Traffic anomaly detection method and device

Abstract

The invention provides a traffic anomaly detection method and device, which are used for improving the efficiency and accuracy of traffic anomaly detection such as bandwidth overrun and reducing the cost. The method comprises the following steps: determining that the port traffic of a port in a first time period reaches a limit value according to a statistical value of the port traffic of the port in each historical time period in a plurality of historical time periods; according to the statistical value of the port traffic of the port in each historical time period in the plurality of historical time periods and the statistical value of the user traffic flowing through the port in each historical time period, determining the sudden increase of the user traffic of the port in a second time period; and judging whether the port network flow is abnormal or not according to the relationship between the first time period and the second time period.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and device for detecting anomaly in traffic. Background Art

[0002] As the Internet becomes more and more popular, for most users, browsing and accessing the Internet is one of the indispensable daily entertainment and work activities. Therefore, the requirements for network stability are becoming more and more stringent. If users want to use Internet services, they usually need to go to the operator's business hall to apply for a broadband package. Different broadband packages have restrictions on the available bandwidth, such as 100M, 200M, 500M, 1000M, etc. When users in the network environment are downloading, watching high-definition videos and other activities, a large amount of bandwidth will be occupied. When the bandwidth reaches the limit value and is fully occupied, it will cause a large amount of packet loss and increased network latency in the network, affecting the Internet experience of other users in the current network environment.

[0003] In the prior art, the operation and maintenance personnel determine whether the bandwidth exceeds the limit. However, relying solely on manpower to make the judgment is not timely and costly. On the other hand, general operators do not actively inform the upstream traffic limit value of the bandwidth, so it is difficult for the operation and maintenance personnel to determine whether the bandwidth exceeds the limit. Even if the operator informs the upstream traffic limit value of the bandwidth, due to factors such as the environment and hardware equipment in the transmission process, the operation and maintenance personnel cannot accurately estimate the actual bandwidth limit value available to the user's home, so there is still the problem of inaccurate judgment of bandwidth exceeding the limit.

[0004] How to improve the efficiency and accuracy of traffic anomaly detection such as bandwidth excess, as well as reduce costs, is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The embodiments of the present application provide a flow anomaly detection method and device for improving the efficiency and accuracy of flow anomaly detection and reducing costs.

[0006] In a first aspect, the present application provides a method for detecting traffic anomalies, which can be applied to electronic devices with processing capabilities, such as intelligent network operation and maintenance platforms. The method comprises:

[0007] According to the statistical value of the port traffic of the port in each historical time period in multiple historical time periods, it is determined that the port traffic of the port in the first time period reaches the limit value; wherein the port traffic is the traffic passing through the port per unit time; according to the statistical value of the port traffic of the port in each historical time period in multiple historical time periods and the statistical value of each user traffic flowing through the port in each historical time period, it is determined that the user traffic of the port in the second time period suddenly increases; wherein the user traffic is the traffic of a single user passing through the port per unit time; and whether the port traffic is abnormal is determined according to the relationship between the first time period and the second time period.

[0008] The traffic of each user (or device or user equipment, etc.) can be identified by the user's address, where the address can specifically be an Internet Protocol (IP) address or a Media Access Control (MAC) address, etc., which is not limited in the embodiments of the present application. When the user traffic is identified by the user's IP address, the user traffic can be called IP traffic.

[0009] In this method, port traffic overrun is identified based on historically collected port traffic, and user traffic surge is identified based on historically collected user traffic. By matching the time when the port traffic overruns and the time when the user traffic surges, it is determined whether the port traffic is abnormal (such as bandwidth overrun), which can improve the accuracy of traffic anomaly detection. The method can also accurately identify the abnormal time point (i.e., the time point when the first time period coincides with the second time period), and then during network operation and maintenance, it can help technicians quickly locate the cause of network packet loss and increased delay, which can improve operation and maintenance efficiency. The method does not require manual participation throughout the process, which can not only improve the efficiency of anomaly detection, but also reduce labor costs. In addition, the method detection is based on historical data of traffic, without occupying additional network resources. It can be seen that the above method has many characteristics such as high anomaly identification accuracy, low deployment difficulty, no need to occupy additional network resources, and low cost, which is of great significance to the development of intelligent operation and maintenance.

[0010] Optionally, before determining that the port traffic of the port in the first time period reaches the limit value based on the port traffic of the port in each historical time period in multiple historical time periods, it also includes: receiving an instruction from a user device, the instruction being used to request to perform traffic anomaly detection on the port; obtaining statistical values ​​of the port traffic in each historical time period in multiple historical time periods and statistical values ​​of each user traffic according to the instruction; wherein the multiple historical time periods are time periods within a preset time range from the current time; the current time is the time when the user device instruction is received; the statistical value of the port traffic in each historical time period is the maximum value of the port traffic at each moment in each historical time period; the statistical value of each user traffic in each historical time period is the maximum value of the user traffic of each user at each moment in each historical time period.

[0011] In this manner, traffic anomaly detection is triggered based on an instruction sent by a user, so that user needs can be met in a timely manner when the user needs traffic anomaly detection, thereby improving user experience.

[0012] Optionally, the method may also include: periodically receiving the statistical values ​​of the port traffic and the statistical values ​​of each user traffic of the port within a preset time period reported by the gateway, the preset time period being the length of each historical time period in multiple historical time periods; or, periodically counting the statistical values ​​of the port traffic and the statistical values ​​of each user traffic of the port within a preset time period, the preset time period being the length of each historical time period in the multiple historical time periods.

[0013] In this method, the gateway or intelligent network operation and maintenance platform can periodically collect the statistical values ​​of port traffic and the statistical values ​​of each user traffic, so that when traffic anomaly detection is needed later, the statistical values ​​of port traffic and the statistical values ​​of each user traffic in multiple historical time periods can be obtained, thereby improving the reliability of the solution.

[0014] Optionally, based on the port flow of the port in each of multiple historical time periods, it is determined that the port flow of the port in the first time period reaches the limit value, including: sorting the statistical values ​​of all port flows of the port in multiple historical time periods in order from large to small; determining N time periods that are in the first N positions of the sort, where N is a positive integer; when the statistical value of the port flow corresponding to the Nth time period is higher than a threshold, it is determined that the port flow of the port in these N time periods reaches the limit value, and the first time period is the set of these N time periods; the threshold is determined according to the maximum value of the statistical value of the port flow in all historical time periods.

[0015] In this method, whether the port traffic has reached the limit value is judged based on the smallest statistical value in the top N time periods with the largest statistical values ​​of the port traffic. This can identify whether the port traffic has reached the limit value for a long time or multiple times (if these N time periods are continuous time periods, it means that the port traffic has reached the limit value for a long time; if these N time periods are non-continuous time periods, it means that the port traffic has reached the limit value multiple times), thereby improving the accuracy of identifying port traffic exceeding the limit.

