Abnormal communication monitoring method and device, equipment and storage medium

Abstract

The invention discloses an abnormal communication monitoring method, apparatus and device, and a storage medium. The method comprises the steps of obtaining a traffic data packet and user access behavior data monitored in a current time period; extracting behavior characteristics of the user access behavior data and traffic characteristics of the traffic data packet; inputting the behavior characteristics into a pre-trained user behavior analysis model, and outputting a user behavior type; and if the user behavior type is a normal user behavior, inputting the traffic characteristics into a pre-trained abnormal communication monitoring model, and determining abnormal communication traffic. According to the method, the user access behavior is judged by establishing the user behavior analysis model, the flow data packet in the current time period is analyzed by using the abnormal communication monitoring model, the abnormal communication flow is identified, and the accuracy of communication flow abnormity identification is improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to an abnormal communication monitoring method, device, equipment and storage medium. Background Art

[0002] With the access of the main body of the field, the cyberspace has changed from closed to open, the exposure of network risks has expanded dramatically, the protection boundary has become increasingly blurred, the difficulty of security management has increased, and the analysis and application of massive data information has led to the emergence of data security issues, bringing new challenges to the existing protection system. In the new power system scenario, there is a lack of effective assessment and defense means for the network security of the distributed energy system, and there are security risks in the master station network.

[0003] In the normal operation process, the network data flow of the process layer of the smart substation is mainly periodic data flow and a small amount of random data flow, occasionally accompanied by burst data flow that affects the peak value of the data flow flow. The overall characteristics show obvious periodicity and irregular variability. In the existing technology, most of the methods based on time domain statistics are used for abnormal monitoring of network communication traffic. The statistical analysis model is used for modeling, historical traffic data is analyzed, and the interval threshold of normal data traffic is constructed to realize data traffic anomaly detection. However, the method based on the threshold principle often has the difficulty of setting the threshold, which easily leads to problems such as high misjudgment or missed detection of network communication traffic anomaly detection, and the accuracy is poor. Summary of the invention

[0004] The embodiments of the present invention provide an abnormal communication monitoring method, device, equipment and storage medium, which judge the user access behavior by establishing a user behavior analysis model, and use the abnormal communication monitoring model to analyze the traffic data packets in the current time period to identify abnormal communication traffic and improve the accuracy of communication traffic anomaly identification.

[0005] In a first aspect, an embodiment of the present invention provides a method for monitoring abnormal communication, comprising:

[0006] Obtain the traffic data packets and user access behavior data monitored during the current period;

[0007] Extracting the behavior characteristics of the user access behavior data and the traffic characteristics of the traffic data packet;

[0008] Inputting the behavior features into a pre-trained user behavior analysis model and outputting the user behavior type;

[0009] If the user behavior type is normal user behavior, the traffic feature is input into a pre-trained abnormal communication monitoring model to determine abnormal communication traffic.

[0010] In a second aspect, an embodiment of the present invention further provides an abnormal communication monitoring device, the device comprising:

[0011] The data acquisition module is used to obtain the traffic data packets and user access behavior data monitored during the current period;

[0012] A feature extraction module, used to extract the behavior features of the user access behavior data and the traffic features of the traffic data packet;

[0013] A user behavior type output module, used to input the behavior characteristics into a pre-trained user behavior analysis model and output the user behavior type;

[0014] The abnormality determination module is used to input the traffic characteristics into a pre-trained abnormal communication monitoring model to determine abnormal communication traffic if the user behavior type is normal user behavior.

[0015] In a third aspect, an embodiment of the present disclosure further provides an electronic device, the electronic device comprising:

[0016] one or more processors;

[0017] a storage device for storing one or more programs,

[0018] When the one or more programs are executed by the one or more processors, the one or more processors implement the abnormal communication monitoring method provided by the embodiment of the present disclosure.

[0019] In a fourth aspect, the embodiments of the present disclosure further provide a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to implement the abnormal communication monitoring method provided by the embodiments of the present disclosure.

[0020] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, the computer program product including a computer program, and when the computer program is executed by a processor, the abnormal communication monitoring method provided in the embodiment of the first aspect above is implemented.

