Method and system for identifying and blocking malicious traffic in real time

Abstract

The invention discloses a real-time malicious traffic identifying and blocking method and system, and relates to the technical field of data processing. The method comprises the following steps: acquiring a to-be-identified network data stream, and determining packet header information of the to-be-identified network data stream; mapping the to-be-identified network data flow into a plurality of virtual data flows based on a source address and a destination address in the packet header information; for each virtual data stream, based on the number and the size of data packets of the virtual data stream, distributing the virtual data stream to a corresponding processing unit, and carrying out traffic processing to obtain a network topology change feature of the virtual data stream; determining flow characteristic parameters of the virtual data flow according to the network topology change characteristics, and constructing a flow characteristic vector based on the flow characteristic parameters; and performing anomaly identification on each traffic feature vector, determining abnormal traffic in each virtual data stream, and performing interception operation on the abnormal traffic. By implementing the technical scheme provided by the invention, the effect of improving the efficiency of identifying and blocking the malicious traffic in real time is achieved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, system, electronic device and storage medium for real-time identification and blocking of malicious traffic. Background Art

[0002] With the development of the digital age, network security has become an important area for maintaining information security and ensuring stable network operation. The large and complex data flow in the network makes it a challenge to identify and block malicious traffic. As network attack methods become increasingly diverse and complex, how to effectively detect and handle these malicious traffic is particularly critical.

[0003] At present, existing methods for real-time identification and blocking of malicious traffic usually adopt a unified identification standard to identify the data traffic as a whole and block the identified malicious traffic. However, in actual applications, when the data traffic to be identified is large, only a unified identification standard is used to identify the data traffic as a whole. It is often easy to overlook subtle anomalies in data traffic, which requires a lot of identification time, resulting in untimely identification of malicious traffic, which leads to low efficiency in real-time identification and blocking of malicious traffic. Summary of the invention

[0004] The present application provides a method and system for real-time identification and blocking of malicious traffic, which has the effect of improving the efficiency of real-time identification and blocking of malicious traffic.

[0005] In a first aspect, the present application provides a method for real-time identification and blocking of malicious traffic, comprising: Acquire a network data stream to be identified, and determine packet header information of the network data stream to be identified; Based on the source address and the destination address in the packet header information, mapping the network data flow to be identified into multiple virtual data flows; For each of the virtual data flows, based on the number and size of packets of the virtual data flow, the virtual data flow is allocated to a corresponding processing unit for parallel flow processing to obtain network topology change characteristics of the virtual data flow; Determine the flow characteristic parameters corresponding to the virtual data flow according to the network topology change characteristics, and construct the flow characteristic vector corresponding to the virtual data flow based on the flow characteristic parameters; Anomalies are identified on each of the traffic feature vectors, abnormal traffic in each of the virtual data flows is determined, and an interception operation is performed on the abnormal traffic.

[0006] In a second aspect of the present application, a system for real-time identification and blocking of malicious traffic is provided, the system comprising: An information acquisition module, used to acquire a network data stream to be identified and determine the packet header information of the network data stream to be identified; A data flow determination module, used for mapping the network data flow to be identified into multiple virtual data flows based on the source address and the destination address in the packet header information; A feature determination module, for allocating each virtual data flow to a corresponding processing unit for parallel flow processing based on the number and size of packets of the virtual data flow, so as to obtain a network topology change feature of the virtual data flow; The traffic identification module is used to determine the traffic characteristic parameters corresponding to the virtual data flow according to the network topology change characteristics, and construct the traffic characteristic vector corresponding to the virtual data flow based on the traffic characteristic parameters; perform anomaly identification on each of the traffic characteristic vectors, determine the abnormal traffic in each of the virtual data flows, and intercept the abnormal traffic.

[0007] In a third aspect of the present application, an electronic device is provided, comprising a memory, a processor, and a program stored in the memory and executable on the processor, wherein the program can implement a method for real-time identification and blocking of malicious traffic when loaded and executed by the processor.

[0008] In a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements a method for real-time identification and blocking of malicious traffic.

[0009] In summary, one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: By adopting the above technical solution, the network data flow to be identified is obtained and its packet header information is extracted. The data flow is mapped into multiple virtual data flows based on the source address and destination address, and fine-grained data flow splitting is achieved. For each virtual data flow, it is assigned to the corresponding processing unit for parallel traffic processing according to the number and size of its data packets, which effectively improves the processing efficiency and ensures that it can still respond quickly in a high-traffic environment. In addition, by extracting the network topology change characteristics of the virtual data flow, determining the traffic characteristic parameters based on these characteristics, and constructing the traffic characteristic vector, the method can conduct in-depth analysis of the traffic from multiple dimensions and significantly improve the accuracy of identifying abnormal traffic. Finally, by performing abnormal identification on the traffic characteristic vector, malicious traffic can be accurately detected and intercepted to ensure real-time protection of network security. Overall, through the mapping and parallel processing analysis of virtual data flows, efficient and accurate malicious traffic identification and blocking are achieved, resource utilization efficiency is optimized, and the problem of low identification efficiency in a high-traffic environment is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is a flow chart of a method for real-time identification and blocking of malicious traffic provided by an embodiment of the present application; Figure 2 It is a structural diagram of a malicious traffic real-time identification and blocking system provided in an embodiment of the present application; Figure 3 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0011] Description of reference numerals: 300, electronic device; 301, processor; 302, communication bus; 303, user interface; 304, network interface; 305, memory. DETAILED DESCRIPTION

[0012] In order to enable technicians in this field to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0013] In the description of the embodiments of the present application, words such as "for example" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "for example" or "for example" is intended to present related concepts in a specific way.

[0014] In the description of the embodiments of the present application, the meaning of the term "multiple" refers to two or more. For example, multiple systems refer to two or more systems, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0015] The present application embodiment provides a method for real-time identification and blocking of malicious traffic. In one embodiment, please refer to Figure 1 , Figure 1This is a flow chart of a method for real-time identification and blocking of malicious traffic provided by an embodiment of the present application. The method can be implemented by a computer program, which can be integrated into an application or run as an independent tool application. The method can also be implemented by a single-chip microcomputer or run in a malicious traffic real-time identification and blocking system based on a von Neumann system. Specifically, the method can include the following steps: Step 101: Acquire a network data flow to be identified, and determine the packet header information of the network data flow to be identified.

