Abnormal traffic event detection method and device, storage medium and electronic equipment

Abstract

The invention discloses an abnormal traffic event detection method and device, a storage medium and electronic equipment. The method comprises the following steps: acquiring a target alarm message sent by a service system; according to the target alarm message, multi-level detection operation is executed on service flow in a service system, an aggregation alarm result is determined, the multi-level detection operation represents detection operation executed in sequence according to the service type, other alarm messages and the terminal equipment, and the other alarm messages are different from the target alarm message; under the condition that the aggregation alarm result indicates that the target event exists in the service system, the service system is repaired according to an operation instruction indicated by a target script strategy, the target script strategy comprises script nodes, and one script node corresponds to one operation instruction. According to the method and the device, the technical problem of low detection accuracy of the abnormal traffic event is solved.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular, to a method and device for detecting abnormal traffic events, a storage medium, and an electronic device. Background Art

[0002] Traditional traffic event detection mechanisms are usually based on fixed rules or pattern matching, and do not fully consider the dynamic characteristics of business traffic in the network environment and the correlation between multi-source alarms, making it difficult for business systems to identify and filter real threats from a global perspective, limiting the efficiency and accuracy of network security incident response. In other words, there is a technical problem in the relevant technology that the detection accuracy of abnormal traffic events is low.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a method and device for detecting abnormal traffic events, a storage medium, and an electronic device, so as to at least solve the technical problem of low detection accuracy of abnormal traffic events.

[0005] According to one aspect of an embodiment of the present application, a method for detecting abnormal traffic events is provided, comprising: obtaining a target alarm message sent by a business system; performing multi-level detection operations on business traffic in the business system according to the target alarm message, and determining an aggregated alarm result, wherein the multi-level detection operation represents detection operations performed in sequence according to business type, other alarm messages, and terminal devices, and the other alarm messages are different from the target alarm message; when the aggregated alarm result indicates that a target event exists in the business system, repairing the business system according to the operating instructions indicated by the target script policy, wherein the target script policy includes script nodes, and one script node corresponds to one operating instruction.

[0006] According to another aspect of an embodiment of the present application, a detection device for abnormal traffic events is also provided, including: an acquisition module, used to acquire a target alarm message sent by a business system; an execution module, used to perform multi-level detection operations on the business traffic in the business system according to the target alarm message, and determine an aggregated alarm result, wherein the multi-level detection operation represents the detection operation performed in sequence according to the business type, other alarm messages and terminal devices, and the other alarm messages are different from the target alarm message; a repair module, used to repair the business system according to the operating instructions indicated by the target script policy when the aggregated alarm result indicates that the business system has a target event, wherein the target script policy includes script nodes, and one script node corresponds to one operating instruction.

[0007] Optionally, the device is also used to: before obtaining the target alarm message sent by the business system, obtain the hardware resources and software resources in the business system; construct a target network topology model according to the association relationship between the hardware resources and the software resources, wherein the target network topology model is used to indicate the static layout of the hardware resources and the software resources, and the dynamic interaction relationship between the hardware resources and the software resources; control the business system to generate the target alarm message according to the target network topology model and the alarm trigger condition.

[0008] Optionally, the device is used to perform multi-level detection operations on the business traffic in the business system according to the target alarm message to determine an aggregate alarm result in the following manner: determine a system event according to the target alarm message; perform an event detection operation according to the business type indicated by the system event to obtain traffic characteristics of a group of terminal devices; determine a target terminal device from the group of terminal devices according to the traffic characteristics, wherein the target traffic characteristics of the target terminal device in a target time period are different from the remaining traffic characteristics of the remaining terminal devices, and the group of terminal devices consists of the target terminal device and the remaining terminals; generate a first alarm result based on the target terminal device and the target traffic characteristics.

[0009] Optionally, the device is also used to: after generating the first alarm result based on the target terminal device and the target traffic characteristics, obtain the business-related data in the target time period; determine the target business traffic data with the target traffic characteristics from the business-related data; and generate a second alarm result based on the target business traffic data and the first alarm result.

[0010] Optionally, the device is also used to: after generating the second alarm result based on the target business traffic data and the first alarm result, obtain the other alarm messages other than the target alarm message in the target time period; determine other terminal devices based on the other alarm messages, wherein the other terminal devices represent terminal devices in the business system that have business associations with the target terminal device and have issued the other alarm messages; and generate the aggregate alarm result based on the other terminal devices and the second alarm result.

[0011] Optionally, the device is used to repair the business system according to the operating instructions indicated by the target script policy when the aggregate alarm result indicates that the business system has a target event in the following manner: determine the target script policy from a set of script policies according to the type of the target event, wherein the set of script policies is obtained in advance by configuring the script nodes by calling a visual process orchestration tool; execute the operating instructions in sequence according to each of the script nodes in the target script policy and the processing flow between each script node to repair the business system; and generate a target prompt message when the business system is repaired, wherein the target prompt message indicates that the business system is repaired, and the target prompt message is used to respond to the target alarm message.

