Traffic data statistical analysis method and system based on large model

Abstract

The present invention proposes a traffic data statistical analysis method, system and computer program product based on a large model, which belongs to the field of computer network security and data analysis technology. The method includes: obtaining the resource set currently requested by the client; identifying the resources to be counted and the clients to be checked; analyzing the traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resources to be counted within a preset time period; the large model outputs a security screening result for the clients to be checked; based on the security screening result, security measures are executed for subsequent resource requests of the clients to be checked. The system includes a cloud server. The solution of the present invention can use the existing large model based on network security to identify network fraud, malicious traffic and disguised attack data streams for the deceptive data of the client, thereby improving the value of the statistical results of the traffic data analysis and avoiding delays and blockages in cloud resource services.

Description

Technical Field

[0001] The present invention belongs to the field of computer network security and data analysis technology, and in particular relates to a traffic data statistical analysis method and system based on a large model, a computer-readable storage medium, a computer program product, and an electronic device for implementing the method. Background Art

[0002] As the internet continues to expand, cybersecurity issues are facing greater pressure and challenges. The diversity of network environments is also increasing, and the emergence of new network environments such as cloud computing, the Internet of Things, and edge computing has posed new challenges to the already increasingly severe cybersecurity situation.

[0003] As an important proactive network security strategy, network traffic anomaly detection technology has been gradually applied to network security protection. By analyzing network traffic data, identifying instances of abnormal traffic, and promptly detecting attacks, network administrators can provide real-time decision-making support, thereby improving overall network security and stability. For example, a Chinese patent publication (CN117749426A) proposes a graph neural network-based anomaly traffic detection method. Based on the detection results of abnormal network traffic, it can generate security alerts or provide decision support, helping network security managers quickly respond to potential network security issues and develop response strategies.

[0004] However, with the full encryption of network traffic loads, encrypted transmission technology has become one of the methods for malicious traffic to evade detection. For client requests for encrypted transmission, traditional abnormal traffic monitoring methods have too small sample sizes and low accuracy. In addition, the indicator for abnormal traffic detection lies in the "high-speed traffic characteristics", but a new trend has emerged in current network data attacks, namely low-rate attacks. By generating low-rate attack traffic that can be hidden in normal transmission control protocols, and at the same time utilizing the adaptive mechanism of the network protocol, false congestion is caused in the network, damaging the connection quality between the client and the server, making it impossible for the server to provide normal services to users. This type of attack is more covert and difficult to detect because they use low-rate attack traffic, which is enough to occupy the key resources of the target system, but not enough to trigger traditional abnormal traffic detection mechanisms. Especially in a cloud computing environment, if such an attack end is hidden in multiple client clusters, it will take advantage of the characteristics of shared resources in the cloud computing environment and affect multiple tenants or users by occupying shared resources, resulting in significant delays and blockages in cloud resource services. Summary of the Invention

[0005] In response to the above technical problems, the technical solution of the present invention can utilize the existing large-scale model based on network security to identify network fraud, malicious traffic and disguised attack data streams for the client's deceptive data, thereby improving the value of the statistical results of traffic data analysis and avoiding delays and blockages in cloud resource services.

[0006] In the first aspect of the present invention, a traffic data statistical analysis method based on a large model is proposed, wherein the method is applied to a cloud server, and the cloud server is connected to N clients {R1, R2, ..., R N} Remote communication, N>1;

[0007] The method applied to the cloud server includes the following steps S100-S500:

[0008] S100: Get client R i The resource set S currently being requested i , i=1,2,…,N; resource set S i Contains at least one requested resource;

[0009] S200: When more than a predetermined proportion T of the resource sets currently requested by the clients all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted; the predetermined proportion T is ≥ 50%.

[0010] S300: Analyzing traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resource to be counted within a preset time period;

[0011] S400: Using the traffic transmission feature, network text feature, and / or encryption feature as data input to a network security-based big model, the network security-based big model outputting a security screening result for each of the clients exceeding the predetermined ratio;

[0012] S500: Based on the security check result, the cloud server executes security measures for subsequent resource requests from each of the clients exceeding the predetermined proportion, the security measures including current limiting, service interruption, or service maintenance.

[0013] The requested resource in step S100 includes a combination of at least two of the following resources:

[0014] CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources.