[0016] Optionally, the number of the multiple historical time periods is M, M is a positive integer, and N is 1% of M. Of course, this is only an example and is not limited to this.

[0017] Optionally, determining a sudden increase in user traffic of the port in the second time period based on the port traffic of the port in each historical time period in multiple historical time periods and each user traffic flowing through the port in each historical time period includes: calculating the sum of the statistical values ​​of all user traffic flowing through the port in each historical time period based on the statistical values ​​of each user traffic flowing through the port in each historical time period; calculating the difference between the sum of the statistical values ​​of all user traffic flowing through the port in each historical time period and the statistical value of the port traffic of the port in each historical time period; and determining a sudden increase in user traffic of the port in the second time period based on the difference corresponding to each historical time period.

[0018] Optionally, based on the difference corresponding to each historical time period, determining the sudden increase in user traffic of the port in the second time period includes: constructing a time series data based on an anomaly detection algorithm, the data corresponding to each time period in the time series data is the difference between the sum of the statistical values ​​of all user traffic flowing through the port in each time period and the statistical value of the port traffic of the port in each time period; each time period is each historical time period in multiple historical time periods; calculating the anomaly score of each time period according to the time series data, and determining the sudden increase in user traffic in each time period according to the anomaly score. The set of time periods corresponding to the top N anomaly scores is taken as the abnormal time period, i.e., the second time period.

[0019] When a large number of users compete for bandwidth, the traffic of each user will reach a peak at different times, drop rapidly, and then fluctuate repeatedly. Correspondingly, the traffic statistics of each user will be very large during this time period.

[0020] Therefore, in this method, by comparing the port traffic of each historical time period in multiple historical time periods and the traffic of each user flowing through the port (for example, calculating the difference), a sudden increase in user traffic can be accurately identified. For example, when the sum of user traffic far exceeds the port traffic, a large number of users compete for bandwidth, which meets the user traffic sudden increase. This method improves the accuracy of identifying user traffic sudden increase.

[0021] Optionally, the anomaly detection algorithm includes one or more of the following: a clustering-based local anomaly factor identification anomaly detection algorithm, a box plot anomaly detection algorithm, a lonely forest anomaly detection algorithm, a k-nearest neighbor anomaly detection algorithm, a minimum covariance determinant anomaly detection algorithm, and a first-class support vector machine anomaly detection algorithm.

[0022] Of course, the above are just examples and are not limited to these.

[0023] Optionally, judging whether the port traffic is abnormal based on the relationship between the first time period and the second time period includes: if the first time period and the second time period at least partially overlap, determining that the port traffic is abnormal.

[0024] In this method, a method for determining whether there is a flow anomaly is limited, thereby improving the reliability of this solution.

[0025] In the second aspect, the present application provides a traffic anomaly detection device, including: a determination module, used to determine that the port traffic of the port in a first time period reaches a limit value based on the statistical value of the port traffic in each historical time period in multiple historical time periods; determine that the user traffic of the port in the second time period has increased suddenly based on the statistical value of the port traffic in each historical time period in multiple historical time periods and the statistical value of each user traffic flowing through the port in each historical time period; a judgment module, used to judge whether the port traffic is abnormal based on the relationship between the first time period and the second time period.

[0026] Optionally, the device further includes: a receiving module, configured to receive an instruction from a user device before the determination module determines that the port flow of the port in the first time period reaches the limit value according to the port flow of each historical time period in multiple historical time periods, the instruction being used to request to perform flow anomaly detection on the port; an acquisition module, configured to acquire the statistical value of the port flow in each historical time period in the multiple historical time periods and the statistical value of each user flow according to the instruction;

[0027] Among them, multiple historical time periods are time periods within a preset time range from the current time; the statistical value of the port traffic of each historical time period is the maximum value of the port traffic at each moment in each historical time period; the statistical value of each user traffic in each historical time period is the maximum value of the user traffic of each user at each moment in each historical time period.

[0028] Optionally, the acquisition module is also used to periodically obtain the statistical values ​​of the port traffic and the statistical values ​​of each user traffic of the port reported by the gateway within a preset time period, and the preset time period is the length of each historical time period in the multiple historical time periods; or, the determination module is also used to: periodically count the statistical values ​​of the port traffic and the statistical values ​​of each user traffic of the port within a preset time period, and the preset time period is the length of each historical time period in the multiple historical time periods.

[0029] Optionally, when the determination module determines that the port flow of the port in the first time period reaches the limit value based on the port flow of the port in each historical time period among multiple historical time periods, it is specifically used to: sort the statistical values ​​of the port flow of the port in all historical time periods among the multiple historical time periods in order from large to small; determine the N time periods that are ranked in the first N positions, where N is a positive integer; when the statistical value of the port flow in the Nth time period is higher than a threshold, determine that the port flow of the port in these N time periods reaches the limit value, and the first time period is the set of these N time periods.

[0030] Optionally, the number of the multiple historical time periods is M, M is a positive integer, and N is 1% of M. Of course, this is only an example and is not limited to this.

[0031] Optionally, when the determination module determines that the user traffic of the port has suddenly increased in the second time period based on the port traffic of each historical time period in the multiple historical time periods and the individual user traffic flowing through the port in each historical time period, the determination module is specifically used to: calculate the sum of the statistical values ​​of all user traffic flowing through the port in each historical time period based on the statistical values ​​of each user traffic flowing through the port in each historical time period; calculate the difference between the sum of the statistical values ​​of all user traffic flowing through the port in each historical time period and the statistical value of the port traffic of the port in each historical time period; and determine that the user traffic of the port has suddenly increased in the second time period based on the difference corresponding to each historical time period.

[0032] Optionally, based on the difference corresponding to each historical time period, determining the sudden increase in user traffic of the port in the second time period includes: constructing a time series data based on an anomaly detection algorithm, the data corresponding to each time period in the time series data is the difference between the sum of the statistical values ​​of all user traffic flowing through the port in each time period and the statistical value of the port traffic of the port in each time period; each time period is each historical time period in multiple historical time periods; calculating the anomaly score of each time period according to the time series data, and determining the sudden increase in user traffic in each time period according to the anomaly score. The set of time periods corresponding to the top N anomaly scores is taken as the abnormal time period, i.e., the second time period.

[0033] Optionally, the anomaly detection algorithm includes one or more of the following: a clustering-based local anomaly factor identification anomaly detection algorithm, a box plot anomaly detection algorithm, a lonely forest anomaly detection algorithm, a k-nearest neighbor anomaly detection algorithm, a minimum covariance determinant anomaly detection algorithm, and a first-class support vector machine anomaly detection algorithm.

[0034] Of course, the above are just examples and are not limited to these.

[0035] Optionally, the judgment module is specifically used for:

[0036] If the first time period at least partially overlaps with the second time period, it is determined that the port traffic is abnormal.

