Network anomaly detection method and anomaly detection device

Abstract

The invention provides a network anomaly detection method and an anomaly detection device. In the method, one or more request intervals within a detection period are determined, where each request interval is a time interval of two network requests from a network source. And determining that the network request from the network source is abnormal according to the request interval in the detection period.

Description

Technical Field

[0001] The present invention relates to a network analysis technology, and more particularly to a network anomaly detection method and an anomaly detection device. Background Art

[0002] Currently, artificial intelligence (AI) services have been widely used in factory automation environments and are implemented through network services. Therefore, network security will be an important issue for smart factories. In order to ensure the normal operation of factory production lines, the network needs to meet more stringent security requirements to avoid network attacks from all parties, thereby affecting the operation of the factory.

[0003] Figure 1 This is an example of network intrusion detection. Figure 1 For the application of network intrusion detection, network administrators can set up a network intrusion detection system (NIDS) at the entrance between the intranet and the Internet to monitor the network packets flowing into the intranet, thereby helping network administrators to discover network anomalies and take preventive measures. However, this approach can only provide detection and prevention from the Internet to the intranet, but it is difficult to detect and prevent the entire network. For example, Figure 2 This is an example of a malicious program intrusion. Please refer to Figure 2 When malicious programs are implanted into the intranet and directly attack intranet services, it is not only difficult to defend against, but also causes the interruption of factory intelligent services (for example, defect detection), thereby affecting the operation of the production line. Summary of the invention

[0004] The present invention provides a method and device for detecting network anomaly, which can provide a flow detection function to detect abnormal flow from the network.

[0005] The network anomaly detection method of the embodiment of the present invention is suitable for execution by a processor. The detection method includes (but is not limited to) the following steps: determining one or more request intervals within a detection period, wherein each request interval is a time interval between two network requests from a network source; and determining a network request anomaly from the network source based on the request interval within the detection period.

[0006] The abnormality detection device of the embodiment of the present invention includes (but is not limited to) a communication transceiver, a memory and a processor. The memory stores program code. The processor is coupled to the communication transceiver and the memory. The processor loads the program code to execute: determining one or more request intervals within a detection period, wherein each request interval is a time interval between two network requests received from a network source by the communication transceiver; and determining the network request abnormality from the network source according to the request interval within the detection period.

[0007] Based on the above, the network anomaly detection method and anomaly detection device of the embodiment of the present invention can determine the network anomaly according to the time interval between two network requests, thereby improving network security and enhancing the reliability of network services.

[0008] In order to make the above features and advantages of the present invention more clearly understood, embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 This is an example of network intrusion detection.

[0010] Figure 2 This is an example of the intrusion of malicious programs.

[0011] Figure 3 is a block diagram of components of an abnormality detection device according to an embodiment of the present invention.

[0012] Figure 4 is a flow chart of a method for detecting network anomalies according to an embodiment of the present invention.

[0013] Figure 5 is a schematic diagram of a request interval according to an embodiment of the present invention.

[0014] Figure 6 is a schematic diagram illustrating an autoencoder according to an embodiment of the present invention.

[0015] Fig. 7A FIG. 4 is a schematic diagram illustrating an abnormal range according to an embodiment of the present invention.

[0016] Figure 7B is a schematic diagram of a Chi-Square Probabilities table according to an embodiment of the present invention.

[0017] Figure 8 The figure is a flowchart of processing a network anomaly according to an embodiment of the present invention.

[0018] The reference numerals are described as follows:

[0019] 10: Abnormal detection device

[0020] 11: Memory

[0021] 12: Communication transceiver

[0022] 13: Processor

[0023] 131: Network Services

[0024] S410~S420, S810~S820: Steps

[0025] RRI: Request Interval

[0026] DD: Detection period

[0027] NR: Network Request

[0028] X: Input data

[0029] 601: Decoder

[0030] Z: Compress data

[0031] 602: Decoder

[0032] X': Reconstructed data

[0033] X 2 : Test statistic

[0034] α: abnormal range DETAILED DESCRIPTION

[0035] Figure 3 is a block diagram of components of an abnormality detection device 10 according to an embodiment of the present invention. Figure 3 The abnormality detection device 10 includes (but is not limited to) a memory 11, a communication transceiver 12, and a processor 13. The abnormality detection device 10 can be a router, a firewall device, a relay device, a gateway device, a computer host, a server, a smart phone, a tablet computer, a wearable device, a smart home appliance, a vehicle-mounted device, or other electronic devices.