[0015] The step S300 specifically includes:

[0016] For each resource to be counted, perform the following analysis process:

[0017] S301: Determine whether the client request for the resource to be counted is encrypted;

[0018] If yes, proceed to step S303, otherwise proceed to step S302;

[0019] S302: Obtaining traffic transmission characteristics and network text characteristics of the resource to be counted within a preset time period;

[0020] S303: Obtain traffic transmission characteristics and encryption characteristics of the resource to be counted within a preset time period.

[0021] In the second aspect of the present invention, a traffic data statistical analysis method based on a large model is proposed, which is applied to N request clients {R1, R2, ..., R N}; the N requesting clients {R1, R2, ..., R N} remotely communicate with a cloud server, the method comprising the following steps:

[0022] SS100: Client R i Sending a client request to the cloud server, wherein the client request is used to schedule a requested resource to the cloud server; the requested resource includes a combination of at least two of the following resources: CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources; i = 1, 2, ..., N;

[0023] SS200: The cloud server counts each client R i The resource set S currently being requested i ;

[0024] SS300: When the resource sets currently requested by clients exceeding a predetermined proportion T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted, and the clients exceeding the predetermined proportion T are used as clients to be checked;

[0025] SS400: The cloud server analyzes traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resource to be counted within a preset time period;

[0026] SS500: using the traffic transmission characteristics, network text characteristics, and / or encryption characteristics as data input to a network security-based big model, the network security-based big model outputting a security screening result for each of the clients to be screened;

[0027] SS600: Based on the security check result, the cloud server executes security measures for subsequent resource requests of each of the clients to be checked, wherein the security measures include current limiting, service interruption, or service maintenance.

[0028] The encryption characteristics in step SS400 include encryption method, encryption length and / or estimated decryption time;

[0029] In step SS500, the network security-based large model outputs a security check result for each of the clients to be checked, specifically including:

[0030] SS501: Determine whether the data input of the large model includes the encryption feature.

[0031] If yes, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network, and an encoder to perform the security check; if no, proceed to step SS502;

[0032] SS502: The large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

[0033] Part or all of the steps of a large-scale model-based traffic data statistical analysis method described in the first or second aspect can be automatically implemented through various forms of electronic devices and computer program instructions; the computer program instructions can be stored in different forms of storage media and loaded into computer electronic devices for execution.

[0034] Therefore, in the third aspect of the present invention, a computer-readable storage medium is also provided for storing computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the traffic data statistical analysis method based on a large model as described in the first or second aspect.

[0035] In the fourth aspect of the present invention, an electronic device is also proposed, which includes a processor and a memory, the memory is used to store instructions, and the processor is used to call the instructions in the memory, so that the electronic device executes the large model-based traffic data statistical analysis method described in the first or second aspect.

[0036] In a fifth aspect of the present invention, a computer program product is also proposed, which includes a computer program. When the computer program is executed, the traffic data statistical analysis method based on the large model described in the first or second aspect is implemented.

[0037] Corresponding to the method and technical solution, in order to execute the method, in a sixth aspect of the present invention, a traffic data statistical analysis system based on a large model is proposed, the system comprising a client request acquisition unit, a resource identification unit to be counted, a feature acquisition unit, a security investigation unit, a security measure execution unit, and a cloud server, wherein the cloud server is connected to the large model based on network security;

[0038] The client request acquisition unit is used to obtain the client R i The resource set S currently being requested i , i=1,2,…,N; resource set S i Contains at least one requested resource; N>1;

[0039] The resource identification unit to be counted is used to count each client R i The resource set S currently being requested i When the resource sets currently requested by clients exceeding a predetermined ratio T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted; the clients exceeding the predetermined ratio T are used as clients to be checked;

[0040] The feature acquisition unit is used to acquire the traffic transmission feature, network text feature, and / or encryption feature of the resource to be counted within a preset time period;

[0041] The security investigation unit is configured to use the traffic transmission characteristics, network text characteristics, and / or encryption characteristics as data input for a large network security model, wherein the large network security model outputs a security investigation result for each of the clients to be investigated;

[0042] The security measure execution unit is configured to enable the cloud server to execute security measures for subsequent resource requests of each of the clients to be checked based on the security check result, wherein the security measures include current limiting, service interruption, or service maintenance.

[0043] The encryption characteristics include encryption method, encryption length, and estimated decryption time.