[0037] In a third aspect, the present application provides an electronic device comprising at least one processor, wherein the at least one processor is configured to implement the method in the first aspect or any optional embodiment of the first aspect when executing a computer program stored in a memory.

[0038] In a fourth aspect, the present application provides a computer-readable storage medium for storing instructions, which, when executed, enables the method in the first aspect or any optional implementation of the first aspect to be implemented.

[0039] The technical effects or advantages of one or more technical solutions provided in the second, third, and fourth aspects of the embodiments of the present application can be correspondingly explained by the technical effects or advantages of one or more corresponding technical solutions provided in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 is a flow chart of a bandwidth limitation detection method;

[0041] Figure 2 is a flow chart of another bandwidth limitation detection method;

[0042] Figure 3 A flow chart of a method for detecting abnormal flow rates provided in an embodiment of the present application;

[0043] Figure 4 A structural diagram of a flow anomaly detection device provided in an embodiment of the present application;

[0044] Figure 5 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] The technical solution of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations on the technical solution of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0046] It should be understood that the term "multiple" in the description of the embodiments of the present application refers to two or more. The term "and / or" in the present embodiment is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the objects associated before and after are in an "or" relationship.

[0047] In various communication fields (including wired and wireless communications), the identification of bandwidth overlimit anomalies mainly relies on fixed threshold methods or monitoring of the number of ARP requests, download data speed, etc. Figure 1 , is a method flow for realizing bandwidth limitation detection. Figure 1 In the process shown, a trusted network interconnection protocol IP-Media Access Control (MAC) list is first established, an Address Resolution Protocol (ARP) request is sent to all hosts in the network, and the ARP reply messages received within a specified time are counted. When the number of messages exceeds the threshold specified by a preset policy, that is, the number of reply messages in the network exceeds a specified reasonable range, it indicates that there are a large number of false reply messages, and therefore it is judged that the bandwidth is limited; and further, a method for identifying the attack source IP is proposed.

[0048] However, the method of judging bandwidth overlimit anomalies by monitoring the number of ARP message requests and whether the download data speed reaches the threshold requires the device to send additional ARP messages or download data, occupying network resources and affecting device performance. In addition, the threshold needs to be set manually, and sudden changes require the creation of a manual maintenance work library, which is prone to misjudgment and missed judgment.

[0049] See also Figure 2 , is another method flow for realizing bandwidth limitation detection. Figure 2In the process shown, a. a predetermined amount of data is downloaded from the speed test website using the default bandwidth to obtain an initial bandwidth; b. the initial bandwidth is applied to the control by the load module and the flow control module; c. the existing bandwidth and the current maximum bandwidth are obtained according to the data flow; d. the average value of the existing bandwidth and the current maximum bandwidth is calculated, and it is determined whether to use the calculated average value as the initial bandwidth for bandwidth reset according to the calculated bandwidth and the change in the current bandwidth; e. the interval setting time is cyclically executed from step b to perform real-time bandwidth monitoring.

[0050] The above two methods can detect network bandwidth limitations. However, the user's bandwidth reaching the limit value does not necessarily mean that a bandwidth overlimit anomaly has occurred. If the bandwidth of the current network environment just meets the current user's needs, the user's Internet experience is not affected. At this time, the threshold-based anomaly detection method will cause misjudgment.

[0051] In view of this, a technical solution of an embodiment of the present application is provided to solve the problem of how to identify traffic anomalies.

[0052] The embodiments of the present application can be applied to any traffic anomaly detection scenario, for example, the port bandwidth overlimit detection scenario described above.

[0053] See also Figure 3 , is a flow chart of a traffic anomaly detection method provided in an embodiment of the present application. The execution subject of the method can be any electronic device with processing capabilities, such as an intelligent network operation and maintenance platform (specifically, it can be an operator's server, a third-party enterprise's server, etc.), or a cell gateway, etc. Taking the method applied to the intelligent network operation and maintenance platform as an example, the method includes steps S301 to S303:

[0054] S301, determining that the port traffic of the port in the first time period reaches a limit value according to the statistical value of the port traffic of each historical time period in multiple historical time periods;

[0055] The port may be a virtual port, such as a port of a switch or a router, or may be an interface serving as a physical port, which is not limited in the embodiments of the present application.

[0056] Port traffic is the traffic that flows through a port per unit time, including the traffic of all users that flow through the port per unit time. A user can be identified by a unique address, such as an IP address, MAC address, etc. When user traffic is identified by the user's IP address, user traffic can be called IP traffic.

[0057] The unit time may be, for example, 1 second, 2 seconds or 1 minute, etc., and this application does not impose any limitation.

[0058] It can be understood that the traffic flowing through the port in the embodiment of the present application can be uplink traffic (such as traffic sent by the user) or downlink traffic (such as traffic received by the user), and the embodiment of the present application does not limit this.

[0059] Exemplarily, determining that the port traffic of the port in the first time period reaches the limit value according to the statistical value of the port traffic in each historical time period in multiple historical time periods may include:

[0060] (1) sorting the statistical values ​​of port traffic in all historical time periods of the port in the order from largest to smallest;

[0061] The statistical value of the port traffic refers to collecting and counting the port traffic data in each time period at a preset time interval.

[0062] (2) Determine the N time periods ranked in the top N positions, where N is a positive integer;

[0063] (3) When the statistical value of the port traffic in the Nth time period is higher than the threshold, it is determined that the port traffic of the port in the N time periods reaches the limit value, and the first time period is the set of the N time periods.

[0064] The statistical value may include but is not limited to a maximum value, an average value, a median value, etc.

[0065] The threshold is determined according to the maximum value of the port traffic statistics in all historical time periods, for example, set to 90% of the maximum value of all port traffic statistics recorded in history.

[0066] It can be understood that the statistical value of the port traffic in the Nth time period is the minimum value of the port traffic statistical values ​​in the previous N time periods. If the port traffic statistical value in the Nth time period is higher than the threshold, it means that the port traffic statistical values ​​in the previous N time periods are all higher than the threshold, that is, the port traffic in the previous N time periods has reached the limit value.

[0067] Assume that the number of the multiple historical time periods is M, and M is a positive integer. M is greater than N, for example, N is one hundredth of M. Of course, the relationship between M and N here is only an example, and is not limited thereto.

[0068] For example, the total historical duration of statistics is 1000 minutes, and the maximum value of the port traffic is counted every 1 minute, then 0-1 minutes is the first historical time period, 1-2 minutes is the second historical time period, 2-3 minutes is the third historical time period... and so on, it can be seen that M=1000, and the maximum value of the port traffic corresponding to each time period in these 1000 time periods is sorted to obtain the top 1% of the values, then N=10.