[0036] The memory 11 may be any type of fixed or removable random access memory (RAM), read only memory (ROM), flash memory, hard disk drive (HDD), solid-state drive (SSD) or similar element. In one embodiment, the memory 11 is used to store program code, software modules, configurations, data (e.g., time, times, or model parameters) or files, and its embodiments will be described in detail later.

[0037] The communication transceiver 12 may be a communication transceiver supporting 4G or other generations of mobile communications, Wi-Fi, Bluetooth, infrared, radio frequency identification (RFID), Ethernet, optical fiber network, etc., a serial communication interface (such as RS-232), or a universal serial bus (USB), Thunderbolt or other communication transmission interface. In one embodiment, the communication transceiver 12 is used to transmit or receive data with other electronic devices (for example, a remote device from the Internet or a networked device in an intranet).

[0038] The processor 13 is coupled to the memory 11 and the communication transceiver 12. The processor 13 can be a central processing unit (CPU), a graphics processing unit (GPU), or other programmable general-purpose or special-purpose microprocessors (Microprocessors), digital signal processors (Digital Signal Processors, DSPs), programmable controllers, field programmable gate arrays (Field Programmable Gate Array, FPGAs), application-specific integrated circuits (Application-Specific Integrated Circuit, ASICs), neural network accelerators or other similar components or combinations of the above components. In one embodiment, the processor 13 is used to perform all or part of the operations of the abnormality detection device 10, and can load and execute various program codes, software modules, files and data stored in the memory 11. In some embodiments, the functions of the processor 13 can be implemented by software or chips.

[0039] In one embodiment, the processor 13 executes one or more network services 131 and provides the network services 131 through the communication transceiver 12. The network services 131 may be, but are not limited to, artificial intelligence detection, recognition or inference, web pages, cloud processing, data storage or multimedia streaming.

[0040] Hereinafter, the method described in the embodiment of the present invention will be described with various devices, components and modules in the abnormality detection device 10. Each process of the method can be adjusted according to the implementation situation.

[0041] Figure 4 is a flow chart of a method for detecting network anomalies according to an embodiment of the present invention. Figure 4, the processor 13 determines one or more request intervals within the detection period (step S410). Specifically, the detection period can be 10 seconds, 30 seconds or one minute, but is not limited thereto. Each request interval is a time interval of two network requests from a certain network source. In one embodiment, the network request is used to request a network service 131 provided by the abnormality detection device 10 or other devices. The processor 13 can capture network packets through software or program libraries such as Wireshark, tcpdump, SmartSniff, libpcap, winpcap or similar, and further parse the received network packets. The network packet may include a network request for the network service 131. For example, a Hyper Text Transfer Protocol (HTTP) request or a Domain Name System (DNS) request. In one embodiment, the network request includes a source network address corresponding to the network source. The network source can be a remote device or any networked device. Different network sources can be distinguished by the source network address. In one embodiment, the network request includes a destination network address corresponding to the abnormality detection device 10 or its network service 131. The network address may be an IP address, a MAC address, or other identification information.

[0042] The request interval is the time interval between any two consecutive network requests from a certain network source. In one embodiment, the processor 13 may record the timestamp of each network request and use the difference between the timestamps of two consecutive network requests received before and after as the request interval.

[0043] For example, Figure 5 is a schematic diagram of a request interval RRI according to an embodiment of the present invention. Figure 5, on the time axis, a network request NR for network service 131 sent by a certain network source can be detected and received at intervals of a detection period DD. Under normal circumstances, the request interval RRI of two adjacent and consecutive network requests NR sent by a certain network source should be in a reasonable range. For example, if a production line corresponds to a source network address and its required speed is to process a network request NR within one second, the reasonable value of the request interval RRI should be about 1 second (there may be an allowable error range based on demand). However, if there is a sudden burst of network requests NR or a network attack, a certain network source will quickly send multiple consecutive network requests NR. At this time, the request interval RRI of the source network address of this network source will deviate from a reasonable range and even approach 0. Therefore, it is reasonable to suspect that the network request NR sent by this network source may cause traffic anomalies in the network service 131, thereby affecting the overall service, and even suspected of being subject to a blocking attack. Therefore, it can be seen that the time area of ​​two consecutive network requests NR can be used to evaluate traffic anomalies.