[0021] The present invention discloses an abnormal communication monitoring method, device, equipment and storage medium, including: obtaining traffic data packets and user access behavior data monitored in the current time period; extracting the behavior characteristics of the user access behavior data and the traffic characteristics of the traffic data packets; inputting the behavior characteristics into a pre-trained user behavior analysis model and outputting the user behavior type; if the user behavior type is normal user behavior, inputting the traffic characteristics into a pre-trained abnormal communication monitoring model to determine abnormal communication traffic. Using this method: judging the user access behavior by establishing a user behavior analysis model, and using the abnormal communication monitoring model to analyze the traffic data packets of the current time period, identifying abnormal communication traffic, and improving the accuracy of identifying abnormal communication traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0023] Figure 1 A flowchart of an abnormal communication monitoring method provided by an embodiment of the present disclosure;

[0024] Figure 2 A schematic diagram of the structure of an abnormal communication monitoring device provided by an embodiment of the present disclosure;

[0025] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0027] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0028] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0029] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0030] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0031] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0032] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0033] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0034] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0035] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0036] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0037] Figure 1 A flowchart of abnormal communication monitoring provided in an embodiment of the present disclosure is applicable to providing solutions to problems such as high misjudgment or missed detection of abnormal network communication traffic, and poor accuracy. The method can be executed by an abnormal communication monitoring device, which can be implemented in the form of software and / or hardware, and optionally, by an electronic device, which can be a mobile terminal, a PC or a server, etc.

[0038] like Figure 1 As shown, an abnormal communication monitoring method provided by an embodiment of the present disclosure may specifically include the following steps:

[0039] S110: Obtain traffic data packets and user access behavior data monitored during the current period.

[0040] In this embodiment,

[0041] S120: extracting behavior characteristics of user access behavior data and traffic characteristics of traffic data packets.

[0042] Among them, behavioral characteristics include user login time, access resource identifier and access frequency; traffic characteristics include quintuple, communication time and communication traffic; quintuple includes: source Internet Protocol address, destination Internet Protocol address, source port, destination port and transport layer protocol.

[0043] Specific

[0044] S130: Input the behavior features into a pre-trained user behavior analysis model, and output the user behavior type.

[0045] Based on the above embodiment, inputting the behavior features into the pre-trained user behavior analysis model, and outputting the user behavior type may include the following steps:

[0046] a1) Obtaining user behavior analysis model;

[0047] Among them, the user access behavior model is established based on the random forest algorithm.

[0048] b1) Input the behavior features into the user behavior analysis model and output the user behavior type; the user behavior type includes: normal user access behavior and abnormal user access behavior.

[0049] S140: If the user behavior type is normal user behavior, the traffic characteristics are input into a pre-trained abnormal communication monitoring model to determine abnormal communication traffic.

[0050] In this embodiment,

[0051] Based on the above embodiment, the training process of the abnormal communication monitoring model may include the following steps:

[0052] a2) Obtain historical traffic data packets and an initial abnormal communication monitoring model; the abnormal communication monitoring model is established based on a random forest algorithm.

[0053] b2) Extracting traffic features of historical traffic data packets; traffic features include five-tuple, communication time and communication volume; the five-tuple includes: source Internet Protocol address, destination Internet Protocol address, source port, destination port and transport layer protocol.

[0054] c2) Cluster the traffic data packets according to the five-tuple and calculate the total flow of the traffic data packets.

[0055] d2) Determine the change trend of the total flow of traffic data packets over time according to the communication time to form traffic time series data.

[0056] e2) Constructing a training set with the corrected traffic time series data and its corresponding communication mode; the communication mode is abnormal communication traffic and normal communication traffic.

[0057] f2) Using the training set to train the initial abnormal communication monitoring model to obtain the abnormal communication monitoring model.

[0058] In this embodiment,

[0059] Based on the above embodiment, determining the change trend of the total flow of traffic data packets over time according to the communication time, and forming the traffic time series data may include the following steps:

[0060] d21) Collect the total flow data of each group of data packets over time as the total flow time series historical data.