[0069] When the maximum values ​​of the port flows corresponding to the 10 time periods are all higher than the threshold value (i.e., the maximum value of the port flows corresponding to the 10th time period is higher than the threshold value), if the 10 time periods are continuous time periods, for example, the 10 time periods are from the 1st historical time period to the 10th historical time period (i.e., minutes 0-10), it means that the port flow of the port has reached the limit value for a long time, and the first time period is the collection of the 1st historical time period to the 10th historical time period; if the 10 time periods are discontinuous, for example, the 10 time periods are the 1st historical time period, the 3rd historical time period, and the 30th-37th historical time periods, it means that the port flow of the port has reached the limit value for multiple times, and the first time period is the collection of the 1st historical time period, the 3rd historical time period, and the 30th-37th historical time periods.

[0070] When at least one of the maximum values ​​of the port traffic corresponding to the 10 time periods is lower than the threshold, it means that the port traffic of the port in the 10 time periods has not reached the limit value.

[0071] In this method, whether the port traffic has reached the limit value is judged based on the statistical values ​​of the port traffic in the first N time periods with the largest statistical values ​​of the port traffic. This can identify whether the port traffic has reached the limit value for a long time or multiple times, thereby improving the accuracy of identifying port traffic exceeding the limit.

[0072] S302, determining that the user traffic of the port in the second time period suddenly increases according to the statistical value of the port traffic in each historical time period in multiple historical time periods and the statistical value of each user traffic flowing through the port in each historical time period;

[0073] It can be understood that when a large number of users compete for bandwidth, the flow of each user will reach the peak value at different times, then drop rapidly, and then fluctuate repeatedly. The flow statistics data value of each user in the corresponding time period is also very large. Therefore, the embodiment of the present application compares the difference between the statistical value of the port flow of each historical time period in a plurality of historical time periods and the statistical value of all user flows flowing through the port in each historical time period. Because under normal circumstances, the sum of the statistical values ​​of the user flow should be close to the statistical value of the port flow, if there is a sudden increase in user flow, (i.e., the flow of different users reaches the peak value successively in a historical time period), the statistical value of each user flow flowing through the port is very large, and generally speaking, the port flow through the port in a unit time is limited, that is, the statistical value of the port flow has an upper limit, so if there is a situation where the sum of the statistical values ​​of all user flows far exceeds the statistical value of the port flow, it can be judged that there is a sudden increase in user flow on the port.

[0074] In a specific embodiment, the user traffic is the IP traffic flowing through the port, and the statistical value is the maximum value. As the port traffic passing through the port in each time period is limited, that is, the statistical value of the port traffic in each time period has an upper limit. Under normal circumstances, the difference between the sum of the maximum values ​​of all user IP traffic flowing through the port in each time period and the maximum value of the port traffic should remain stable; however, if users compete for bandwidth, that is, in a historical time period, at one moment, the IP traffic of a certain user is very large, and the IP traffic of other users is very small, and at the next moment, the IP traffic of another user is very large, and the IP traffic of other users is very small, and so on, it can be known that when counting the maximum value of each user's IP traffic in the historical time period, the maximum value of the IP traffic will be counted as the statistical value, and the statistical values ​​obtained by the statistics are all very large, which leads to the sum of the maximum values ​​of all user IP traffic being also very large, far exceeding the maximum value of the port traffic.

[0075] For example, during a historical time period (assuming that the historical time period includes two historical moments), the maximum value of the port traffic is 50 Mbps. At the first historical moment, the IP traffic of user 1 is 40 Mbps, and the IP traffic of user 2 is 10 Mbps. At the second historical moment, the IP traffic of user 1 is 0 Mbps, and the IP traffic of user 2 is 50 Mbps. During the historical time period, the maximum value of the IP traffic of user 1 is 40 Mbps, and the maximum value of the IP traffic of user 2 is 50 Mbps. The sum of the maximum values ​​of the IP traffic of all users in the historical time period is 90 Mbps, which is far higher than the maximum value of the port traffic, that is, a sudden increase in user IP traffic has occurred.

[0076] Exemplarily, determining that the user traffic of the port in the second time period increases suddenly according to the port traffic of each historical time period in multiple historical time periods and each user traffic flowing through the port in each historical time period may include:

[0077] According to the statistical value of each user flow passing through the port in each historical time period, the total statistical value of all the user flows passing through the port in each historical time period is calculated;

[0078] Determine and calculate the difference between the sum of the statistical values ​​of all the user traffic flowing through the port in each historical time period and the statistical value of the port traffic of the port in each historical time period;

[0079] The difference corresponding to each historical time period in the multiple historical time periods is calculated based on the anomaly detection algorithm, and the sudden increase of the user traffic of the port in the second time period is determined according to the calculation result.

[0080] In the specific implementation process, the anomaly detection algorithm includes but is not limited to one or more of the following:

[0081] The following is an introduction to the above anomaly detection algorithms:

[0082] 1. Cluster-based Local Outlier Factor (CBLOF) anomaly detection algorithm. The basic idea of ​​the CBLOF algorithm is that data may gather in multiple different places to form clusters. We distinguish large and small clusters based on the size of the cluster. The closer a point is to a large cluster, the higher the probability of it being a normal point. Conversely, when a point is far away from a large cluster, the lower the probability of it being a normal point. The first step of the CBLOF algorithm is clustering. Here we use the k-means clustering algorithm for clustering. We distinguish large and small clusters based on two principles: the absolute logarithm principle and the sudden drop principle. The absolute logarithm principle means that we arrange these clusters from large to small according to the number of samples in the cluster. Starting from the largest cluster, add up the number of samples in their clusters in order, and the number of large clusters must reach the absolute majority of the total number of samples. And this absolute majority is a parameter α that can be set, and its value range is 0.5 to 1. The sudden drop principle refers to whether the number of cluster samples arranged by size has a sudden drop. If a sudden drop occurs, it is the dividing line between large and small clusters. We use the multiple β to measure it. The second step of the algorithm is to calculate the local outlier factor (LOF), which is the distance from a point to the nearest large cluster. If this point is a point in a large cluster, just calculate its distance to the center of the cluster. If this point is not a point in a large cluster, calculate its distance to all large clusters separately and select the smallest one as the factor.

[0083] 2. Box-plot anomaly detection algorithm. Box-plot is mainly used to reflect the center position and distribution range of one or more groups of continuous quantitative data. The box-plot is a graphical description formed by the quartiles of the data set. The upper and lower whiskers are the boundaries of the data distribution. Any data point that is higher than the upper whisker or lower than the lower whisker is considered an outlier or anomaly. The lower quartile represents the value corresponding to the 25% quantile (Q1), the upper quartile represents the value corresponding to the 75% quantile (Q3), the upper whisker represents Q3+1.5 (Q3-Q1), and the lower whisker represents Q1-1.5 (Q3-Q1).