[0016] The network data flow to be identified refers to a collection of data packets transmitted in the network environment that need to be identified as malicious traffic. These data packets can come from different network nodes and contain communication data of various network protocol types, such as TCP, UDP, ICMP and other protocol packets. Each data packet carries the corresponding header information and data payload, forming a complete network communication content.

[0017] The packet header information refers to the control information and metadata contained in the network data packet. It is located at the front end of the data packet and contains the key information required for data packet transmission and processing. This information mainly includes fields such as source address (identifying the sender of the data packet), destination address (identifying the receiver of the data packet), protocol type (indicating the network protocol used by the data packet), port number (identifying the specific network service), and sequence number (used for data packet sorting and reassembly).

[0018] Specifically, it is necessary to first obtain the network data stream to be identified from the network through the data stream acquisition module. The network data stream contains a large number of data packets, and each data packet has its corresponding header information. The header information is an important part of the data packet, which contains key information such as the source address, destination address, protocol type, port number, etc. of the data packet. This information is of great significance for the subsequent identification of the nature and characteristics of the data stream. After obtaining the network data stream, the system will parse each data packet in the data stream and extract the header information. Specifically, the system disassembles the data packet through the network protocol analyzer and separates the header information from the data packet. The extraction process of the header information adopts the standard network protocol specification to ensure that the extracted information is accurate and complete. Since different types of network protocols have different header formats, the system will select the corresponding parsing method according to the protocol type to accurately extract each field in the header information. The process of obtaining the header information actually lays the foundation for the subsequent virtual data stream mapping. By analyzing the source address and destination address in the header information, the system can understand the source and destination of the data packet, which is of great significance for identifying potential malicious traffic. For example, some malicious traffic may come from a specific IP address segment or have specific destination address characteristics. By extracting and analyzing this address information, the system can preliminarily determine the suspiciousness of the data flow, providing a data basis for subsequent virtual data flow mapping.

[0019] Step 102: Based on the source address and the destination address in the packet header information, the network data flow to be identified is mapped into multiple virtual data flows.

[0020] The source address refers to the network address information that identifies the sender in the network data packet, usually in the form of an IP address. This address can be in IPv4 format or IPv6 format, and is used to uniquely identify the device or node that sends the data packet in the network. The source address can be understood as the starting point identifier of the data packet, which records the starting position information of the data packet in the network. In the process of network communication, the source address, as an important attribute of the data packet, indicates the source of the data stream.

[0021] The destination address refers to the network address information that identifies the recipient in a network data packet, and is also expressed in the form of an IP address. This address is similar to the source address and can be in IPv4 or IPv6 format. It is used to uniquely identify the device or node in the network where the data packet is expected to arrive. The destination address is the routing basis during the data packet transmission process to ensure that the data packet can correctly reach the intended recipient.

[0022] A virtual data flow refers to a logical data flow set consisting of data packets with similar network attributes after mapping the source address and destination address of the identified network data flow. Each virtual data flow contains data packets from the same network area or with the same transmission target. These data packets have certain correlations in the source address or destination address, and together constitute an independent data processing unit.

[0023] Specifically, first, the network address segment corresponding to the source address and destination address in the packet header information is obtained. The system maintains a network address segment mapping table, which contains the address segment division information of different network areas. By querying the mapping table, the system can determine the network address segment to which the source address and destination address of each data packet belong. Then, the system generates unique address segment identifiers for different network address segments. These address segment identifiers are used to mark data flows in different network areas to ensure the accuracy of data flow classification. After generating the address segment identifiers, the system will classify and map the data packets in the network data flow to be identified. Specifically, the system checks the address segment identifiers corresponding to the source address and destination address of each data packet, and maps the data packets with the same address segment identifiers to the same virtual data flow. In this way, data packets from the same network area or with the same destination will be classified into the corresponding virtual data flow, forming multiple independent virtual data flows. This mapping mechanism realizes the classification processing of data flows by mapping a large number of data flows into multiple virtual data flows, reducing the calculation load of a single processing unit. Secondly, the address segment-based mapping method allows packets with similar network attributes to be classified into the same virtual data flow, making it easier for the system to identify abnormal traffic in a specific network area. For example, if an abnormal traffic pattern appears in a virtual data flow, the system can quickly locate the source network area of ​​the problem.

[0024] Based on the above embodiment, as an optional embodiment, in step 102: mapping the network data flow to be identified into multiple virtual data flows based on the source address and the destination address in the packet header information, this step may also include the following steps: Step 201: Acquire multiple network address segments corresponding to source addresses and destination addresses; generate address segment identifiers corresponding to each network address segment.

[0025] Among them, a network address segment refers to a set of IP addresses with continuity and similar network attributes, usually described in CIDR (Classless Inter-Domain Routing) notation, such as "192.168.1.0 / 24" represents 256 consecutive IP addresses from "192.168.1.0" to "192.168.1.255". A network address segment contains basic information such as the start address, end address, and subnet mask, and is used to define the address range within a specific network area. A network address segment can be understood as a logical partition unit of network space. Each network address segment represents an independent area in the network, which may be physically isolated subnets or logically divided functional areas.

[0026] The address segment identifier refers to the unique identifier assigned by the system to each network address segment. It is a coded string containing network attribute information. This identifier is generated through specific coding rules and may contain network type prefix (such as "IB" for internal business network segment), area number, security level and other information, which is used to uniquely identify and distinguish different network address segments.

[0027] Specifically, the system first needs to obtain the network address segment information corresponding to the source address and the destination address. This process is completed by querying the pre-configured network address segment mapping table. The network address segment mapping table stores the address segment division information of different areas in the network, including the starting address, ending address, and subnet mask of the address segment. The system will search for matching address segment information in the mapping table based on the source address and destination address of the data packet. For example, for the IP address "192.168.1.100", the system may map it to the address segment "192.168.1.0 / 24". After determining the relevant network address segments, the system will generate a unique address segment identifier for each address segment. The generation of address segment identifiers uses specific encoding rules to ensure that there is no conflict between identifiers of different address segments. The encoding rules can take into account the network attributes of the address segment, such as the category of the address segment (intranet / extranet), the area to which it belongs (business area / management area), and other factors. For example, the system may assign an identifier beginning with "IB" to the address segment of the intranet business area, and an identifier beginning with "EV" to the address segment of the extranet access area, followed by a specific sequence number to form a complete address segment identifier. This address segment mapping and identifier generation mechanism lays the foundation for subsequent virtual data flow mapping and malicious traffic identification.