[0061] d22) The total traffic time series historical data is trained through the pre-set long short-term memory network model to obtain the traffic time series prediction model.

[0062] d23) Input the communication time into the traffic time series prediction model and output the traffic time series data.

[0063] Among them, the user behavior analysis model and the abnormal communication monitoring model are associated with the business communication service port.

[0064] The present invention discloses an abnormal communication monitoring method, including: obtaining traffic data packets and user access behavior data monitored in the current period; extracting the behavior characteristics of the user access behavior data and the traffic characteristics of the traffic data packets; inputting the behavior characteristics into a pre-trained user behavior analysis model, and outputting the user behavior type; if the user behavior type is a normal user behavior, inputting the traffic characteristics into a pre-trained abnormal communication monitoring model to determine the abnormal communication flow. Using this method: judging the user access behavior by establishing a user behavior analysis model, and using the abnormal communication monitoring model to analyze the traffic data packets in the current period, identifying the abnormal communication flow, and improving the accuracy of identifying abnormal communication flow.

[0065] Figure 2 The present invention also provides a schematic diagram of the structure of an abnormal communication monitoring device. Figure 2 As shown, the device includes: a data acquisition module 210, a feature extraction module 220, a visual feature module 230, a user behavior type output module 230 and an abnormality determination module 240.

[0066] The data acquisition module 210 is used to acquire the traffic data packets and user access behavior data monitored in the current period;

[0067] A feature extraction module 220, used to extract the behavior features of the user access behavior data and the traffic features of the traffic data packet;

[0068] A user behavior type output module 230, used to input the behavior characteristics into a pre-trained user behavior analysis model and output the user behavior type;

[0069] The abnormality determination module 240 is used to input the traffic characteristics into a pre-trained abnormal communication monitoring model to determine abnormal communication traffic if the user behavior type is normal user behavior.

[0070] The technical solution provided by the embodiment of the present disclosure determines the user access behavior by establishing a user behavior analysis model, and uses the abnormal communication monitoring model to analyze the traffic data packets in the current period, identify abnormal communication traffic, and improve the accuracy of identifying communication traffic anomalies.

[0071] Furthermore, the feature extraction module 220 may be used to:

[0072] The behavior characteristics include user login time, access resource identifier and access frequency; the traffic characteristics include five-tuple, communication time and communication traffic; the five-tuple includes: source Internet Protocol address, destination Internet Protocol address, source port, destination port and transport layer protocol.

[0073] Furthermore, the user behavior type output module 230 can be used to:

[0074] Acquire the user behavior analysis model; the user access behavior model is established based on a random forest algorithm;

[0075] The behavior features are input into the user behavior analysis model, and the user behavior type is output; the user behavior type includes: normal user access behavior and abnormal user access behavior.

[0076] Furthermore, the abnormality determination module 240 may be used to:

[0077] Obtaining historical traffic data packets and an initial abnormal communication monitoring model; the abnormal communication monitoring model is established based on a random forest algorithm;

[0078] Extracting the flow characteristics of the historical flow data packets; the flow characteristics include a five-tuple, communication time and communication flow; the five-tuple includes: source Internet Protocol address, destination Internet Protocol address, source port, destination port and transport layer protocol;

[0079] Clustering the traffic data packets according to the five-tuple, and calculating the total flow of the traffic data packets;

[0080] Determine the change trend of the total flow of the traffic data packets over time according to the communication time to form traffic time series data;

[0081] Using a moving average time series algorithm to correct abnormal values ​​in the flow time series data;

[0082] The modified traffic time series data and its corresponding communication mode are used to construct a training set; the communication mode is the abnormal communication traffic and the normal communication traffic;

[0083] The initial abnormal communication monitoring model is trained using the training set to obtain the abnormal communication monitoring model.

[0084] Furthermore, the abnormality determination module 240 may be used to:

[0085] Collect the total traffic of each group of data packets over time as the total traffic time series historical data;

[0086] The total flow time series historical data is trained by a preset long short-term memory network model to obtain a flow time series prediction model;

[0087] The communication time is input into the traffic time series prediction model, and the traffic time series data is output.