[0084] 3. Isolation Forest (iForest) anomaly detection algorithm. Among all sample data, abnormal data has the characteristics of being small in number and different from most data. By using this characteristic to split samples, those abnormal data can also be easily isolated and processed. In terms of statistics, in the data space, sparsely distributed areas indicate that the probability of data occurring in this area is very low, so it can be considered that the data falling in these areas is abnormal. The iForest algorithm benefits from the idea of ​​random forest. Just as random forest is composed of a large number of decision trees, iForest is also composed of a large number of binary trees, which is a completely random process. Assuming that the data set has N data, when building a binary tree, n samples are uniformly sampled from the N data as training samples for the tree. In the sample, a feature is randomly selected, and a value is randomly selected from the range of all values ​​of this feature (between the minimum and maximum values), and the sample is binary divided, and the samples with values ​​less than the value are divided to the left of the node, and the samples with values ​​greater than or equal to the value are divided to the right of the node. Thus, a splitting condition and the left and right data sets are obtained, and then the above process is repeated on the left and right data sets respectively until the data set has only one record or the limited height of the tree is reached. Since the abnormal data is small and the eigenvalues ​​are very different from the normal data. Therefore, when constructing a binary tree, the abnormal data is closer to the root, while the normal data is farther from the root. The results of a binary tree are generally unreliable. The iForest anomaly detection algorithm constructs multiple binary trees through multiple sampling. Finally, the results of all trees are integrated, and the average depth is taken as the final output depth, thereby calculating the anomaly score of the data point.

[0085] 4. k-nearest neighbor anomaly detection algorithm. The idea of ​​the k-nearest neighbor algorithm is that a sample is most similar to k samples in the data set. If most of these k samples belong to a certain category, then the sample also belongs to a certain category. The advantage of the k-nearest neighbor algorithm in detecting outliers in time series data is that it has a short training time, no assumptions about the data, and high accuracy. The k-nearest neighbor anomaly detection algorithm is mainly divided into three steps. The first step is to calculate the distance between the current point and each sample point in the data set for each sample point in the data set. The distance is usually measured using the Euclidean distance. Calculate, where x1 is the sample point in the data set and x2 is the current point. The second step is to sort all the distances obtained from small to large, the smaller the distance, the more similar it is. The third step is to take the first k sample data and take the average of the distances as the anomaly score.

[0086] 5. Minimum Covariance Determinan (MCD) anomaly detection algorithm. The basic idea of ​​the MCD algorithm is as follows: Consider a matrix X with n rows and p columns n×p, randomly select h sample data from it, and calculate the sample mean T1 and covariance matrix S1 of these h sample data. Then through Among them, x i is the sample data. Calculate the Mahalanobis distances from these n sample data to the center T1, select the smallest h of these n distances, and then calculate the sample mean T2 and covariance matrix S2 through these h samples. At this time, we will have det(S2)≤det(S1), and the equality holds if and only if T1=T2, S1=S2. This iteration continues, and when det(S m )=det(S m-1 ) stops the iteration. Then pass S m By performing weighted calculation, a robust covariance matrix estimator can be obtained. The graph shows that the super ellipsoid with the shortest distance to the sample center containing h sample points is constantly sought, while the remaining nh sample points are excluded from the super ellipsoid.

[0087] 6. One-Class SVM (OCSVM) anomaly detection algorithm. The core idea of ​​the OCSVM algorithm is to find a hyperplane to circle the positive examples in the sample, and make decisions on the samples through this hyperplane. The samples in the circle are considered to be positive samples. Assume that the parameters of the generated hypersphere are the center o and the corresponding hypersphere radius r>0, the hypersphere volume V(r) is minimized, and the center o is a linear combination of the support lines; similar to the traditional support vector machine (SVM) method, it can be required that all training data points x i The distance to the center is strictly less than r. But at the same time, a slack variable ξ with a penalty coefficient C is constructed i , the optimization problem is shown as follows:

[0088]

[0089] ‖x i -o‖2≤r+ξ i ,i=1,2,3,…,m

[0090] ξ i ≥0,i=1,2,…,m

[0091] Among them, x i is the sample data.

[0092] After solving the Lagrangian duality, we can determine whether the new data point z is inside the hypersphere. If the distance from z to the center is less than or equal to the radius r, it is not an outlier. If it is outside the hypersphere, it is an outlier.

[0093] It can be understood that the above examples are only examples and are not limited to these.

[0094] Take Lonely Forest as an anomaly detection algorithm as an example:

[0095] Construct a time series data, where the corresponding data of each time period is the difference between the sum of all user traffic flowing through the port in that time period and the port traffic of the port;

[0096] According to the time series data, 100 binary trees are constructed. The average depth of each time point is taken as the final output depth, and the output depth is used as the anomaly score of the time period. All anomaly scores are sorted from large to small, and the data corresponding to the top N anomaly scores are used as the anomaly time period, that is, the second time period.

[0097] In this method, the port traffic of each historical time period in multiple historical time periods and the traffic of each user flowing through the port are compared (for example, the difference is calculated), and a sudden increase in user traffic can be accurately identified. For example, when the sum of user traffic far exceeds the port traffic, a large number of users compete for bandwidth, which meets the user traffic sudden increase. This method improves the accuracy of identifying user traffic sudden increase.

[0098] S303: Determine whether the port traffic is abnormal based on the relationship between the first time period and the second time period.

[0099] In a possible implementation, if the first time period at least partially overlaps with the second time period, that is, there is a situation in which the port traffic reaches the limit value and the user traffic increases suddenly in at least part of the time period, then it is determined that the port traffic is abnormal.

[0100] Optionally, it may also be determined that the port flow of the port in the first time period reaches the limit value specifically because the port flow reaches the limit value multiple times or for a long time;

[0101] Optionally, it may also be determined that the sudden increase in user traffic of the port in the second time period is specifically caused by users competing for bandwidth.

[0102] If the first time period completely overlaps with the second time period, it can be determined that the port has a bandwidth over limit anomaly. Optionally, it can be determined that the port has a bandwidth over limit anomaly during the time period when the first time period and the second time period overlap.

[0103] For example, if the first time period is the 3rd, 4th, 6th and 10th historical time periods among all historical time periods; and the second time period is the 3rd, 4th, 6th and 10th historical time periods among all historical time periods; then the first time period completely overlaps with the second time period, and therefore it is determined that bandwidth overlimit anomalies occur in the 3rd, 4th, 6th and 10th historical time periods;

[0104] If the first time period partially overlaps with the second time period, it is determined that the port has a bandwidth overlimit anomaly. Optionally, it may be determined that the port has a bandwidth overlimit anomaly during the time period when the first time period overlaps with the second time period.