[0044] The large model based on network security includes a deep learning module integrating convolutional neural network, recurrent neural network and encoder, and a traffic threshold interception module;

[0045] The network security-based large model outputs a security screening result for each of the clients to be screened, specifically including:

[0046] If the data input of the large model includes the encryption feature, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network, and an encoder to perform the security check;

[0047] Otherwise, the large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

[0048] The solution of the present invention can utilize the existing large-scale model based on network security to identify network fraud, malicious traffic and disguised attack data streams for the client's deceptive data, thereby improving the value of the statistical results of traffic data analysis and avoiding delays and blockages in cloud resource services.

[0049] Further advantages of the present invention will be further reflected in detail in the specific embodiments section in conjunction with the drawings of the specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0051] Figure 1 This is a schematic diagram of a specific scenario in which an embodiment of the present invention is applied.

[0052] Figure 2 This is a schematic diagram of the main flow of a traffic data statistical analysis method based on a large model according to an embodiment of the present invention.

[0053] Figure 3 This is a schematic diagram of the main flow of a traffic data statistical analysis method based on a large model according to another embodiment of the present invention.

[0054] Figure 4 This is a schematic diagram of the functional modules of a traffic data statistical analysis system based on a large model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0055] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. When the following description refers to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments applicable to the present application. Rather, they are merely examples of apparatus and methods applicable to certain aspects of the present application, as detailed in the appended claims.

[0056] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0057] At the same time, in the specific implementation of this application, if user-related data is involved, when the embodiment of this application is applied to a specific product or technology, user permission or consent must be obtained, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0058] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0059] See also Figure 1 , Figure 1 A schematic diagram showing a specific scenario in which an embodiment of the present invention is applied.

[0060] exist Figure 1 In the figure, multiple clients are shown, including mobile clients, desktop clients and other types of user clients, including virtual machines, servers, physical hosts, etc. Multiple clients communicate remotely with the cloud computing environment. When the user makes a request, the corresponding resource support is obtained from the cloud server to complete the corresponding task operation.

[0061] For example, a user's client needs to perform software development and code editing, requiring an integrated development environment (IDE). Its functionality is generally divided into two main areas: project management and code editing. Project management includes project creation, opening, closing, compiling, and packaging, while code editing includes text editing, code auto-completion, and code highlighting. An IDE integrates multiple functions required for software development, enabling developers to develop more quickly and conveniently.

[0062] However, setting up traditional IDE development tools often requires significant manpower and resources. With the continuous development of cloud technology, more and more cloud platform companies are migrating IDE tools to the cloud, providing web-based IDEs for users to use. This allows users to develop software directly on the web without having to install any applications. WebIDE systems primarily consist of a client and a backend cloud server. Users access the cloud server through a web page on the client. The server dispatches the requested resources based on the user's request and returns the corresponding cloud server and web page.

[0063] For the convenience of description, multiple user clients are referred to as N request clients {R1, R2, ..., R N}, the N requesting clients {R1, R2, ..., R N}Remote communication with cloud servers;

[0064] Take a client R i For example, a client R i Sending a client request to the cloud server, wherein the client request is used to schedule a requested resource to the cloud server; the requested resource includes a combination of at least two of the following resources: CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources; i = 1, 2, ..., N;

[0065] Taking the aforementioned IDE development product as an example, after the background IDE cloud server receives the target user's initialization page access request sent by the client, under normal circumstances, it allocates a target container to the target user through the container platform to process the target user's code editing request. In this way, each user can be assigned to an independent background server, which can alleviate the problem of resource preemption, reduce lag, and improve user safety.

[0066] However, in actual applications, due to the openness of cloud resources (especially for public clouds), malicious network attacks, abnormal traffic attacks, and disguised request data can also disguise themselves as normal clients to issue resource requests, causing impact on the normal resource services in the cloud.

[0067] In the prior art, the network traffic anomaly detection technology mentioned in the above background technology can be used to identify abnormal traffic instances and promptly discover attack behaviors in the network.

[0068] However, with the emergence of new network environments such as cloud computing, the Internet of Things, and edge computing, network attacks, traffic attacks, and disguised request data are no longer characterized by "peak traffic", but are usually manifested as low-rate attacks. By generating low-rate attack traffic that can be hidden in normal transmission control protocols, and utilizing the adaptive mechanism of network protocols, false congestion is caused in the network, damaging the connection quality between the client and the server, making it impossible for the server to provide normal services to users. Such attacks are more covert and difficult to detect because they use low-rate attack traffic, which is enough to occupy the key resources of the target system, but not enough to trigger traditional abnormal traffic detection mechanisms; especially in a cloud computing environment, if such attack ends are hidden in multiple client clusters, they will take advantage of the characteristics of shared resources in the cloud computing environment and affect multiple tenants or users by occupying shared resources, resulting in significant delays and blockages in cloud resource services.