[0028] Step 202: Based on each address segment identifier, map the network data packets with the same address segment identifier in the network data flow to be identified into a virtual data flow to obtain multiple virtual data flows with different address segment identifiers.

[0029] Specifically, the system first extracts the source address and destination address of each data packet from the network data stream to be identified, and then queries the address segment identifiers corresponding to these addresses. For example, for a data packet from "192.168.1.100" and accessing "10.0.0.50", the system will determine the address segment identifier of the source address (such as "IB001_H") and the address segment identifier of the destination address (such as "IS002_H") respectively. Next, the system will maintain a mapping table to record the correspondence between different address segment identifiers and virtual data streams. When a new data packet is identified, the system will add it to the corresponding virtual data stream according to its address segment identifier, or create a new virtual data stream if necessary. The implementation effect of this mapping mechanism is significant. First, the system can automatically aggregate data packets with similar network attributes into virtual data streams, which is convenient for discovering the overall behavior pattern of data streams. Second, different virtual data streams can be processed in parallel, and each processing unit focuses on a specific type of data stream, which improves processing efficiency.

[0030] Step 103: for each virtual data flow, based on the number and size of packets of the virtual data flow, the virtual data flow is allocated to a corresponding processing unit for parallel traffic processing to obtain network topology change characteristics of the virtual data flow.

[0031] The number of packets refers to the total number of network packets contained in each virtual data flow, and the packet size refers to the total number of bytes of all packets in the virtual data flow. These two parameters together reflect the data volume and processing load characteristics of the virtual data flow. For example, a virtual data flow may contain 1,000 packets (number of packets) and a total of 10MB of data (packet size).

[0032] A processing unit refers to a functional module in the system that is responsible for performing virtual data flow analysis and feature extraction. Each processing unit has independent computing resources and processing capabilities, and can be a physically isolated processor core or a logically divided processing thread. Different processing units may have different processing capabilities and features. For example, a high-performance processing unit may be configured with more computing resources and cache space.

[0033] The network topology change characteristics refer to the dynamic changes in the network connection relationship and behavior pattern of the virtual data flow during the transmission process, including the establishment and disconnection of connections between nodes, the fluctuation of data transmission frequency, the change of communication mode and other timing characteristics. The network topology change characteristics can be understood as the behavioral fingerprint of the virtual data flow. It reflects the evolution of the transmission path and interaction mode of the data flow in the network, including the number of new connections, the duration of active connections, the change of data transmission rate and other characteristics.

[0034] Specifically, the characteristic parameters of each virtual data flow are first counted, including the total number of data packets and the cumulative data volume. For example, a virtual data flow may contain 1,000 data packets with a total data volume of 10MB. Based on these statistical information, the system adopts a weighted allocation algorithm to allocate virtual data flows with heavy processing loads to processing units with stronger processing capabilities, or divide large data flows into multiple sub-flows and allocate them to multiple processing units for collaborative processing. After receiving the allocated virtual data flow, the processing unit will analyze the timing relationship, transmission mode, connection status and other information of the data packets, build a network topology diagram of the virtual data flow, and record the connection relationship and data transmission characteristics between nodes. This parallel processing mechanism based on load balancing has significant effects. First, by reasonably allocating processing tasks, the overload of a single processing unit is avoided, and the overall processing efficiency of the system is improved. Secondly, each processing unit focuses on the analysis of a specific virtual data flow, which can more deeply explore the behavioral characteristics of the data flow and accurately record the dynamic changes of the network topology.

[0035] Based on the above embodiment, as an optional embodiment, in step 103: based on the number and size of packets of the virtual data flow, the virtual data flow is allocated to the corresponding processing unit for parallel traffic processing to obtain the network topology change characteristics of the virtual data flow. This step may also include the following steps: Step 301: Calculate the load value of the virtual data flow according to the number and size of data packets.

[0036] The load value refers to a quantitative indicator of the virtual data flow processing pressure obtained by weighted calculation based on the number of packets and the size of the packets. The load value can be understood as the resource consumption score of the virtual data flow. It comprehensively considers the computational overhead of packet parsing (related to the number of packets) and the resource overhead of data transmission and storage (related to the size of the packets).

[0037] Specifically, the system adopts a weighted calculation model to comprehensively consider the impact of the number of packets and the size of the packets. First, the total number of packets N and the total number of bytes S in the virtual data flow are counted, and then the load value of the virtual data flow is calculated according to the formula "load value = α×N+β×S", where α and β are the weight coefficients of the number and size of packets, respectively. For example, when α=1 and β=0.0001, the load value of a virtual data flow containing 1000 packets and a total size of 10MB is 1000+0.0001×10×1024×1024≈1102.4. This calculation method takes into account the combined impact of packet processing overhead and data transmission overhead, and the weight coefficient can be adjusted according to the actual system performance characteristics. The implementation effect of this load calculation mechanism is significant. First, through the quantified load value, the system can objectively evaluate the processing requirements of different virtual data flows, providing a reliable basis for subsequent task allocation. Second, considering the dual impact of the number and size of packets, the calculated load value more accurately reflects the actual processing pressure, which helps to achieve more reasonable resource allocation. Finally, through the adjustable weight coefficient, the system can flexibly adjust the load calculation strategy according to the actual processing capacity and business needs to adapt to different application scenarios. This precise load evaluation mechanism lays the foundation for efficient parallel processing.

[0038] Step 302: Based on each load value, allocate the virtual data flow to the processing unit corresponding to the data load amount.

[0039] Specifically, all virtual data flows are first sorted by load value, while maintaining the current load status and maximum processing capacity of each processing unit. For example, a virtual data flow with a load value of 1102.4 will be preferentially allocated to a high-performance processing unit with a low current load and sufficient processing capacity. When the load value of a virtual data flow exceeds the processing threshold of a single processing unit, the system will split it into multiple sub-flows and assign it to multiple processing units for collaborative processing. The system will also dynamically monitor the load of each processing unit and rebalance tasks when necessary to ensure that the processing load is always maintained at a reasonable level. This load value-based allocation mechanism has a significant effect. First, by preferentially allocating virtual data flows with higher load values ​​to high-performance processing units, the generation of processing bottlenecks is avoided and the overall processing efficiency of the system is improved. Secondly, the dynamic load monitoring and task adjustment mechanism ensures the balanced utilization of system resources and prevents the situation where some processing units are overloaded while other processing units are idle. Finally, through reasonable task allocation, the system can complete the processing and analysis of virtual data flows more quickly and improve the real-time performance of anomaly detection.