[0105] For example, if the first time period is the 3rd, 4th, 6th and 10th historical time periods of all historical time periods; the second time period is the 4th, 5th, 6th and 12th historical time periods of all historical time periods; then the overlapping parts of the first time period and the second time period are the 4th and 6th historical time periods, that is, the first time period and the second time period partially overlap, so it is determined that the bandwidth exceeds the limit abnormality of the port in the 4th and 6th historical time periods;

[0106] In another possible implementation, if the first time period does not overlap with the second time period, that is, there is no situation where the port traffic reaches the limit value and the user traffic suddenly increases, it is determined that there is no bandwidth exceeding exception on the port.

[0107] For example, if the first time period is the 1st historical time period, the 3rd historical time period, the 6th historical time period, and the 10th historical time period among all historical time periods; and the second time period is the 2nd historical time period, the 4th historical time period, the 7th historical time period, and the 12th historical time period among all historical time periods; then the first time period does not overlap with the second time period, and therefore it is determined that there is no bandwidth exceeding abnormality on the port.

[0108] When the first time period does not overlap with the second time period, it can be determined whether the port traffic is abnormal according to actual needs.

[0109] Example 1: If the port does not have bandwidth exceeding the limit, the port traffic is normal.

[0110] Example 2: The port does not have an abnormality of bandwidth exceeding the limit, and the port traffic abnormality can also be determined. In this case, the port traffic abnormality specifically includes: the port traffic of the port in the first time period reaches the limit value, or the user traffic of the port in the second time period increases suddenly.

[0111] In this manner, a method for determining whether a port has an abnormal bandwidth exceeding limit is defined, thereby improving the reliability of this solution.

[0112] Through the above scheme, port traffic overlimit is identified based on historically collected port traffic, and user traffic surge is identified based on historically collected user traffic, and the port traffic is judged to be abnormal (such as bandwidth overlimit) by matching the time when the port traffic reaches the limit value and the time when the user traffic surges, so as to improve the accuracy of traffic anomaly detection. The method can also accurately identify the abnormal time point (i.e., the time point when the first time period coincides with the second time period), and then during network operation and maintenance, it can help technicians quickly locate the cause of network packet loss and increased delay, and improve operation and maintenance efficiency. The method can be done without manual participation throughout the process, which can not only improve the anomaly detection efficiency, but also reduce labor costs. In addition, the detection of this method is based on historical data of traffic, without occupying additional network resources. It can be seen that the above method has many characteristics such as high anomaly identification accuracy, low deployment difficulty, no need to occupy additional network resources, and low cost, which is of great significance to the development of intelligent operation and maintenance.

[0113] In a possible implementation, the above steps S101 to S103 may be performed periodically at a certain time interval, for example, once every 5 minutes.

[0114] In another possible implementation, the above steps S101 to S103 may be triggered based on user needs.

[0115] Exemplarily, before determining that the port flow of the port in the first time period reaches the limit value according to the port flow of the port in each historical time period in multiple historical time periods, the method further includes:

[0116] Receive an instruction from a user device, the instruction is used to request to perform traffic anomaly detection on a port, obtain the statistical value of port traffic and the statistical value of each user traffic in each historical time period in multiple historical time periods according to the instruction, and execute the above S101 to S103.

[0117] For example, when a user finds that the network is stuck, the user inputs monitoring instructions through the software on a personal device (such as a mobile phone, tablet, computer, etc.), and the personal device sends the instructions to the cloud.

[0118] The multiple historical time periods may specifically be time periods within a preset time range from the current time, such as 1 hour or 1 day.

[0119] The statistical value of the port traffic in each historical time period includes, but is not limited to, a maximum value, an average value, or a median value of the port traffic at each moment in each time period.

[0120] For example, among the three historical time periods, the port traffic collected in the first historical time period is 5Mbps, 10Mbps, 8Mbps, and 9Mbps; the port traffic collected in the second historical time period is 7Mbps, 2Mbps, 6Mbps, and 4Mbps; the port traffic collected in the third historical time period is 5Mbps, 6Mbps, 8Mbps, and 3Mbps; taking the maximum value as the statistical value, the statistical value of the port traffic in the first time period is 10Mbps, the statistical value of the port traffic in the second time period is 7Mbps, and the statistical value of the port traffic in the third time period is 8Mbps.

[0121] Taking the user traffic as IP traffic as an example, the statistical value of the IP traffic in each historical time period is taken as the maximum value of the IP traffic corresponding to a single IP at each moment in each historical time period;

[0122] For example, there are three IPs flowing through the port in two historical time periods. In the first historical time period, the collected traffic of the first IP is 1Mbps, 2Mbps, 0Mbps, 1Mbps; the traffic of the second IP is 0Mbps, 3Mbps, 0Mbps, 2Mbps; the traffic of the third IP is 1Mbps, 1Mbps, 0Mbps, 2Mbps; in the second historical time period, the collected traffic of the first IP is 3Mbps, 0Mbps, 0Mbps, 0Mbps; the traffic of the second IP is 2Mbps, 1Mbps, 2Mbps, 1Mbps; the traffic of the third IP is 1Mbps, 1Mbps, 0Mbps, 2Mbps; then in the first historical time period, the statistical value of the first IP traffic is 2Mbps, the statistical value of the second IP traffic is 3Mbps, and the statistical value of the third IP traffic is 2Mbps; in the second historical time period, the statistical value of the first IP traffic is 3Mbps, the statistical value of the second IP traffic is 2Mbps, and the statistical value of the third IP traffic is 2Mbps.

[0123] Of course, the above statistical values ​​are only examples and are not limited to these.

[0124] In this way, it is possible to trigger anomaly detection execution based on user needs, with rapid response and high efficiency.

[0125] Optionally, in order to ensure that the network intelligent operation and maintenance platform can obtain the statistical value of the port traffic and the statistical value of each user traffic in each historical time period among multiple historical time periods, the gateway can periodically collect the statistical value of the port traffic and the statistical value of each user traffic of the port within a preset time period and report the collected data to the network intelligent operation and maintenance platform. Correspondingly, the network intelligent operation and maintenance platform periodically receives the statistical value of the port traffic and the statistical value of each user traffic of the port within the preset time period reported by the gateway. Among them, the preset time period is the length of a single historical time period among multiple historical time periods;

[0126] For example, the gateway periodically collects traffic statistics passing through the port and traffic statistics of each user within a fixed time period, and the data can also be reported to the cloud.

[0127] Alternatively, the gateway reports the original data (such as the port traffic and user traffic of the port within a preset time), and the network intelligent operation and maintenance platform periodically counts the statistical value of the port traffic within the preset time and the statistical value of each user traffic;

[0128] For example, the gateway periodically collects all traffic data passing through the port and all traffic data of each user within a fixed time period, reports the data to the cloud, and the cloud performs data statistics.

[0129] Of course, the above two methods are only examples and are not limited to them.

[0130] For ease of understanding, the following uses several specific examples to introduce the technical solutions of the embodiments of the present application when the port has an abnormal bandwidth over limit and when the port has no abnormal bandwidth over limit. Take the user traffic as IP traffic as an example.