[0044] In one embodiment, if there are multiple network sources, the processor 13 determines the request interval of each network source respectively.

[0045] Please refer to Figure 4 , the processor 13 determines that the network request from this network source is abnormal based on one or more request intervals during the detection period (step S420). Specifically, the length of the request interval can be used to evaluate abnormal traffic and serve as a basis for evaluating the abnormality of the network request. In one embodiment, normal traffic can be defined by the speed / frequency at which the network source transmits network requests. For example, the speed at which the AI ​​client device on each assembly line of a factory production line sends each image to the network service 131. Sending one network request (e.g., corresponding to one image) per second can be considered normal traffic.

[0046] Taking a factory production line as an example, a production line completes one picture per second and sends it to the AI ​​client device for automatic optical inspection (AOI) judgment. Then, the AI ​​client device sends a network request to the network service 131 at a frequency of sending one picture per second. The request interval is about 1 second. Judging by such a sending frequency, if it is found that the frequency of network requests sent by a certain AI client device is different from the normal speed (i.e., normal traffic), for example, the request interval becomes 0.001 seconds, it can be inferred that this AI client device may have an abnormal condition.

[0047] In one embodiment, the processor 13 may determine one or more request intervals as abnormal intervals through a detection model. The detection model may be trained using one or more request intervals of one or more normal intervals. A normal interval is a request interval under normal traffic. In other words, the training samples of the detection model have been marked as normal intervals belonging to normal traffic. The number of training samples may be 60, 120, or 300, and is not limited thereto.

[0048] The detection model may be a model trained by a machine learning algorithm using known normal intervals. The machine learning algorithm may be an autoencoder, a decision tree, KNN (K Nearest Neighbor), a support vector machine (SVM), a random forest, or a neural network (NN), but is not limited thereto. The detection model is used to determine whether a request interval during the detection period is an abnormal interval or a request interval corresponding to abnormal traffic.

[0049] For example, Figure 6 is a schematic diagram illustrating an automatic encoder according to an embodiment of the present invention. Figure 6 , the detection model based on the autoencoder includes an encoder 601 and a decoder 602. The detection model is a model trained using multiple request intervals under normal traffic. The input data X is the request interval of the sequence. The encoder 601 encodes the input data X into compressed data Z. The compressed data Z is the input data X compressed into data with a relatively low dimension by the encoder 601 of the detection model. Then, the decoder 602 can decompress the compressed data Z into reconstructed data X'.

[0050] Assume that the encoder 601 can be represented by the function , and the decoder 602 can be represented by the function f θ The goal of the autoencoder is to find a function by inputting a normal interval f θ , so that And X' is approximately or equal to X. That is, when the input data X is a normal interval, the reconstructed data X' is approximately or equal to the input data X. Then, the trained detection model can be used to infer the request interval determined in step S410. Responding to |XX′| <T D , then the input data X is a normal interval or a request interval corresponding to normal traffic. Responding to |XX′|>T D , then the input data X is an abnormal interval or a request interval corresponding to abnormal traffic. Threshold value T DThe value of can be obtained from a specific quantile (e.g., 98, 97.5, or 95) of the sample distribution of all |XX′|.

[0051] In one application scenario, the detection model may be deployed to the network service 131. The network service 131 may then detect abnormal traffic from one or more network sources.

[0052] In addition, taking the production line for AOI defect detection as an example, the AI ​​server (which can be implemented by the abnormality detection device 10) provides a network service 131 for AOI detection. The network service 131 can execute an AI model (or called an AI service). When performing AOI detection, each production line will have an AI client device to transmit the image to be detected to the AI ​​model of the AI ​​service for defect determination. If the AI ​​client device of each production line transmits an image (corresponding to a network request) to the AI ​​service at a frequency of 0.5 seconds, the difference between two consecutive network requests transmitted by the AI ​​client device of each production line may be about 0.5 seconds. That is, the request interval is about 0.5 seconds. Under normal traffic conditions, the request interval fragments are collected for the AI ​​client device of each production line, and their start time is recorded. For example, multiple fragments of 60 request intervals are collected. Under normal traffic conditions, each group of 60 request intervals will have the characteristics of normal traffic. If a detection model is trained with fragments of these 60 request areas, the detection model will be a model of known normal traffic. Assume that there is a set of input data of 60 request intervals whose start time is known to a certain network source. If the input data is similar or equal to the output data of the detection model (for example, according to the aforementioned threshold value T D If the input data and the output data of the detection model differ too much (for example, according to the threshold value T D If the AI ​​service is loaded into the detection model and the traffic is judged for the request interval of each continuous network request from each network source, it can be determined whether the traffic from these network sources is abnormal, and even the network source with abnormal traffic can be detected in time and blocked / blocked, or the network request from this network source can be not processed / discarded (dropped). In this way, the network service 131 can be prevented from being affected.