[0040] Step 303: extract features of the allocated virtual data stream through the processing unit to obtain the network node diffusion speed and network node connection direction of the virtual data, and use the network node diffusion speed and network node connection direction of the virtual data as network topology change features of the virtual data stream.

[0041] Among them, the network node diffusion speed refers to the time dynamic characteristics of newly added network nodes in the virtual data flow, which is measured by calculating the number of new nodes participating in data transmission per unit time, and reflects the expansion rate of the scale of network connections.

[0042] The network node connection direction refers to the directional characteristics of the communication link between nodes in the virtual data flow. It is determined by analyzing the timing relationship between the source address and the destination address of the data packet, including information such as the connection initiation direction, data transmission direction, and connection response direction.

[0043] Specifically, the processing unit first performs a timing analysis on the received virtual data stream, and calculates the network node diffusion speed by tracking the timestamp and address information of the data packet. For example, the system records the time interval and number of newly added network nodes to obtain the node growth rate. Rapid node diffusion may indicate worm propagation or scanning attacks. At the same time, the processing unit analyzes the source address and destination address sequence of the data packet, constructs a network connection diagram, and extracts the connection direction characteristics between nodes, including the initiation direction, response status, and duration of the connection. These information together constitute the network topology change characteristics of the virtual data stream, reflecting the propagation mode and behavior characteristics of the data stream. The implementation effect of this feature extraction mechanism is significant. First, by analyzing the node diffusion speed, the system can quickly discover abnormal network expansion behaviors, such as the rapid spread of botnets or network scanning activities. Secondly, the analysis of node connection directions helps to identify abnormal communication modes, such as reverse connections or abnormal multi-point transmission behaviors. Finally, the combination of these features provides a richer judgment basis for subsequent anomaly detection and improves the accuracy of attack identification.

[0044] Step 104: Determine the traffic characteristic parameters corresponding to the virtual data flow according to the network topology change characteristics, and construct the traffic characteristic vector corresponding to the virtual data flow based on the traffic characteristic parameters.

[0045] Among them, traffic characteristic parameters refer to three key quantitative indicators obtained by analyzing the network behavior characteristics of virtual data flows: bandwidth occupancy (reflecting the use of network resources), message time interval (reflecting the continuity of data transmission), and traffic burstiness (reflecting the drastic degree of traffic changes). These three parameters describe the behavioral characteristics of data flows from the dimensions of resource occupancy, time characteristics, and change intensity. Traffic characteristic parameters can be understood as the numerical expression of data flow network behavior. Bandwidth occupancy indicates the degree to which data flows occupy network bandwidth, message time interval reflects the time regularity of data packet transmission, and traffic burstiness measures the fluctuation of data transmission intensity.

[0046] The traffic feature vector refers to a three-dimensional numerical vector composed of three traffic feature parameters, namely bandwidth occupancy, packet time interval and traffic burstiness, in a fixed order. It adopts the vector representation form V=(x, y, z), where x represents the bandwidth occupancy value, y represents the packet time interval value, and z represents the traffic burstiness value. This mathematical form is used to fully describe the behavior characteristics of the virtual data flow.

[0047] Specifically, three key traffic characteristic parameters are first extracted according to the characteristics of network topology changes. The bandwidth occupancy rate is calculated by analyzing the resource usage of the data flow, the message time interval is obtained by recording the time law of data packet transmission, and the traffic burstiness is determined by evaluating the change trend of traffic intensity. For example, the system calculates the bandwidth occupancy rate by monitoring the ratio of data transmission volume per unit time to available bandwidth, obtains the message time interval by counting the time difference between adjacent data packets, and calculates the traffic burstiness by analyzing the fluctuation of traffic size. Then, the system organizes these three characteristic parameters into a three-dimensional feature vector V=(x, y, z) in a predefined order, where x, y, and z correspond to the specific values ​​of bandwidth occupancy rate, message time interval, and traffic burstiness, respectively. This feature parameterization and vectorization processing mechanism has significant effects. First, by extracting standardized traffic characteristic parameters, the accurate quantification of network behavior is achieved, which is convenient for subsequent numerical calculation and comparative analysis. Secondly, the vectorization representation method is adopted to provide a unified mathematical description form for different types of data flows, supporting vector distance calculation and similarity analysis. Finally, the construction of this three-dimensional feature space provides a clear mathematical framework for anomaly detection, enabling the system to identify abnormal behavior based on vector operations, improving the accuracy and efficiency of detection.

[0048] Based on the above embodiment, as an optional embodiment, in step 104: determining the flow characteristic parameters corresponding to the virtual data flow according to the network topology change characteristics, this step may also include the following steps: Step 401: Determine the total data transmission amount of the virtual data flow within a preset time period based on the network node diffusion speed and the network node connection direction.

[0049] The total amount of data transmission refers to the cumulative size of all data packets transmitted through the virtual data stream within the preset time. It comprehensively counts the data flow within the time window by analyzing the data transmission scale reflected by the diffusion speed of network nodes and the transmission direction reflected by the connection direction of network nodes, and finally obtains the total amount of transmission value in bytes.

[0050] Specifically, a fixed observation duration (such as 1 minute) is first set as the preset duration. Within this time window, the system counts the changes in the number of nodes participating in data transmission based on the diffusion speed of network nodes, and analyzes the data transmission direction and traffic size of each node according to the connection direction of network nodes. By multiplying the node diffusion speed with the average transmission volume of a single node, the data transmission volume in each time unit can be estimated; combined with the information of the network node connection direction, the system can distinguish between inbound and outbound traffic to avoid repeated calculation of the data volume of bidirectional transmission. Finally, the transmission volume of all time units within the preset duration is accumulated to obtain the total data transmission volume of the virtual data flow in this period. This method of calculating the total data transmission volume based on network topology characteristics is effective. First, by combining the information of the two dimensions of node diffusion speed and connection direction, the accuracy of transmission volume statistics is improved, avoiding the errors that may be caused by relying solely on traffic counting. Secondly, the setting of the preset duration ensures the consistency of data sampling, making the transmission volume in different time periods comparable. Finally, this calculation method provides a reliable data basis for subsequent bandwidth occupancy analysis, which helps to accurately identify abnormal resource occupancy behavior.