[0069] to this end, Figure 1The technical solution introduces a big model based on network security as an auxiliary. After statistical analysis of traffic data in the above situation, the resources to be counted and the clients to be checked are identified, and then corresponding security measures are taken. The existing big model based on network security is used to identify network fraud, malicious traffic and disguised attack data streams based on the client's deceptive data, thereby improving the value of the statistical results of traffic data analysis and avoiding delays and blockages in cloud resource services.

[0070] Before introducing the subsequent specific embodiments of the present invention, the meaning of the large model based on network security in the embodiments of the present invention is first introduced.

[0071] First of all, it should be made clear that the "big model based on network security" in the embodiment of the present invention itself is not the area that needs to be improved in the technical solution of the present invention. From the subsequent embodiments, it can be seen that the focus of the technical solution of the present invention is how to specifically identify the resources to be counted and the clients to be checked, and then use the existing big model based on network security to perform corresponding checking operations.

[0072] In this field (computer network security related fields), there are many existing (open source or commercial) network security models. Table 1 lists the names and principles of some of the network security-based models as follows:

[0073] Table 1

[0074]

[0075] Preferably, the large model based on network security described in this application includes a deep learning module and a traffic threshold interception module.

[0076] The deep learning module uses the basic data of threat intelligence and abnormal traffic monitoring as text features, and based on the semantic analysis capabilities of the large model, it completes threat intelligence sharing and abnormal traffic detection. In addition, by pre-training on a large-scale code base, the large model can learn common code structures and patterns such as code syntax rules, naming conventions, function calls, etc. Most of the malware and vulnerability exploits commonly used in APT attacks rely on code writing. Therefore, the large model can be used to identify common code structures, design patterns, vulnerability patterns, etc. and associate them with existing knowledge. When encountering similar code structures, it can quickly understand their meaning and discover possible security issues.

[0077] In addition, the deep learning module can also integrate the stacked integrated adversarial defense method of the encrypted malicious traffic detection model.

[0078] The traffic threshold interception module, on the one hand, detects data attacks through traffic anomalies based on existing technologies (such as the network traffic anomaly detection technology mentioned in the background technology); on the other hand, it identifies the abnormal characteristics in the time domain and frequency domain of low-rate attack traffic hidden in the normal transmission control protocol disguised as a low-rate attack, and then classifies and detects it through the improved Stacking algorithm. It can accurately learn the abnormal characteristics and thus has the ability to detect traffic containing low-rate attacks.

[0079] For a detailed introduction to the aforementioned large-scale model based on network security, please refer to the prior art. This embodiment will not elaborate on this in detail. The following prior art can be used as a reference:

[0080] [1] Chen Ruilong, Hu Tao, Bu Youjun, et al. Stacked ensemble adversarial defense method for encrypted malicious traffic detection model [J / OL]. Computer Applications, 1-12.

[0081] [2]A static mechanism based on behavioral analysis is forDDoS attack countermeasure.I EEE Transactions on Information Forensics andSecurity,2022,17:2732;

[0082] [3]Sequence alignment detection of TCP-targeted synchronous low-rate DoS attacks. Computer Networks, 2019, 152: 64

[0083] [4] Low-rate denial of service attack detection method based on TCP time-frequency domain characteristics[J]. Journal of Sichuan University (Natural Science Edition), 2024, 61(03): 178-187.

[0084] While the aforementioned existing technologies have proposed various large-scale network security models, their applications are all targeted at single or small client environments. However, in cloud computing environments, the number of connected clients often ranges from hundreds to thousands, or even tens of thousands, and the number can be even higher during peak periods. In this case, if these large-scale network security models are indiscriminately applied to all connected clients to detect abnormal fluency, normal cloud services will be impacted.