[0053] For example, if the time series of network requests from a certain network source is as follows (4.5, 5.0, 5.4, 6.0, 6.5…, 16.7, 16.8, 16.82, 16.83, 16.89). The corresponding request interval is (0.5, 0.4, 0.6, 0.5,…, 0.1, 0.02, 0.01, 0.06). If the four request intervals are taken as a group, the input data is X0 = (0.5, 0.4, 0.6, 0.5),…, Xn = (0.1, 0.02, 0.01, 0.6), where n is a positive integer. The detection model can output X0' = (0.49, 0.41, 0.62, 0.5),…, Xn' = (0.5, 0.4, 0.3, 0.4) based on these input data.

[0054] |Xt-Xt'| can be obtained using the Euclidean distance (t is one from 0 to n):

[0055] For example, |X0-X0'|=Sqrt(0.0001+0.0001+0.0004+0)=0.0245;

[0056] |Xn-Xn'|=Sqrt(0.16+0.1444+0.0841+0.1156)=0.71.

[0057] If the threshold value T D is 0.2, it can be seen that the input data X0 belongs to the normal interval, while Xn belongs to the abnormal interval.

[0058] Under normal traffic conditions, it is inevitable that several abnormal traffic segments will occur in an hour or a day. However, the production line is actually operating normally. It just happened that the AI ​​client device may have network problems at that time, and some network requests may be concentrated in a certain time period, resulting in a short-term traffic abnormality. If the network service 131 to a certain network source is forcibly blocked because of this, it will be a misjudgment and may cause problems to a certain production line. Therefore, it is necessary to evaluate abnormal traffic over a longer period than the detection period.

[0059] In one embodiment, the processor 13 may determine the number of occurrences of one or more request intervals in the detection period as abnormal intervals. For example, for each detection period, the processor 13 counts the number of abnormal intervals determined by the detection model. The processor 13 may determine that the network request from this network source is abnormal based on the number of occurrences of abnormal intervals in multiple detection periods in the statistical period. The statistical period is greater than the detection period, and the statistical period includes multiple detection periods. For example, if the detection period is 30 seconds, the statistical period is 5 minutes, 10 minutes, or 60 minutes. The abnormal traffic condition may be a continuous irregular occurrence within the statistical time, rather than only occurring in a part of the time. Therefore, in order to solve this problem, the segments (for example, 60 request intervals) where all abnormal traffic from each network source occurs are determined within a statistical period that is longer than the detection period. And these segments where abnormal traffic occurs can be called abnormal events. And the segments where abnormal events occur can be called abnormal intervals. Next, observe whether the number of occurrences of abnormal intervals of abnormal events in this statistical period is within a reasonable range. If the number of occurrences does not meet the normal conditions, it is determined that abnormal traffic occurs. On the contrary, if the number of occurrences is in line with normal conditions, it is determined that no abnormal traffic has occurred. In other words, this network source is under normal traffic.

[0060] In one embodiment, the processor 13 may determine whether the number of occurrences of abnormal intervals during multiple detection periods within a statistical period conforms to the statistical distribution to produce a conforming result. The conforming result includes that the number of occurrences of abnormal intervals during the statistical period conforms to the statistical distribution, and the number of occurrences of abnormal intervals during the statistical period does not conform to the statistical distribution. Experiments have shown that under normal traffic, the number of abnormal events from each network source (i.e., a fragment / set of the number of occurrences of a specific number of abnormal intervals (e.g., 50, 60 or 100)) will comply with a statistical distribution / distribution within a unit time. For example, the statistical distribution is a Poisson distribution, and its probability distribution function is:

[0061]

[0062] η represents the average number of occurrences of abnormal events from the network source during the statistical period, and x is the number of occurrences of abnormal events from the network source during the detection period.