[0088] Furthermore, the device may also include: the user behavior analysis model and the abnormal communication monitoring model are associated with the business communication service port.

[0089] The above device can execute the methods provided by all the above embodiments of the present invention, and has the corresponding functional modules and beneficial effects of executing the above methods. For technical details not described in detail in this embodiment, please refer to the methods provided by all the above embodiments of the present invention.

[0090] Figure 3 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is given. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0091] like Figure 3 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0092] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0093] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the abnormal communication monitoring method.

[0094] In some embodiments, the abnormal communication monitoring method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the abnormal communication monitoring method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the abnormal communication monitoring method in any other appropriate manner (e.g., by means of firmware).

[0095] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0096] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0097] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0098] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0099] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0100] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0101] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0102] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for monitoring abnormal communication, characterized in that: include: Obtain the traffic data packets and user access behavior data monitored during the current period; Extracting the behavior characteristics of the user access behavior data and the traffic characteristics of the traffic data packet; Inputting the behavior features into a pre-trained user behavior analysis model and outputting the user behavior type; If the user behavior type is normal user behavior, the traffic feature is input into a pre-trained abnormal communication monitoring model to determine abnormal communication traffic.

2. The method according to claim 1, characterized in that The behavior characteristics include user login time, access resource identifier and access frequency; the traffic characteristics include five-tuple, communication time and communication traffic; the five-tuple includes: source Internet Protocol address, destination Internet Protocol address, source port, destination port and transport layer protocol.

3. The method according to claim 1, characterized in that: The step of inputting the behavior feature into a pre-trained user behavior analysis model and outputting the user behavior type includes: Acquire the user behavior analysis model; the user access behavior model is established based on a random forest algorithm; The behavior features are input into the user behavior analysis model, and the user behavior type is output; the user behavior type includes: normal user access behavior and abnormal user access behavior.

4. The method according to claim 1, characterized in that: The training process of the abnormal communication monitoring model includes: Obtaining historical traffic data packets and an initial abnormal communication monitoring model; the abnormal communication monitoring model is established based on a random forest algorithm; Extracting the flow characteristics of the historical flow data packets; the flow characteristics include a five-tuple, communication time and communication flow; the five-tuple includes: source Internet Protocol address, destination Internet Protocol address, source port, destination port and transport layer protocol; Clustering the traffic data packets according to the five-tuple, and calculating the total flow of the traffic data packets; Determine the change trend of the total flow of the traffic data packets over time according to the communication time to form traffic time series data; Using a moving average time series algorithm to correct abnormal values ​​in the flow time series data; The modified traffic time series data and its corresponding communication mode are used to construct a training set; the communication mode is the abnormal communication traffic and the normal communication traffic; The initial abnormal communication monitoring model is trained using the training set to obtain the abnormal communication monitoring model.

5. The method according to claim 4, characterized in that Determining the change trend of the total flow of the flow data packets over time according to the communication time to form flow time series data includes: Collect the total traffic of each group of data packets over time as the total traffic time series historical data; The total flow time series historical data is trained by a preset long short-term memory network model to obtain a flow time series prediction model; The communication time is input into the traffic time series prediction model, and the traffic time series data is output.

6. The method according to claim 1, characterized in that The user behavior analysis model and the abnormal communication monitoring model are associated with the business communication service port.

7. An abnormal communication monitoring device, characterized in that: include: The data acquisition module is used to obtain the traffic data packets and user access behavior data monitored during the current period; A feature extraction module, used to extract the behavior features of the user access behavior data and the traffic features of the traffic data packet; A user behavior type output module, used to input the behavior characteristics into a pre-trained user behavior analysis model and output the user behavior type; The abnormality determination module is used to input the traffic characteristics into a pre-trained abnormal communication monitoring model to determine abnormal communication traffic if the user behavior type is normal user behavior.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal communication monitoring method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormal communication monitoring method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the abnormal communication monitoring method according to any one of claims 1 to 6 is implemented.

Images