[0085] For this purpose, see first Figure 2 Example of . Figure 2A schematic diagram of the main flow of a traffic data statistical analysis method based on a large model according to an embodiment of the present invention is shown. The method is applied to a cloud server, which is connected to N clients {R1, R2, ..., R N} Remote communication, N>1;

[0086] The method comprises the following steps:

[0087] S100: Get client R i The resource set S currently being requested i , i=1,2,…,N; resource set S i Contains at least one requested resource;

[0088] S200: When more than a predetermined proportion T of the resource sets currently requested by the clients all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted;

[0089] S300: Analyzing traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resource to be counted within a preset time period;

[0090] S400: Using the traffic transmission feature, network text feature, and / or encryption feature as data input to a network security-based big model, the network security-based big model outputting a security screening result for each of the clients exceeding the predetermined ratio;

[0091] S500: Based on the security check result, the cloud server executes security measures for subsequent resource requests from each of the clients exceeding the predetermined proportion, the security measures including current limiting, service interruption, or service maintenance.

[0092] The requested resource in step S100 includes a combination of at least two of the following resources:

[0093] CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources.

[0094] Furthermore, in the aforementioned IDE example, the resource request also includes a target container allocation request.

[0095] The client sends a container allocation request to the container platform of the cloud server, where the container allocation request is used to request the container platform to allocate a target container to a target user of the client.

[0096] Preferably, the predetermined ratio T is ≥ 50%.

[0097] In step S200, if more than half When the resource sets currently requested by the client all contain at least one commonly requested resource, the commonly requested resource is used as the resource to be counted;

[0098] For example, when N=500, if the resource requests received from more than 250 clients all include GPU resources and upload channel resources, {GPU resources, upload channel resources} will be treated as resources to be counted;

[0099] The step S300 specifically includes:

[0100] For each resource to be counted, perform the following analysis process:

[0101] S301: Determine whether the client request for the resource to be counted is encrypted;

[0102] If yes, proceed to step S303, otherwise proceed to step S302;

[0103] S302: Obtaining traffic transmission characteristics and network text characteristics of the resource to be counted within a preset time period;

[0104] S303: Obtaining traffic transmission characteristics and encryption characteristics of the resource to be counted within a preset time period;

[0105] In this step, if the client request for the resource to be counted is not encrypted, there is no need to call the stacked integrated adversarial defense method of the encrypted malicious traffic detection model integrated in the deep learning module. The next security investigation process can be directly entered based on the existing traffic transmission characteristics and network text characteristics.

[0106] Specifically, traffic transmission characteristics are characterized by the abnormal characteristics of low-rate attack traffic in the time domain and frequency domain within a preset time period; network text characteristics are the characteristics used by content-based anomaly detection methods, including code structure, design patterns, vulnerability patterns, etc.

[0107] On the other hand, if the client request for the resource to be counted is encrypted, it is necessary to call the stacked integrated countermeasure defense method of the encrypted malicious traffic detection model integrated in the deep learning module. The encryption features here include encryption method, encryption length and / or expected decryption time. The encryption method refers to the encryption method used for the resource request message, such as HASH encryption, character encryption, etc.; the encryption length refers to the number of encryption bits used by the encryption method, such as 64-bit encryption, 256-bit encryption; the expected decryption time refers to the time required to decrypt the message without a key. In practical applications, the encryption features commonly used include encryption method and encryption length. The embodiment of the present application also uses encryption method and encryption length as preliminary sample features for model training.

[0108] At this time, the traffic transmission characteristics and encryption characteristics of the resource to be counted within a preset time period are obtained.

[0109] The network security-based large model outputs a security screening result for each of the clients to be screened, specifically including:

[0110] SS501: Determine whether the data input of the large model includes the encryption feature.

[0111] If yes, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network, and an encoder to perform the security check; if no, proceed to step SS502;

[0112] The deep learning module integrating convolutional neural network, recurrent neural network and encoder can be found in the aforementioned prior art literature [1].

[0113] SS502: The large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

[0114] The specific implementation method of the traffic threshold interception module here can be found in the aforementioned literature [2]-[4].

[0115] Next, the traffic transmission characteristics, network text characteristics, and / or encryption characteristics are used as data inputs of a large model based on network security, and the large model based on network security outputs a security screening result for each of the clients that exceeds the predetermined proportion; based on the security screening result, the cloud server executes security measures for subsequent resource requests of each of the clients that exceeds the predetermined proportion, and the security measures include current limiting, service interruption, or service maintenance.

[0116] It can be seen that in the above process, there is no need to target all N clients {R1, R2, ..., R N} is checked (because in actual situations the resources requested by N clients are different), but once the resource sets currently requested by clients exceeding a predetermined proportion T all contain at least one commonly requested resource, the commonly requested resource will be used as the resource to be counted. This will identify disguised low-speed attack data streams to the greatest extent, thereby improving the value of the statistical results of traffic data analysis and avoiding delays and blockages in cloud resource services.