[0063] The processor 13 can determine that the network request from this network source is abnormal based on the result of the compliance with the statistical distribution. For example, if the average occurrence number η is estimated using the abnormal events of the network source with normal traffic, under normal circumstances, the number of occurrences of abnormal events during the statistical period will comply with the distribution of Poisson (η). On the contrary, if the number of occurrences of the abnormal period during the statistical period does not comply with the Poisson (η) distribution, it is determined that the network request from this network source is abnormal or the traffic is abnormal.

[0064] In one embodiment, the processor 13 may determine the test statistic based on the number of observations and the expected number of times. The number of observations is the number of occurrences in each detection period, and the expected number of times is the expected value of the number of occurrences in each detection period under this statistical distribution. The average value of the number of occurrences of abnormal events in multiple detection periods within the statistical period can be used as the average number of occurrences η. The processor 13 calculates the probability of each number of occurrences in the statistical period under this statistical distribution. For example, the processor 13 calculates the Poisson probability of each number of occurrences, P(Xi)=pi, i is an integer. The processor 13 can calculate the expected number of times Ei=n*pi under the statistical distribution for each number of occurrences, where n is the total number of samples (i.e., the value of this number of occurrences). If Ei <T E (eg, 5, 7 or 8), the processor 13 may combine the number of occurrences during this detection period with the number of occurrences during other detection periods.

[0065] In one embodiment, the test statistic is defined by a chi-square test. For example, the mathematical expression of the test statistic is:

[0066]

[0067] Its degree of freedom is km-1. Since we only estimate an average number of occurrences η, m = 1, but this is not limited to this. k is the number of occurrences. For example, if the number of occurrences is 0, 1, and 3, then k is 3. The number of observations O i is the observed value, which is the actual number of times an abnormal event occurs during the detection period.

[0068] The processor 13 may determine the compliance result with the statistical distribution based on the test statistic. In one embodiment, the processor 13 may determine whether the test statistic is within the abnormal range of the statistical distribution. For example, Fig. 7A is a schematic diagram illustrating an abnormal range α according to an embodiment of the present invention. Fig. 7A , the curve is a Poisson distribution. In response to the fact that the test statistic is not in the abnormal range α, the processor 13 may determine that the compliance result is that the number of occurrences of the abnormal interval within the statistical period is consistent with the statistical distribution. That is, it is considered that the traffic is normal or the network request is normal. On the other hand, in response to the fact that the test statistic is in the abnormal range α, the processor 13 may determine that the compliance result is that the number of occurrences of the abnormal interval within the statistical period is not consistent with the statistical distribution. That is, it is considered that the traffic is abnormal or the network request is abnormal.

[0069] In one embodiment, the processor 13 may compare the test statistic with the threshold value. Fig. 7A For example, the threshold value is located at the starting point of the abnormal range α. The threshold value is Figure 7Bis a schematic diagram of a Chi-Square Probabilities table according to an embodiment of the present invention. Figure 7B , taking the abnormal range α as 0.05 as an example, the threshold value is 3.841 (i.e., And df = km-1 = 1). If the test statistic χ 2 Greater than threshold If , the test statistic is within the abnormal range α, and the flow abnormality is considered to have occurred. Otherwise, it means that the test statistic is not within the abnormal range α, and the flow abnormality is considered not to have occurred.

[0070] Figure 8 This is a flowchart of processing network anomalies according to an embodiment of the present invention. Figure 8 , the processor 13 detects an abnormal request (i.e., a network request under abnormal traffic) (step S810), and the processor 13 can further block the network request from this network source (step S820). For example, the network address of this network source is subjected to packet filtering, and the packet with the detected abnormal request is prohibited from accessing the corresponding network service 131, or the network service 131 does not process or discards the network request for this network source.

[0071] Taking the factory as an example, for the AI ​​client device of each production line, the detection model is first used to detect the time when the abnormal event occurs, and then the Poisson distribution test is used to detect whether the network request traffic of the AI ​​client device is abnormal.

[0072] Assume that the statistical time is 30 minutes and the detection period is set to 1 minute. During this statistical time, the number of abnormal events in each detection period is counted to see whether it conforms to the normal Poisson distribution of a detection period of 1 minute.