[0051] Step 402: The ratio of the total data transmission amount to the preset duration is used as the bandwidth occupancy rate of the virtual data flow.

[0052] The bandwidth utilization rate refers to the ratio of the total amount of data transmission of the virtual data flow within the preset duration to the duration, which indicates the actual transmission rate of the data flow per unit time. This ratio is calculated by dividing the accumulated data transmission volume in a specific time window by the observation duration, reflecting the intensity of the data flow's use of network resources.

[0053] Specifically, the system divides the total amount of data transmission obtained by statistics by the corresponding preset duration to obtain the average transmission rate. For example, if the total amount of data transmission within the preset duration of 1 minute is 60MB, the calculated average transmission rate is 1MB / s. This rate value is the bandwidth occupancy of the virtual data flow, which reflects the actual size of the network resources occupied by the data flow per unit time. By comparing this bandwidth occupancy with the available bandwidth of the network link, the bandwidth occupancy rate expressed as a percentage can be obtained. This method of calculating bandwidth occupancy is effective. First, through time normalization processing, the influence of different observation durations is eliminated, making the bandwidth occupancy rate have good comparability. Secondly, this calculation method is simple and intuitive, which facilitates the system to quickly evaluate the resource occupancy of the data flow. Finally, the obtained bandwidth occupancy rate, as an important dimension of the traffic feature vector, provides a reliable feature indicator for the identification of abnormal traffic and helps to discover abnormal resource usage behavior.

[0054] Step 403: within a preset time length, calculate the average value of the time difference between any two adjacent data packets in the virtual data flow to obtain the message time interval of the virtual data flow.

[0055] The packet time interval refers to the average time difference between any two adjacent packets of the virtual data flow within the preset time length. It calculates the time interval between consecutively arriving packets and performs arithmetic averaging on all time differences to obtain a statistical indicator that reflects the regularity of packet transmission time.

[0056] Specifically, the system records the timestamps of all data packets in the virtual data stream within a preset time length, and calculates the time difference between any two adjacent data packets. For example, if the arrival times of three consecutive data packets are t1, t2, and t3, respectively, the two time differences (t2-t1) and (t3-t2) are calculated. By collecting the time differences of all adjacent data packets within the preset time length and calculating the arithmetic mean of these differences, the message time interval of the virtual data stream is obtained. This average value reflects the typical time interval of data packet transmission. This method of calculating the message time interval is effective. First, by averaging a large number of time differences, the random fluctuations of the transmission delay of a single data packet are eliminated, and a stable and reliable time feature is obtained. Secondly, this calculation method can effectively reflect the transmission rhythm of the data stream, and different types of network behaviors usually show different message time interval characteristics. Finally, the obtained message time interval, as an important dimension of the traffic feature vector, provides a characteristic indicator of the time dimension for the identification of abnormal traffic, which helps to discover data streams with abnormal transmission patterns.

[0057] Step 404: Based on the total amount of data transmission, the traffic burstiness of the virtual data flow is calculated; and the bandwidth occupancy rate, the message time interval and the traffic burstiness are used as traffic characteristic parameters corresponding to the virtual data flow.

[0058] The traffic burst refers to the degree of fluctuation of the transmission volume of the virtual data flow within a preset time period, which is expressed by calculating the ratio of the variance to the mean of the data transmission volume in multiple time segments. This ratio reflects the degree of change in the intensity of data flow transmission. The larger the value, the more significant the traffic fluctuation.

[0059] Specifically, the system first divides the preset duration into multiple smaller time segments, and counts the transmission volume in each time segment. By calculating the ratio of the variance to the mean of the transmission volume in these time segments, the traffic burstiness of the virtual data flow is obtained. For example, if the total amount of data transmission is evenly distributed in each time segment, the calculated traffic burstiness is low; if the transmission volume fluctuates violently, the traffic burstiness will be high. Subsequently, the system uses the calculated bandwidth occupancy rate, message time interval, and traffic burstiness as the traffic characteristic parameters of the virtual data flow, providing a complete parameter set for the subsequent feature vector construction. This feature parameter construction method is effective. First, by combining the indicators of three dimensions of resource occupancy (bandwidth occupancy rate), time characteristics (message time interval), and fluctuation characteristics (traffic burstiness), a comprehensive characterization of data flow behavior is achieved. Second, these three feature parameters are independent of each other and have their own characteristics, which can reflect the behavioral characteristics of data flows from different angles. Finally, this multi-dimensional feature parameter provides a complete numerical basis for the construction of traffic feature vectors, which helps to improve the accuracy of anomaly detection.

[0060] Based on the above embodiment, as an optional embodiment, in step 404: calculating the traffic burst of the virtual data flow based on the total amount of data transmission, this step may also include the following steps: Step 414: Based on the total amount of data transmission, determine the data transmission amount difference between a plurality of adjacent sampling points within a preset time period, and calculate the average of each data transmission difference.

[0061] Specifically, the system first sets multiple uniformly distributed sampling points within a preset time length, and divides the time window into several sampling intervals of equal length. The current data transmission volume is recorded at each sampling point, and the data transmission volume difference between adjacent sampling points is calculated. For example, if the transmission volume of three consecutive sampling points is V1, V2, and V3, respectively, the two transmission volume differences (V2-V1) and (V3-V2) are calculated. By taking the arithmetic average of the transmission volume differences of all adjacent sampling point pairs within the preset time length, the average level reflecting the change in transmission volume is obtained. This method of calculating the data transmission difference is effective. First, by introducing uniformly distributed sampling points, continuous monitoring of data flow behavior is guaranteed, avoiding sampling blind spots. Secondly, calculating the transmission volume difference of adjacent sampling points can intuitively reflect the intensity of data flow changes in a short period of time. Finally, the processing method of taking the average of all transmission volume differences provides a reliable statistical basis for the subsequent calculation of traffic burstiness, which helps to accurately evaluate the fluctuation characteristics of data flows.

[0062] Step 424: Filter out the number of sampling points whose data transmission volume difference is greater than the mean value as the number of fluctuation points.

[0063] The number of fluctuation points refers to the total number of sampling points where the difference in data transmission volume is greater than the average difference within a preset time period. It reflects the frequency of significant fluctuations in the virtual data flow during transmission by counting the number of moments when the transmission volume changes exceed the average level.

