based on the normal distribution using the historical time series traffic data.

6. The behavior anomaly analysis method based on network port monitoring according to claim 1, characterized in that: The matching of the real-time traffic data and the traffic characteristic data to obtain a third matching result includes: Acquire real-time traffic data and extract features of the real-time traffic data; It is determined whether the characteristics of the real-time traffic data are consistent with the traffic characteristic data, and the determination result is used as the third matching result.

7. A behavior anomaly analysis method based on network port monitoring according to any one of claims 3 or 6, characterized in that: The outputting of the traffic anomaly judgment result based on the first matching result, the second matching result and the third matching result includes: When any of the first matching result, the second matching result and the third matching result is abnormal, the traffic abnormality judgment result is that an abnormality exists.

8. The behavior anomaly analysis method based on network port monitoring according to claim 1, characterized in that: The acquiring of traffic characteristic data based on the historical alarm set includes: Obtain the alarm traffic data that is normal after alarm troubleshooting in the historical alarm collection, and extract the features of the alarm traffic data to obtain traffic feature data.

9. The behavior anomaly analysis method based on network port monitoring according to claim 8, characterized in that: The acquiring of traffic characteristic data based on the historical alarm set further includes: Determine whether data cleaning needs to be performed based on the efficiency threshold and traffic characteristic data; When performing data cleaning, features in the traffic feature data are screened out based on the impact factor weights.

10. The behavior anomaly analysis method based on network port monitoring according to claim 8, characterized in that: The features in the traffic feature data that are screened out based on the weight of the impact factor include: Obtain the impact factor and impact factor weight corresponding to the feature, perform weighted sum based on the impact factor weight of each feature, and filter out the feature with the smallest sum value until the determination efficiency threshold is met.

Images