[0131] Example 1: The port has an exception of bandwidth exceeding the limit:

[0132] The gateway collects the maximum value of the port traffic and the maximum value of all IP traffic flowing through the port every 5 minutes.

[0133] When users find that the network is stuck, they use a computer application to send network anomaly detection instructions to the cloud;

[0134] After receiving the command, the cloud obtains the maximum port flow of the port connected to the user end and the maximum value of all IP flows flowing through the port in the 300 historical time periods before the network freeze occurs;

[0135] The maximum port traffic values ​​in the 300 historical time periods before the network freeze were sorted in descending order, and the top three maximum port traffic values ​​were 16Mbps, 15Mbps, and 15Mbps. The corresponding first time periods were the 216th historical time period, the 188th historical time period, and the 6th historical time period, and the range of the port maximum values ​​was 15Mbps-16Mbps. Since the range was higher than the threshold of 14.4Mbps (90% of the maximum values ​​of all ports), it means that the port traffic has reached the limit value;

[0136] Calculate the difference between the sum of the maximum values ​​of all IP traffic flowing through the port in each of the 300 historical time periods before the network freeze and the maximum value of the port traffic in the corresponding time period. Detect the difference with a sudden increase based on the anomaly detection algorithm and determine the corresponding second time period. The detection results are the 6th historical time period, the 43rd historical time period, and the 157th historical time period.

[0137] Comparing the first time period with the second time period, the overlapping time period is the sixth historical time period, that is, the first time period and the second time period partially overlap, and the bandwidth exceeds the limit abnormality on the port in the sixth historical time period.

[0138] Example 2: The port does not have an exception of bandwidth exceeding the limit:

[0139] The gateway collects the maximum value of the port traffic and the maximum value of all IP traffic flowing through the port every 5 minutes.

[0140] When the user finds that the network is stuck, he uses a computer application to send a network anomaly detection command to the cloud;

[0141] After receiving the command, the cloud obtains the maximum port flow of the port connected to the user end and the maximum value of all IP flows flowing through the port in the 300 historical time periods before the network freeze occurs;

[0142] The maximum port traffic values ​​in the 300 historical time periods before the network freeze were sorted in descending order, and the top three maximum port traffic values ​​were 16Mbps, 13Mbps and 14Mbps. The corresponding first time periods were the 216th historical time period, the 188th historical time period and the 6th historical time period, respectively. The range of the port maximum value was 13Mbps-16Mbps, and there was a part below the threshold value of 14.4Mbps (90% of the maximum value of all ports), indicating that the port traffic did not reach the limit value and the port did not have any bandwidth exceeding exception.

[0143] Example 3: The port does not have bandwidth exceeding the limit exception:

[0144] The gateway collects the maximum value of the port traffic and the maximum value of all IP traffic flowing through the port every 5 minutes.

[0145] When the user finds that the network is stuck, he uses a computer to send a network anomaly detection command to the cloud through an application;

[0146] After receiving the command, the cloud obtains the maximum port flow of the port connected to the user end and the maximum value of all IP flows flowing through the port in the 300 historical time periods before the network freeze occurs;

[0147] The maximum port traffic values ​​in the 300 historical time periods before the network freeze were sorted in descending order, and the top three maximum port traffic values ​​were 16Mbps, 15Mbps, and 15Mbps. The corresponding first time periods were the 216th historical time period, the 188th historical time period, and the 6th historical time period. The maximum port value range was 15Mbps-16Mbps, which was higher than the threshold value of 14.4Mbps (90% of the maximum value of all ports), indicating that the port traffic reached the limit value.

[0148] Calculate the difference between the sum of the maximum values ​​of all IP traffic flowing through the port in each of the 300 historical time periods before the network freeze and the maximum value of the port traffic in the corresponding time period. Detect the difference with a sudden increase based on the anomaly detection algorithm, and determine the abnormal IP and the corresponding second time period. The detection results are for the 7th historical time period, the 43rd historical time period, and the 157th historical time period.

[0149] Comparing the first time period with the second time period, there is no overlapping time period, and the port does not have any bandwidth exceeding the limit exception.

[0150] The method provided by the embodiment of the present application is introduced above, and the device provided by the embodiment of the present application is introduced below.

[0151] See also Figure 4 An embodiment of the present application provides a traffic anomaly detection device, which includes a module / unit / technical means for executing the method performed by the intelligent network operation and maintenance platform in the above method embodiment.

[0152] Exemplarily, the device 400 includes:

[0153] The determination module 401 is used to determine that the port flow of the port in the first time period reaches the limit value according to the statistical value of the port flow in each historical time period in multiple historical time periods; determine that the user flow of the port in the second time period increases suddenly according to the statistical value of the port flow in each historical time period in multiple historical time periods and the statistical value of each user flow flowing through the port in each historical time period;

[0154] The judgment module 402 is used to judge whether the port traffic is abnormal according to the relationship between the first time period and the second time period.

[0155] Optionally, the device also includes: a receiving module 403, which is used to receive a traffic anomaly detection instruction from a user device and perform traffic anomaly detection on the port according to the instruction request; an acquisition module 404, which periodically obtains the statistical values ​​of the port traffic and the statistical values ​​of each user traffic reported by the gateway within a preset time period, and the preset time period is the length of each time period in the multiple historical time periods.

[0156] Optionally, the determination module 401 may also be configured to periodically count the statistical value of the port traffic and the statistical value of each user traffic of the port within a preset time period, where the preset time period is the length of each time period in the multiple historical time periods.

[0157] Optionally, when the determination module 401 determines that the port traffic of the port in the first time period reaches the limit value based on the statistical value of the port traffic in each historical time period in multiple historical time periods, it is specifically used to: sort the statistical values ​​of all port traffic of the port in multiple historical time periods in order from large to small; determine the N time periods that are ranked in the first N positions, where N is a positive integer; when the statistical value of the port traffic corresponding to the Nth time period is higher than a threshold, determine that the port traffic of the port in N time periods exceeds the limit value, and the first time period is the set of the N time periods; the threshold is determined according to the maximum value of the statistical value of the port traffic in all multiple historical time periods.

[0158] Optionally, when determining that the user traffic of the port suddenly increases in the second time period based on the statistical value of the port traffic in each historical time period of multiple historical time periods and the statistical value of each user traffic flowing through the port in each historical time period, the determination module 401 is specifically used to: calculate the sum of the statistical values ​​of all user traffic flowing through the port in each historical time period based on the statistical values ​​of each user traffic flowing through the port in each historical time period; calculate the difference between the sum of the statistical values ​​of all user traffic flowing through the port in each historical time period and the statistical value of the port traffic of the port in each historical time period; and determine the second time period in which the user traffic suddenly increases at the port based on the difference corresponding to each historical time period.