[0012] Optionally, the device is also used to: obtain hardware resources and software resources in the business system; construct a target network topology model based on the association relationship between the hardware resources and the software resources, wherein the target network topology model is used to indicate the static layout of the hardware resources and the software resources, and the dynamic interaction relationship between the hardware resources and the software resources; control the business system to generate the target alarm message according to the target network topology model and the alarm trigger condition; obtain the target alarm message; determine the system event according to the target alarm message; perform the event detection operation according to the business type indicated by the system event to obtain the traffic characteristics of a group of terminal devices; determine the target terminal device from the group of terminal devices according to the traffic characteristics, wherein the target traffic characteristics of the target terminal device in the target time period are different from the remaining traffic characteristics of the remaining terminal devices, and the group of terminal devices consists of the target terminal device and the remaining terminals; generate a first alarm result according to the target terminal device and the target traffic characteristics; after generating the first alarm result, by obtaining the business association data in the target time period, and Determine the target business flow data with the target flow characteristics from the business association data; generate a second alarm result according to the target business flow data and the first alarm result; obtain the other alarm messages in the target time period; determine other terminal devices based on the other alarm messages, wherein the other terminal devices represent terminal devices in the business system that have business associations with the target terminal device and have issued the other alarm messages; generate the aggregate alarm result according to the other terminal devices and the second alarm result; when the aggregate alarm result indicates that the business system has the target event, determine the target script strategy from a set of script strategies that are pre-configured by calling a visual process orchestration tool to configure the script nodes according to the type of the target event; execute the operation instructions in sequence according to each script node in the target script strategy and the processing flow between each script node to repair the business system; when the business system is repaired, generate a target prompt message, wherein the target prompt message indicates that the business system is repaired, and the target prompt message is used to respond to the target alarm message.

[0013] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned abnormal traffic event detection method when running.

[0014] According to another aspect of the embodiment of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the above abnormal traffic event detection method.

[0015] According to another aspect of an embodiment of the present application, there is also provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-mentioned method for detecting abnormal traffic events through the computer program.

[0016] In an embodiment of the present application, a target alarm message sent by a business system is obtained; a multi-level detection operation is performed on the business traffic in the business system according to the target alarm message to determine an aggregate alarm result, wherein the multi-level detection operation represents the detection operation performed in sequence according to the business type, other alarm messages and terminal devices, and the other alarm messages are different from the target alarm message; when the aggregate alarm result indicates that there is a target event in the business system, the business system is repaired according to the operation instructions indicated by the target script policy, wherein the target script policy includes script nodes, and one script node corresponds to one operation instruction. Through deep correlation analysis and an intelligent script response mechanism, the purpose of significantly improving the accuracy of abnormal traffic event detection is achieved, thereby achieving the technical effect of efficient and accurate security incident response and disposal, and further solving the technical problem of low detection accuracy of abnormal traffic events. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a schematic diagram of an application environment of an optional abnormal traffic event detection method according to an embodiment of the present application;

[0019] Figure 2 is a flow chart of an optional abnormal traffic event detection method according to an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of an optional abnormal traffic event detection method according to an embodiment of the present application;

[0021] Figure 4 is a schematic structural diagram of an optional abnormal traffic event detection device according to an embodiment of the present application;

[0022] Figure 5 is a schematic structural diagram of an optional abnormal traffic event detection product according to an embodiment of the present application;

[0023] Figure 6 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] The present application is described below in conjunction with embodiments:

[0027] According to one aspect of an embodiment of the present application, a method for detecting an abnormal traffic event is provided. Optionally, in this embodiment, the above-mentioned method for detecting an abnormal traffic event can be applied to Figure 1 In the hardware environment composed of the server 101 and the terminal device 103 shown in FIG. Figure 1As shown, the server 101 is connected to the terminal 103 via a network, and can be used to provide services for the terminal device or an application 107 installed on the terminal device. The application can be a video application, an instant messaging application, a browser application, an educational application, a game application, etc. A database 105 may be set up on the server or independently of the server to provide data storage services for the server 101, for example, a game data storage server. The above-mentioned network may include, but is not limited to, a wired network and a wireless network, wherein the wired network includes, for example, a local area network, a metropolitan area network, and a wide area network; the wireless network includes, for example, Bluetooth, WIFI, and other networks that implement wireless communication; the terminal device 103 may be a terminal configured with an application program, and may include, but is not limited to, at least one of the following: a mobile phone (such as an Android phone, an iOS phone, etc.), a laptop computer, a tablet computer, a PDA, a MID (Mobile Internet Devices), a PAD, a desktop computer, a smart TV, an intelligent voice interaction device, a smart home appliance, a vehicle-mounted terminal, an aircraft, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a mixed reality (MR) terminal, and other computer devices; the above-mentioned server may be a single server, a server cluster consisting of multiple servers, or a cloud server.

[0028] Combination Figure 1 As shown, the above-mentioned abnormal traffic event detection method can be executed by an electronic device, which can be a terminal device or a server. The above-mentioned abnormal traffic event detection method can be implemented by the terminal device or the server separately, or by the terminal device and the server together.

[0029] The above is only an example and is not specifically limited in this embodiment.