[0064] Specifically, the system compares the data transmission volume difference of all sampling points within the preset time length with the calculated mean. For each sampling point, if the corresponding transmission volume difference exceeds the mean, the sampling point is marked as a fluctuation point. By counting the number of all fluctuation points that meet the conditions, the number of fluctuation points reflecting the frequency of drastic changes in the data flow is obtained. For example, if the transmission volume difference of 30 points out of 100 sampling points is greater than the mean, the number of fluctuation points is 30. This fluctuation point screening method is effective. First, by using the mean as the threshold for fluctuation judgment, an adaptive fluctuation detection standard is established to avoid the misjudgment that may be caused by a fixed threshold. Secondly, the number of fluctuation points intuitively reflects the frequency of significant changes in the data flow, providing a quantitative basis for evaluating traffic stability. Finally, this statistical method provides important parameters for the subsequent calculation of traffic burstiness, which helps to accurately characterize the fluctuation characteristics of the data flow.

[0065] Step 434: The ratio of the number of fluctuation points to the total number of sampling points within a preset time length is used as the traffic burstiness of the virtual data flow.

[0066] Specifically, the system first counts the total number of sampling points within the preset time length, which depends on the sampling interval set by the system. Then the number of fluctuation points obtained is divided by the total number of sampling points to obtain a ratio reflecting the degree of fluctuation of the data flow. For example, if 30 fluctuation points are detected among 100 sampling points, the calculated traffic burst is 0.3, indicating that 30% of the sampling moments of the virtual data flow have significant changes in transmission volume. This method of calculating traffic burst is effective. First, by adopting the form of ratio, the normalized representation of fluctuation characteristics is realized, making data flows of different durations and different sampling frequencies comparable. Secondly, this calculation method intuitively reflects the degree of instability of the data flow. The larger the traffic burst, the more violent the fluctuation of the data flow. Finally, the obtained traffic burst, as the third dimension of the traffic feature vector, together with the bandwidth occupancy rate and the message time interval, provides a complete feature description for the identification of abnormal traffic.

[0067] Based on the above embodiment, as an optional embodiment, in step 104: constructing a flow characteristic vector corresponding to the virtual data flow based on the flow characteristic parameters, this step may also include the following steps: Step 405: construct a reference three-dimensional feature matrix, and map the bandwidth occupancy rate, message time interval, and traffic burstiness in the traffic feature parameters to multiple discrete points in the reference three-dimensional feature matrix.

[0068] The benchmark three-dimensional feature matrix refers to a feature space constructed with bandwidth occupancy, message time interval and traffic burst as three coordinate axes. This space is divided into several feature points through preset discrete intervals to form a standardized three-dimensional grid structure. Each feature point is uniquely determined by the specific values ​​of these three dimensions.

[0069] Specifically, the system first establishes a three-dimensional feature space with bandwidth occupancy, message time interval and traffic burst as three coordinate axes. In each dimension, the appropriate value range and discrete interval are set according to historical data and expert experience to form a benchmark three-dimensional feature matrix. Subsequently, the calculated traffic feature parameters are mapped to the closest discrete point position in the feature matrix according to their respective numerical values. For example, if the bandwidth occupancy of a virtual data flow is 1MB / s, the message time interval is 0.02 seconds, and the traffic burst is 0.3, the coordinates of the discrete point closest to this set of parameters are found in the feature matrix as the feature representation point of the data flow. This feature mapping method has significant effects. First, by constructing a standardized benchmark feature matrix, a unified measurement space is provided for the feature parameters of different data flows, which is convenient for similarity analysis. Secondly, the discrete point mapping method is adopted to reduce the computational complexity brought by continuous values ​​while retaining the main information of the feature parameters. Finally, based on the mapping results of the three-dimensional feature matrix, a standardized data basis is provided for the subsequent calculation of the feature vector, which helps to improve the efficiency and accuracy of anomaly detection.

[0070] Step 406: Generate a flow characteristic curve based on each discrete point; perform piecewise fitting on the flow characteristic curve according to a preset time window to obtain a flow characteristic vector corresponding to the virtual data flow.

[0071] The traffic characteristic curve refers to the spatial trajectory formed by connecting the characteristic parameter mapping points of the virtual data flow at different times in time sequence in the reference three-dimensional characteristic matrix space. This curve reflects the common change law of the three characteristic parameters of the data flow: bandwidth occupancy, message time interval and traffic burstiness over time.

[0072] Specifically, the system first connects the discrete points mapped in the reference three-dimensional feature matrix in chronological order to form a flow characteristic curve that reflects the changes in data flow behavior. Subsequently, the characteristic curve is segmented according to the preset time window, and a set of coefficients is obtained by mathematical fitting for the curve segments in each time window. For example, a polynomial fitting method can be used to represent each curve segment as a polynomial function with specific coefficients. Finally, the fitting coefficients obtained in all time windows are combined in sequence to form a flow characteristic vector that describes the complete behavioral characteristics of the virtual data flow. This feature vector construction method is effective. First, by generating a flow characteristic curve, the continuity characteristics of the data flow behavior changing over time are retained. Secondly, the segmented fitting method is adopted to reduce the amount of data while maintaining the accurate description of the local behavioral characteristics. Finally, the obtained flow characteristic vector contains both the information of the static characteristic parameters and the changing laws of the dynamic behavior.

[0073] Step 105: perform abnormal identification on each traffic feature vector, determine the abnormal traffic in each virtual data flow, and intercept the abnormal traffic.

[0074] Abnormal traffic refers to virtual data flows whose traffic feature vector patterns deviate from the normal range. It identifies data transmission activities that differ significantly from normal network behaviors by analyzing the combined features of bandwidth occupancy, message time interval, and traffic burstiness in the traffic feature vector.

[0075] Specifically, the system first analyzes the traffic feature vector of each virtual data flow based on a pre-trained machine learning model or a preset anomaly detection rule. By calculating the degree of deviation of the feature vector from the normal traffic pattern, data flows with abnormal characteristics are identified. For example, if a feature vector shows an abnormally high bandwidth occupancy rate, an abnormally short message time interval, or a severe traffic burst, the system will mark it as abnormal traffic. Subsequently, the data flow confirmed as abnormal is intercepted, and current limiting, blocking, or redirection can be used to prevent abnormal traffic from having a negative impact on the network. This abnormal traffic identification and processing method is effective. First, by analyzing the traffic feature vector, accurate identification of abnormal behavior is achieved, avoiding the misjudgment that may be caused by simple threshold judgment. Secondly, the use of real-time detection and timely interception effectively prevents the impact of abnormal traffic on network performance.