[0117] Of course, the setting of the predetermined ratio T also determines that the number of clients checked in the above process is limited.

[0118] To further reduce the number of checks while ensuring complete accuracy, Figure 2 The method is further improved as follows:

[0119] After step S300 and before step S400, the method further includes:

[0120] S310: When it is identified that the traffic transmission characteristics, network text characteristics, and / or encryption characteristics of a certain client are abnormal within a preset time period, the client is designated as a client to be checked;

[0121] At this time, the step S400 is correspondingly modified as follows:

[0122] S400: Using the traffic transmission feature, network text feature, and / or encryption feature as data input to a network security-based big model, the network security-based big model outputting a security screening result for each of the clients to be screened;

[0123] Step S500 is modified accordingly:

[0124] S500: Based on the security check result, the cloud server executes security measures for subsequent resource requests of each of the clients to be checked, where the security measures include current limiting, service interruption, or service maintenance.

[0125] Figure 3 A schematic diagram showing the main flow of a traffic data statistical analysis method based on a large model according to another embodiment of the present invention. Figure 3 The method is applied to N request clients {R1, R2, ..., R N}, the N requesting clients {R1, R2, ..., R N} remotely communicate with a cloud server, the method comprising the following steps:

[0126] SS100: Client R i Sending a client request to the cloud server, wherein the client request is used to schedule a requested resource to the cloud server; the requested resource includes a combination of at least two of the following resources: CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources; i = 1, 2, ..., N;

[0127] SS200: The cloud server counts each client R i The resource set S currently being requested i ;

[0128] SS300: When the resource sets currently requested by clients exceeding a predetermined proportion T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted, and the clients exceeding the predetermined proportion T are used as clients to be checked;

[0129] SS400: The cloud server analyzes traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resource to be counted within a preset time period;

[0130] SS500: using the traffic transmission characteristics, network text characteristics, and / or encryption characteristics as data input to a network security-based big model, the network security-based big model outputting a security screening result for each of the clients to be screened;

[0131] SS600: Based on the security check result, the cloud server executes security measures for subsequent resource requests of each of the clients to be checked, wherein the security measures include current limiting, service interruption, or service maintenance.

[0132] The encryption characteristics in step SS400 include encryption method, encryption length, and estimated decryption time;

[0133] In step SS500, the network security-based large model outputs a security check result for each of the clients to be checked, specifically including:

[0134] SS501: Determine whether the data input of the large model includes the encryption feature.

[0135] If yes, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network, and an encoder to perform the security check; if no, proceed to step SS502;

[0136] SS502: The large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

[0137] and Figure 2 Corresponding to the improved method of steps S300-500, Figure 3 In the embodiment, steps SS300-SS600 are improved as follows:

[0138] SS300: When more than a predetermined proportion T of the resource sets currently requested by the clients all contain at least one commonly requested resource, the commonly requested resource is taken as a resource to be counted;

[0139] SS400: The cloud server analyzes traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resource to be counted within a preset time period;

[0140] When a client's traffic transmission characteristics, network text characteristics, and / or encryption characteristics are found to be abnormal within a preset time period, the client is identified as a client to be investigated;

[0141] SS500: using the traffic transmission characteristics, network text characteristics, and / or encryption characteristics as data input to a network security-based big model, the network security-based big model outputting a security screening result for each of the clients to be screened;

[0142] SS600: Based on the security check result, the cloud server executes security measures for subsequent resource requests of each of the clients to be checked, wherein the security measures include current limiting, service interruption, or service maintenance.

[0143] Based on the method embodiment, further introduction Figure 4 The system embodiment is as follows: Figure 4 The figure is a schematic diagram of the functional modules of a traffic data statistical analysis system based on a large model according to an embodiment of the present invention.

[0144] exist Figure 4 In the system, the system includes a client request acquisition unit, a resource identification unit to be counted, a feature acquisition unit, a security investigation unit, a security measure execution unit and a cloud server, and the cloud server is connected to a large model based on network security;

[0145] The client request acquisition unit is used to obtain the client R i The resource set S currently being requested i , i=1,2,…,N; resource set S i Contains at least one requested resource; N>1;

[0146] The resource identification unit to be counted is used to count each client R i The resource set S currently being requested i When more than a predetermined proportion T of the resource sets currently requested by the clients all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted;

[0147] The feature acquisition unit is used to acquire the traffic transmission feature, network text feature, and / or encryption feature of the resource to be counted within a preset time period;

[0148] The security investigation unit is configured to use the traffic transmission characteristics, network text characteristics, and / or encryption characteristics as data input for a large network security model, wherein the large network security model outputs a security investigation result for each of the clients to be investigated;

[0149] The security measure execution unit is configured to enable the cloud server to execute security measures for subsequent resource requests of each of the clients to be checked based on the security check result, wherein the security measures include current limiting, service interruption, or service maintenance.