[0159] Optionally, the determination module 401 is further used to determine the second time period in which a sudden increase in user traffic occurs at the port based on the difference corresponding to each historical time period and to: construct a time series data based on an anomaly detection algorithm, the data corresponding to each time period in the time series data being the difference between the sum of the statistical values ​​of all user traffic flowing through the port in each time period and the statistical value of the port traffic of the port in each time period; each time period is a historical time period among multiple historical time periods; the anomaly score of each time period is calculated according to the time series data, and the sudden increase in user traffic in each time period is determined according to the anomaly score; and the set of time periods corresponding to the top N items ranked by anomaly scores is taken as the abnormal time period, i.e., the second time period.

[0160] Optionally, when judging whether the port traffic is abnormal according to the relationship between the first time period and the second time period, the judging module 402 is specifically configured to: determine that the port traffic is abnormal if the first time period at least partially overlaps with the second time period.

[0161] It should be understood that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0162] As a possible product form of the above device, see Figure 5 The embodiment of the present application further provides an electronic device 500, including:

[0163] At least one processor 501; and a communication interface 503 that is communicatively connected to the at least one processor 501; the at least one processor 501 executes instructions stored in the memory 502, so that the electronic device 500 executes the method steps performed by the network intelligent operation and maintenance platform in the above method embodiment through the communication interface 503.

[0164] Optionally, the memory 502 is located outside the electronic device 500 .

[0165] Optionally, the electronic device 500 includes the memory 502, the memory 502 is connected to the at least one processor 501, and the memory 502 has instructions that can be executed by the at least one processor 501. Figure 5 The dashed lines indicate that the memory 502 is optional for the electronic device 500 .

[0166] The at least one processor 501 and the memory 502 may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0167] The specific connection medium between the at least one processor 501, the memory 502 and the communication interface 503 is not limited in the embodiment of the present application. Figure 5The connection between other components is only for schematic illustration and is not intended to be limiting. The bus part can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 It is represented by only one thick line, but it does not mean that there is only one bus or one type of bus.

[0168] It should be understood that the processor mentioned in the embodiments of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor implemented by reading software code stored in a memory.

[0169] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0170] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both a volatile memory and a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct RAM bus random access memory (DR RAM).

[0171] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0172] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0173] As another possible product form, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps performed by any device in the above method example.

[0174] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0175] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0176] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0177] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0178] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting flow anomaly, characterized in that: include: According to the statistical value of the port traffic of each historical time period of the port in multiple historical time periods, determine that the port traffic of the port in the first time period reaches the limit value; wherein the port traffic is the traffic passing through the port in unit time; Determine that the user traffic of the port in the second time period suddenly increases according to the statistical value of the port traffic in each historical time period in the multiple historical time periods and the statistical value of each user traffic flowing through the port in each historical time period; wherein the user traffic is the traffic of a single user passing through the port in unit time; Whether the port traffic is abnormal is determined according to the relationship between the first time period and the second time period.

2. The method according to claim 1, characterized in that Also includes: Receiving an instruction from a user device, the instruction being used to request to perform traffic anomaly detection on the port; Obtaining, according to the instructions, the statistical value of the port traffic and the statistical value of each user traffic in each historical time period in a plurality of historical time periods; The multiple historical time periods are time periods within a preset time range from the current time; The current time is the time when the user equipment instruction is received; The statistical value of the port flow in each historical time period is the maximum value of the port flow at each moment in each historical time period; The statistical value of the traffic of each user in each historical time period is the maximum value of the user traffic of each user at each moment in each historical time period.

3. The method according to claim 1, characterized in that The method further comprises: Periodically receiving the statistical value of the port traffic and the statistical value of each user traffic of the port within a preset time period reported by the gateway, wherein the preset time period is the length of each historical time period in the multiple historical time periods; or, The statistical value of the port traffic and the statistical value of each user traffic of the port within a preset time period are periodically counted, and the preset time period is the time period of each historical time period in the multiple historical time periods.

4. The method according to any one of claims 1 to 3, characterized in that: The determining, based on the port flow of the port in each historical time period in a plurality of historical time periods, that the port flow of the port in the first time period reaches the limit value comprises: Sorting the statistical values ​​of all port traffic of the port in multiple historical time periods in descending order; Determine N time periods ranked in the first N positions, where N is a positive integer; when the statistical value of the port traffic corresponding to the Nth time period is higher than a threshold, determine that the port traffic of the port in the N time periods reaches a limit value, and the first time period is a set of the N time periods; The threshold is determined according to a maximum value of the statistical values ​​of the port traffic in the multiple historical time periods.

5. The method according to any one of claims 1 to 3, characterized in that: The determining, based on the port traffic of the port in each historical time period in the multiple historical time periods and the traffic of each user flowing through the port in each historical time period, that the user traffic of the port in the second time period suddenly increases includes: Calculating the sum of the statistics of all user flows flowing through the port in each historical time period according to the statistics of each user flow flowing through the port in each historical time period; Determine and calculate the difference between the sum of the statistical values ​​of all user traffic flowing through the port in each historical time period and the statistical value of the port traffic of the port in each historical time period; Based on the difference corresponding to each historical time period, a second time period in which a sudden increase in user traffic occurs at the port is determined.

6. The method according to claim 5, characterized in that The determining, based on the difference corresponding to each historical time period, a second time period in which a sudden increase in user traffic occurs at the port comprises: A time series data is constructed based on the anomaly detection algorithm, wherein the data corresponding to each time period in the time series data is the difference between the sum of the statistical values ​​of all user traffic flowing through the port in each time period and the statistical value of the port traffic of the port in each time period; each time period is each historical time period in a plurality of historical time periods; An abnormality score for each time period is calculated according to the time series data, and a sudden increase in user traffic in each time period is determined according to the abnormality score; a set of time periods corresponding to the top N items of the abnormality score ranking is taken as an abnormal time period, i.e., a second time period.

7. The method according to any one of claims 1 to 3, characterized in that: Determining whether the port traffic is abnormal according to the relationship between the first time period and the second time period includes: If the first time period at least partially overlaps with the second time period, it is determined that the port traffic is abnormal.

8. A flow anomaly detection device, characterized in that: include: A determination module, configured to determine, based on a statistical value of the port traffic of the port in each historical time period in a plurality of historical time periods, that the port traffic of the port in the first time period reaches a limit value; Determine, based on the statistical value of the port traffic of the port in each historical time period in the multiple historical time periods and the statistical value of each user traffic flowing through the port in each historical time period, that the user traffic of the port in the second time period increases suddenly; The judging module is used to judge whether the port traffic is abnormal according to the relationship between the first time period and the second time period.

9. An electronic device, characterized in that: The electronic device comprises at least one processor, and the at least one processor is configured to implement the method according to any one of claims 1 to 7 when executing a computer program stored in a memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 7 is implemented.

Images