[0076] Based on the above embodiment, as an optional embodiment, in step 105: performing abnormal identification on each traffic feature vector to determine the abnormal traffic in each virtual data flow, this step may also include the following steps: Step 501: For each virtual data flow, calculate the similarity value between the traffic feature vector and the preset abnormal feature vector; when the similarity value is greater than the similarity threshold, determine the virtual data flow as abnormal traffic.

[0077] Specifically, after obtaining the traffic feature vector, in order to accurately identify abnormal traffic, it is necessary to evaluate the degree of abnormality of the data flow. Since different types of network abnormal behaviors will form specific characteristic patterns, by calculating the similarity between the traffic feature vector and the known abnormal pattern, it is possible to effectively determine whether the data flow is abnormal. Specifically, based on historical data and expert experience, a set of typical abnormal feature vectors are predefined, which represent various known abnormal behavior patterns. Subsequently, for each virtual data flow traffic feature vector, the similarity value between it and the preset abnormal feature vector is calculated. The similarity calculation can use mathematical methods such as cosine similarity and Euclidean distance to quantify the degree of proximity between feature vectors. For example, if the similarity value between the feature vector of a virtual data flow and the abnormal feature vector representing the DDoS attack exceeds a preset similarity threshold, such as 0.85, the data flow is judged as abnormal traffic. This similarity-based abnormal identification method is effective. First, by presetting the abnormal feature vector as a reference template, a clear abnormal judgment standard is established, which improves the accuracy of identification. Secondly, by using the similarity calculation method, the subtle differences in feature vectors can be flexibly handled, avoiding the limitations of simple threshold judgment. Finally, by adjusting the similarity threshold, the sensitivity and false alarm rate of detection can be balanced to achieve more accurate abnormal traffic identification.

[0078] Reference Figure 2 , a malicious traffic real-time identification and blocking system provided in an embodiment of the present application, the system comprises: an information acquisition module, a data flow determination module, a feature determination module, and a traffic identification module, wherein: An information acquisition module, used to acquire the network data flow to be identified and determine the packet header information of the network data flow to be identified; A data flow determination module, used for mapping the network data flow to be identified into multiple virtual data flows based on the source address and the destination address in the packet header information; A feature determination module is used to allocate each virtual data flow to a corresponding processing unit for parallel flow processing based on the number and size of packets of the virtual data flow, so as to obtain a network topology change feature of the virtual data flow; The traffic identification module is used to determine the traffic characteristic parameters corresponding to the virtual data flow according to the characteristics of network topology changes, and to construct the traffic characteristic vector corresponding to the virtual data flow based on the traffic characteristic parameters; to identify anomalies in each traffic characteristic vector, to determine the abnormal traffic in each virtual data flow, and to intercept the abnormal traffic.

[0079] Based on the above embodiments, the data flow determination module is also used to obtain multiple network address segments corresponding to the source address and the destination address; generate address segment identifiers corresponding to each network address segment; based on each address segment identifier, map the network data packets with the same address segment identifier in the network data flow to be identified into a virtual data flow, and obtain multiple virtual data streams with different address segment identifiers.

[0080] Based on the above embodiments, the feature determination module is also used to calculate the load value of the virtual data flow according to the number and size of data packets; based on each load value, the virtual data flow is allocated to the processing unit of the corresponding data load; the processing unit performs feature extraction on the allocated virtual data flow to obtain the network node diffusion speed and network node connection direction of the virtual data, and uses the network node diffusion speed and network node connection direction of the virtual data as the network topology change characteristics of the virtual data flow.

[0081] On the basis of the above embodiments, the traffic identification module is also used to determine the total amount of data transmission of the virtual data flow within a preset time period based on the diffusion speed of the network nodes and the connection direction of the network nodes; the ratio of the total amount of data transmission to the preset time period is used as the bandwidth occupancy rate of the virtual data flow; within the preset time period, the average value of the time difference between any two adjacent data packets in the virtual data flow is calculated to obtain the message time interval of the virtual data flow; based on the total amount of data transmission, the traffic burstiness of the virtual data flow is calculated; the bandwidth occupancy rate, the message time interval and the traffic burstiness are used as the traffic characteristic parameters corresponding to the virtual data flow.

[0082] On the basis of the above embodiment, the traffic identification module is also used to determine the data transmission volume difference between multiple adjacent sampling points within a preset time length based on the total data transmission, and calculate the mean of each data transmission difference; filter out the number of sampling points whose data transmission volume difference is greater than the mean as the number of fluctuation points; and use the ratio of the number of fluctuation points to the total number of sampling points within the preset time length as the traffic burstiness of the virtual data flow.

[0083] On the basis of the above-mentioned embodiment, the traffic identification module is also used to construct a benchmark three-dimensional feature matrix, and map the bandwidth occupancy, message time interval and traffic burstiness in the traffic feature parameters to multiple discrete points in the benchmark three-dimensional feature matrix; based on each discrete point, a traffic characteristic curve is generated; according to a preset time window, the traffic characteristic curve is segmentedly fitted to obtain a traffic characteristic vector corresponding to the virtual data flow.

[0084] Based on the above embodiment, the traffic identification module is further used to calculate the similarity value between the traffic feature vector and the preset abnormal feature vector for each virtual data flow; when the similarity value is greater than the similarity threshold, the virtual data flow is determined as abnormal traffic.

[0085] It should be noted that: when the device provided in the above embodiment realizes its function, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0086] The present application also discloses an electronic device. Figure 3 , Figure 3 The electronic device 300 may include: at least one processor 301 , at least one network interface 304 , a user interface 303 , a memory 305 , and at least one communication bus 302 .

[0087] The communication bus 302 is used to realize the connection and communication between these components.

[0088] The user interface 303 may include a display interface and a camera interface. Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0089] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0090] Among them, the processor 301 may include one or more processing cores. The processor 301 uses various interfaces and lines to connect various parts in the entire server, and executes various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 305, and calling data stored in the memory 305. Optionally, the processor 301 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 301 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface diagrams and applications, etc.; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 301, and it can be implemented separately through a chip.