[0150] The encryption characteristics include encryption method, encryption length, and estimated decryption time.

[0151] The large model based on network security includes a deep learning module integrating convolutional neural network, recurrent neural network and encoder, and a traffic threshold interception module;

[0152] The network security-based large model outputs a security screening result for each of the clients to be screened, specifically including:

[0153] If the data input of the large model includes the encryption feature, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network, and an encoder to perform the security check;

[0154] Otherwise, the large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

[0155] In one embodiment, the to-be-counted resource identification unit takes the clients exceeding the predetermined ratio T as the to-be-checked clients;

[0156] In another embodiment, when the feature acquisition unit obtains abnormalities in the traffic transmission features, network text features, and / or encryption features of a certain client within a preset time period, the client is treated as a client to be checked.

[0157] After the security check, taking the aforementioned user terminal requesting the IDE service as an example, if the security measure for a client to be checked is to maintain the service, then upon receiving the user's initial page access request, the IDE server allocates a container for the user to process the user's page access request;

[0158] To further improve the rationality of resource allocation, in this embodiment, multiple users can share a backend server to process project management requests, and each user processes code editing requests through the container assigned to them. That is, the IDE server can serve as a backend server for project management to process the user's project management requests; the container assigned to the user is specifically used to process the user's code editing request.

[0159] If the security measure for a client to be checked is to interrupt the service, the server will respond to the initial page access request with a feedback to the user that there is an abnormality, requiring the user to send a resource request again and include more user login information (such as account + password + host ID, etc.) in the resource request for secondary identity verification;

[0160] If the security measure for a client to be checked is a rate limiting service, the server will respond to the user that rate limiting exists after receiving the initialization page access request;

[0161] At this time, if the user's resource request itself includes a resource application amount D, the resource application amount D is multiplied by the predetermined ratio T as the resource allocation amount. The container platform server temporarily creates a container as the target container based on the resource allocation amount and sends it to the user client;

[0162] If the user's resource request does not include the resource application amount D, the container platform server will temporarily create a basic container as the target container and send it to the user client when there are idle container resources. The resource amount of the basic container is equal to the system default basic value.

[0163] The solution of the present invention can utilize the existing large-scale model based on network security to identify network fraud, malicious traffic and disguised attack data streams for the client's deceptive data, thereby improving the value of the statistical results of traffic data analysis and avoiding delays and blockages in cloud resource services; especially for multi-user requests in an IDE environment, the above solution can also alleviate the problem of resource preemption, reduce lag, and improve the security of legitimate users.

[0164] The present invention provides multiple embodiments, each of which constitutes an independent technical solution and may contribute to the existing technology and solve corresponding technical problems. However, it should be noted that different embodiments can be combined with each other without violating logic; at the same time, each embodiment can solve at least one technical problem, but it is not required that each individual embodiment solve multiple or all technical problems.

[0165] For other technologies, principles, algorithms or models not elaborated in detail in this application, please refer to the existing technology.

[0166] The foregoing has shown and described the method embodiments and system of the present invention, but it is understood by those skilled in the art that various changes, modifications, substitutions and variations may be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A traffic data statistical analysis method based on a large model, the method is applied to a cloud server, the cloud server and N clients {R1, R2, …, R N } Remote communication, N>1; characterized in that, The method comprises the following steps: S100: Get client R i The resource set S currently being requested i , i = 1, 2, … , N ; resource set S i Contains at least one requested resource; S2 00: When the resource sets currently requested by more than a predetermined proportion T of clients all contain at least one commonly requested resource, the commonly requested resources are taken as resources to be counted; S300: Analyze traffic transmission characteristics, network text characteristics, and encryption characteristics of the resource to be counted within a preset time period; S400: Using traffic transmission features, network text features, and encryption features as data inputs for a large network security model, the large network security model outputs a security screening result for each of the clients exceeding a predetermined ratio; S5 00: Based on the security check results, the cloud server executes security measures for subsequent resource requests from each client exceeding a predetermined ratio. The security measures include limiting the flow of requests, interrupting the service, or maintaining the service. In step S400, the network security model based on the network security outputs a security check result for each client to be checked, specifically including: SS401: Determine whether the data input of the large model includes the encryption feature. If yes, the large model calls the deep learning module integrating convolutional neural network, recurrent neural network and encoder to perform security check; if no, proceed to step SS402; SS402: The large model calls the traffic threshold interception module to perform security checks based on traffic transmission characteristics and network text characteristics.