[0073] Under normal circumstances, it is observed that η=0.1 during the statistical time, that is, an average of 0.1 abnormal events are observed every minute, which is equivalent to one every 10 minutes. Since 30 minutes of observation are required, a total of 30 detection period data can be collected. These 30 data can be used for Poisson (0.1) verification to find out whether these 30 data conform to the distribution of Poisson (0.1). If the data conforms to the distribution of Poisson (0.1), it belongs to normal traffic conditions; if the data does not conform to the distribution of Poisson (0.1), it is judged as an abnormal condition (that is, the network request of this AI client device is abnormal).

[0074] The following are examples of abnormal conditions:

[0075] If the time sequence of abnormal events is (1:01, 1:31, 2:30, 3:02, 3:20, 10:30, 19:30, 20:42, 29:00), it can be summarized as follows:

[0076] Occurrence rate Number of observations 0 22 1 6 2 or more 2

[0077] Next, we need to test whether this table conforms to the Poisson distribution (η = 0.1) and α = 0.05. The number of observations (O0, O1, O2) = (22, 6, 2), and the expected number

[0078] (E0, E1, E2) = (30*P(X = 0), 30*P(X = 1), 30*P(X = 2)) = (27.145, 2.715, 0.135). If the test statistic χ 2 =30.714>Threshold value (It can be obtained by looking up the table according to α=0.05, k=3, and m=1), then the abnormality detection device 10 determines that abnormal network request traffic occurs in this production line.

[0079] The following are examples of normal conditions:

[0080] If the time sequence of abnormal events is (1:31, 2:30, 20:42), it can be summarized as follows:

[0081] Occurrence frequency Number of observations 0 27 1 3 2 or more 0

[0082] Next, we need to test whether this table is consistent with the Poisson (η = 0.1) distribution, and α = 0.05. The number of observations (O0, O1, O2) = (27, 3, 0), and the expected number

[0083] (E0, E1, E2) = (30*P(X = 0), 30*P(X = 1), 30*P(X = 2)) = (27.145, 2.715, 0.135). If the test statistic χ 2 =0.165<threshold value (which can be obtained by looking up a table based on α=0.05, k=3, and m=1), the anomaly detection device 10 determines that the network request of this production line is under normal flow.

[0084] In summary, in the network anomaly detection method and anomaly detection device of the embodiment of the present invention, the abnormal period of continuous network requests within the detection period is determined by the detection model, and the number of occurrences of abnormal events within a longer statistical period is determined to be consistent with the statistical distribution. In this way, abnormal traffic can be efficiently found and abnormal situations can be handled as soon as possible.

[0085] Although the present invention has been disclosed as above by way of embodiments, it is not intended to limit the present invention. Any person having ordinary knowledge in the technical field may make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be determined by the following claims.

Claims

1. A method for detecting network anomalies, adapted to be executed by a processor, and comprising: determining at least one request interval within a detection period, wherein each of the request intervals is a time interval of two network requests from a network source; as well as A network request anomaly from the network source is determined based on the at least one request interval within the detection period.

2. The method for detecting network anomalies as claimed in claim 1, wherein the step of determining the network request anomaly from the network source according to the at least one request interval within the detection period comprises: The at least one request interval is determined to be an abnormal interval by a detection model, wherein the detection model is trained using at least one request interval of at least one normal interval.

3. The method for detecting network anomalies as claimed in claim 1, wherein the step of determining the network request anomaly from the network source based on the at least one request interval within the detection period comprises: Determining a number of occurrences of the at least one request interval being an abnormal interval within the detection period; as well as The network request abnormality from the network source is determined according to the number of occurrences of the abnormal interval in a plurality of the detection periods within a statistical period.

4. The method for detecting network anomalies as claimed in claim 3, wherein the step of determining the network request anomaly from the network source according to the number of occurrences of the anomaly interval in a plurality of the detection periods within the statistical period comprises: Determining whether the number of occurrences of the abnormal intervals in the plurality of the detection periods within the statistical period conforms to a statistical distribution to generate a conformity result, wherein the conformity result includes whether the number of occurrences within the statistical period conforms to the statistical distribution and whether the number of occurrences within the statistical period does not conform to the statistical distribution; and The network request from the network source is determined to be abnormal according to the matching result with the statistical distribution.