[0091] Among them, the memory 305 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 305 includes a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 305 may optionally also be at least one storage device located away from the aforementioned processor 301. Refer to Figure 3 , the memory 305 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an application program for a method for real-time identification and blocking of malicious traffic.

[0092] exist Figure 3In the electronic device 300 shown, the user interface 303 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 301 can be used to call the application program stored in the memory 305 for a method of real-time identification and blocking of malicious traffic. When executed by one or more processors 301, the electronic device 300 executes one or more methods in the above-mentioned embodiments. It should be noted that for the aforementioned method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for the present application.

[0093] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0094] In the several embodiments provided in this application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0095] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0096] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0097] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: various media that can store program codes, such as USB flash drives, mobile hard drives, magnetic disks or optical disks.

[0098] The above are only exemplary embodiments of the present disclosure and cannot be used to limit the scope of the present disclosure. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the disclosure of the specification and practice, those skilled in the art will easily think of other embodiments of the present disclosure.

[0099] This application is intended to cover any variation, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the art not recorded in the present disclosure. The description and examples are to be regarded as exemplary only.

Claims

1. A method for real-time identification and blocking of malicious traffic, characterized in that: include: Acquire a network data stream to be identified, and determine packet header information of the network data stream to be identified; Based on the source address and the destination address in the packet header information, mapping the network data flow to be identified into multiple virtual data flows; For each of the virtual data flows, based on the number and size of packets of the virtual data flow, the virtual data flow is allocated to a corresponding processing unit for parallel flow processing to obtain network topology change characteristics of the virtual data flow; Determine the flow characteristic parameters corresponding to the virtual data flow according to the network topology change characteristics, and construct the flow characteristic vector corresponding to the virtual data flow based on the flow characteristic parameters; Anomalies are identified on each of the traffic feature vectors, abnormal traffic in each of the virtual data flows is determined, and an interception operation is performed on the abnormal traffic.

2. The method for real-time identification and blocking of malicious traffic according to claim 1 is characterized in that: The mapping of the to-be-identified network data stream into a plurality of virtual data streams based on the source address and the destination address in the packet header information includes: Obtain multiple network address segments corresponding to the source address and the destination address; Generate address segment identifiers corresponding to each of the network address segments; Based on each of the address segment identifiers, network data packets with the same address segment identifier in the network data flow to be identified are mapped into a virtual data flow to obtain multiple virtual data flows with different address segment identifiers.

3. The method for real-time identification and blocking of malicious traffic according to claim 1 is characterized in that: The method of allocating the virtual data flow to corresponding processing units for parallel traffic processing based on the number and size of data packets of the virtual data flow to obtain network topology change characteristics of the virtual data flow includes: Calculating the load value of the virtual data flow according to the number and size of the data packets; Based on each of the load values, the virtual data stream is allocated to a processing unit corresponding to the data load amount; The processing unit extracts features of the allocated virtual data stream to obtain the network node diffusion speed and network node connection direction of the virtual data, and uses the network node diffusion speed and network node connection direction of the virtual data as network topology change features of the virtual data stream.

4. The method for real-time identification and blocking of malicious traffic according to claim 3 is characterized in that: The determining, according to the network topology change characteristics, the traffic characteristic parameters corresponding to the virtual data flow includes: Determining the total amount of data transmission of the virtual data flow within a preset time period based on the diffusion speed of the network nodes and the connection direction of the network nodes; The ratio of the total data transmission amount to the preset duration is used as the bandwidth occupancy rate of the virtual data flow; Within the preset time length, calculating the average value of the time difference between any two adjacent data packets in the virtual data stream to obtain the message time interval of the virtual data stream; Calculating the traffic burstiness of the virtual data flow based on the total amount of data transmission; The bandwidth occupancy rate, the message time interval and the traffic burstiness are used as traffic characteristic parameters corresponding to the virtual data flow.

5. The method for real-time identification and blocking of malicious traffic according to claim 4 is characterized in that: The calculating the traffic burstiness of the virtual data flow based on the total amount of data transmission includes: Based on the total amount of data transmission, determining a data transmission amount difference between a plurality of adjacent sampling points within the preset time length, and calculating a mean of each of the data transmission differences; Filter out the number of sampling points whose data transmission volume difference is greater than the mean as the number of fluctuation points; The ratio of the number of fluctuation points to the total number of sampling points within the preset time length is used as the traffic burstiness of the virtual data flow.

6. The method for real-time identification and blocking of malicious traffic according to claim 1 is characterized in that: The constructing, based on the traffic characteristic parameter, a traffic characteristic vector corresponding to the virtual data flow includes: Constructing a reference three-dimensional feature matrix, and mapping the bandwidth occupancy rate, message time interval and traffic burstiness in the traffic feature parameters to a plurality of discrete points in the reference three-dimensional feature matrix; Based on each of the discrete points, a flow characteristic curve is generated; According to a preset time window, the flow characteristic curve is fitted piecewise to obtain a flow characteristic vector corresponding to the virtual data flow.

7. The method for real-time identification and blocking of malicious traffic according to claim 1, characterized in that: The performing abnormal identification on each of the flow feature vectors to determine the abnormal flow in each of the virtual data includes: For each of the virtual data flows, calculating a similarity value between the traffic feature vector and a preset abnormal feature vector; When the similarity value is greater than a similarity threshold, the virtual data flow is determined as abnormal traffic.

8. A real-time identification and blocking system for malicious traffic, characterized in that: The system comprises: An information acquisition module, used to acquire a network data stream to be identified and determine the packet header information of the network data stream to be identified; A data flow determination module, used for mapping the network data flow to be identified into multiple virtual data flows based on the source address and the destination address in the packet header information; A feature determination module, for allocating each virtual data flow to a corresponding processing unit for parallel flow processing based on the number and size of packets of the virtual data flow, so as to obtain a network topology change feature of the virtual data flow; The traffic identification module is used to determine the traffic characteristic parameters corresponding to the virtual data flow according to the network topology change characteristics, and construct the traffic characteristic vector corresponding to the virtual data flow based on the traffic characteristic parameters; perform anomaly identification on each of the traffic characteristic vectors, determine the abnormal traffic in each of the virtual data flows, and intercept the abnormal traffic.

9. An electronic device, characterized in that: It includes a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the real-time identification and blocking method for malicious traffic as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed, the real-time identification and blocking method for malicious traffic as described in any one of claims 1-7 is executed.

Images