2. The method for statistical analysis of traffic data based on a large model according to claim 1, characterized in that: The requested resource in step S100 includes a combination of at least two of the following resources: CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources.

3. The method for statistical analysis of traffic data based on a large model according to claim 1, characterized in that: The predetermined ratio T is ≥ 50%.

4. The method for statistical analysis of traffic data based on a large model according to claim 1, characterized in that: The step S300 specifically includes: For each resource to be counted, perform the following analysis process: S301: Determine whether the client request for the resource to be counted is encrypted; If yes, go to step S303, otherwise go to step S302; S302: Obtaining traffic transmission characteristics and network text characteristics of the resource to be counted within a preset time period; S303: Obtain traffic transmission characteristics and encryption characteristics of the resource to be counted within a preset time period.

5. A traffic data statistical analysis method based on a large model, the method is applied to N request clients {R1, R2, …, R N }, the N request clients {R1, R2, … , R N } Remote communication with cloud server, characterized in that, The method comprises the following steps: SS100: Client R i Sending a client request to the cloud server, wherein the client request is used to schedule a requested resource to the cloud server; the requested resource includes a combination of at least two of the following resources: CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources; i = 1, 2, … , N ; SS200: The cloud server counts each client R i The resource set S currently being requested i ; SS300: When the resource sets currently requested by clients exceeding a predetermined proportion T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted, and the clients exceeding the predetermined proportion T are used as clients to be checked; SS400: The cloud server analyzes the traffic transmission characteristics, network text characteristics, and encryption characteristics of the resource to be counted within a preset time period; SS500: using the traffic transmission features, network text features, and encryption features as data inputs for a large network security model, the large network security model outputting a security screening result for each of the clients to be screened; SS600: Based on the security check results, the cloud server performs security measures for each subsequent resource request to be checked client, the security measures include current limiting, interruption of service or maintenance of service; In step SS500, the network security-based large model outputs a security check result for each of the clients to be checked, specifically including: SS501: Determine whether the data input of the large model includes the encryption feature. If yes, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network, and an encoder to perform the security check; if no, proceed to step SS502; SS502: The large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

6. A traffic data statistical analysis method based on a large model as claimed in claim 5, characterized in that: The encryption characteristics in step SS400 include encryption method, encryption length and / or estimated decryption time.

7. A traffic data statistical analysis system based on a large model, the system comprising a cloud server connected to a large model based on network security, characterized in that: The system further comprises: Client request acquisition unit, used to obtain client R i The resource set S currently being requested i , i = 1, 2, … , N; resource set S i Contains at least one requested resource; N>1; The resource identification unit to be counted is used to count each client R i The resource set S currently being requested i When the resource sets currently requested by clients exceeding a predetermined ratio T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted; the clients exceeding the predetermined ratio T are used as clients to be checked; a feature acquisition unit, configured to acquire traffic transmission features, network text features, and encryption features of the resource to be counted within a preset time period; a security screening unit, configured to use the traffic transmission characteristics, network text characteristics, and encryption characteristics as data inputs for a large network security model, wherein the large network security model outputs a security screening result for each of the clients to be screened; A security measure execution unit is configured to execute security measures for subsequent resource requests of each of the clients to be checked based on the security check result. Measures, wherein the security measures include current limiting, service interruption or service maintenance; The large model based on network security includes a deep learning module integrating convolutional neural network, recurrent neural network and encoder, and a traffic threshold interception module; The network security-based large model outputs a security screening result for each of the clients to be screened, specifically including: If the data input of the large model includes the encryption feature, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network, and an encoder to perform the security check; Otherwise, the large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

8. A traffic data statistical analysis system based on a large model as claimed in claim 7, characterized in that: The encryption characteristics include encryption method, encryption length, and estimated decryption time.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, it is used to implement a traffic data statistical analysis method based on a large model as described in any one of claims 1-4 or 5-6 above.

Images