5. The method for detecting network anomalies as claimed in claim 4, wherein the step of determining whether the number of occurrences of the anomaly intervals in a plurality of the detection periods within the statistical period conforms to the statistical distribution comprises: Determining a test statistic according to an observation number and an expected number, wherein the observation number is the number of occurrences in each of the detection periods, and the expected number is the expected value of the number of occurrences of the abnormal interval in each of the detection periods under the statistical distribution; and The compliance result is determined based on the test statistic.

6. The method for detecting network anomalies as claimed in claim 5, wherein the step of determining the matching result according to the test statistic comprises: determining whether the test statistic is located in an abnormal range of the statistical distribution; In response to the test statistic not being within the abnormal range, determining that the compliance result is that the number of occurrences of the abnormal interval within the statistical period complies with the statistical distribution; and In response to the detection statistic being located in the abnormal interval, the conforming result is determined as the number of occurrences of the abnormal interval within the statistical period not conforming to the statistical distribution.

7. The method for detecting network anomalies as claimed in claim 6, wherein the step of determining whether the test statistic is located in the abnormal range of the statistical distribution comprises: The test statistic is compared with a threshold value, wherein the threshold value is located at the starting point of the abnormal range.

8. The method for detecting network anomalies as claimed in claim 1, wherein the step of determining the network request anomaly from the network source according to the at least one request interval within the detection period comprises: Block network requests from this network source. 9 . The network anomaly detection method as claimed in claim 5 , wherein the test statistic is defined by a chi-square test.

10. The network anomaly detection method as claimed in claim 4, wherein the statistical distribution is a Pashon distribution.

11. An abnormality detection device, comprising: a communication transceiver; a memory storing a program code; as well as A processor is coupled to the communication transceiver and the memory, and is loaded with the program code to execute: determining at least one request interval within a detection period, wherein each of the request intervals is a time interval of two network requests received from a network source by the communication transceiver; and A network request anomaly from the network source is determined based on the at least one request interval within the detection period.

12. The abnormality detection device as claimed in claim 11, wherein the processor further executes: The at least one request interval is determined to be an abnormal interval by a detection model, wherein the detection model is trained using at least one request interval of at least one normal interval.

13. The abnormality detection device as claimed in claim 11, wherein the processor further executes: determining a number of occurrences of the at least one request interval being an abnormal interval within the detection period; and The network request abnormality from the network source is determined according to the number of occurrences of the abnormal interval in a plurality of the detection periods within a statistical period.

14. The abnormality detection device as claimed in claim 13, wherein the processor further executes: Determining whether the number of occurrences of the abnormal intervals of the plurality of detection periods within the statistical period conforms to a statistical distribution to generate a conformity result, wherein the conformity result includes that the number of occurrences of the abnormal intervals within the statistical period conforms to the statistical distribution and the number of occurrences of the abnormal intervals within the statistical period does not conform to the statistical distribution; and The network request from the network source is determined to be abnormal according to the matching result with the statistical distribution.

15. The abnormality detection device as claimed in claim 14, wherein the processor further executes: Determine a test statistic according to an observation number and an expected number, wherein the observation number is the number of occurrences in each of the detection periods, and the expected number is the expected value of the number of occurrences in each of the detection periods under the statistical distribution; and The compliance result is determined based on the test statistic.

16. The abnormality detection device as claimed in claim 15, wherein the processor further executes: determining whether the test statistic is located in an abnormal range of the statistical distribution; In response to the test statistic not being within the abnormal range, determining that the compliance result is that the number of occurrences of the abnormal interval within the statistical period complies with the statistical distribution; and In response to the detection statistic being located in the abnormal range, the conforming result is determined as the number of occurrences of the abnormal interval within the statistical period not conforming to the statistical distribution.

17. The abnormality detection device as claimed in claim 16, wherein the processor further executes: The test statistic is compared with a threshold value, wherein the threshold value is located at the starting point of the abnormal range.

18. The abnormality detection device as claimed in claim 11, wherein the processor further executes: Network requests from the network source are blocked through the communications transceiver.

19. The anomaly detection device of claim 15, wherein the test statistic is defined by a chi-square test.

20. The abnormality detection device of claim 14, wherein the statistical distribution is a Pashon distribution.

Images