[0030] Optionally, as an optional implementation, as Figure 2 As shown, the above-mentioned abnormal traffic event detection method includes:

[0031] S202, obtaining a target alarm message sent by the business system;

[0032] Optionally, in the embodiment of the present application, the above-mentioned "business system" refers to the system responsible for data processing and business logic execution within an enterprise or organization, including but not limited to network servers, application servers, database systems, firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), etc. These systems will generate a large amount of logs and data related to business operations and system status during operation, and when abnormal behavior is detected, an alarm message will be triggered and sent.

[0033] It should be noted that the type and scope of the business system can be adjusted according to the specific application scenario. For example, it can be a specific application service cluster, a data center infrastructure, or a resource management system in a hybrid cloud environment. The specific composition of the business system should cover the key components in the IT architecture of the enterprise or organization in order to comprehensively monitor and respond to potential network security threats, but its specific composition and form are not limited in this application, and can be flexibly configured and expanded according to actual needs and network architecture.

[0034] Similarly, the above-mentioned "target alarm message" refers to the alarm information generated and sent by the business system, which is intended to notify the system administrator or security monitoring platform about potential security events, including but not limited to alarms of network intrusion, abnormal traffic, malware activities, etc. The triggering conditions and format of the target alarm message may also vary according to the characteristics of the business system and the security policy, and this application does not make specific restrictions on this, so as to adapt to various alarm scenarios and needs.

[0035] S204, performing a multi-level detection operation on the service traffic in the service system according to the target alarm message to determine an aggregate alarm result, wherein the multi-level detection operation represents a detection operation performed in sequence according to the service type, other alarm messages and terminal devices, and the other alarm messages are different from the target alarm message;

[0036] Optionally, in the embodiment of the present application, the above-mentioned "multi-level detection operation" refers to a hierarchical and systematic detection process, including but not limited to the first-level detection according to the business type, the second-level detection based on other alarm messages, and the third-level detection for terminal devices. Each level of detection operation is to further refine and confirm potential security incidents, reduce false alarms, and ensure the reliability and value of alarm information.

[0037] It should be noted that the order and specific content of the multi-level detection operations can be adjusted according to different business needs and network conditions. For example, business type detection can precede terminal device detection, with the aim of quickly identifying abnormal traffic associated with a specific business; and detection based on other alarm messages will be performed at the last level to ensure that all related information is fully considered. In addition, the detection technology used in each level, such as machine learning models, signature matching algorithms, behavioral analysis, etc., can also be selected and optimized according to actual needs. This application does not limit this.

[0038] Similarly, the above-mentioned "aggregate alarm results" refer to the final alarm output that is formed by comprehensively analyzing and organizing all detection results after the multi-level detection operation is completed. It includes the in-depth correlation analysis results of various information such as business traffic, terminal device status and business type, aiming to provide a comprehensive and concise view of security incidents to help security managers quickly understand and respond.

[0039] Specifically, the specific form and content of the aggregated alarm results can be customized according to the characteristics and security requirements of the business system, such as alarm level, event description, recommended actions, etc. This application does not limit this to ensure the practicality and pertinence of the results.

[0040] S206, when the aggregated alarm result indicates that the business system has a target event, repair the business system according to the operation instructions indicated by the target script policy, wherein the target script policy includes script nodes, and one script node corresponds to one operation instruction.

[0041] Optionally, in an embodiment of the present application, the above-mentioned "target script strategy" refers to a series of preset standardized response processes based on the characteristics of security incidents identified in the aggregated alarm results, which is intended to guide system or security managers on how to effectively handle such incidents. The above-mentioned operating instructions are used to perform specific emergency response actions, such as blocking malicious traffic, isolating affected systems, starting system repair programs, or notifying relevant teams, etc., to minimize the impact of security incidents on business systems. The above-mentioned script node refers to each specific step or decision point defined in the target script strategy. Each script node corresponds to one or a group of operating instructions. The script nodes can be connected in a preset logical order to form a complete set of incident response scripts to ensure that when a security incident occurs, actions can be taken quickly and accurately according to established processes.

[0042] It should be noted that "the existence of a target event in the business system" means that the aggregated alarm results indicate that there are situations in the system that meet the characteristics of predefined security events. These characteristics may include but are not limited to abnormal traffic, system performance degradation, unknown network connection attempts, etc. Due to the complexity and dynamic nature of business systems, the specific definition and detection criteria of target events may need to be adjusted according to different network environments and business needs. This application does not limit this, but aims to provide a mechanism that can flexibly identify and respond to multiple security threats.

[0043] Similarly, the above-mentioned "target script strategy" refers to a pre-defined set of response steps based on the specific security incident type indicated in the aggregated alarm results. Each script node corresponds to a specific operation instruction, including but not limited to network isolation, enhanced traffic monitoring, system repair, alarm notification, etc., aiming to quickly and orderly handle security incidents, reduce incident response time, and improve handling efficiency.

[0044] The formulation of target scenario strategies can be customized according to enterprise security policies, IT architecture and business continuity requirements to ensure that the most appropriate response measures can be taken in different scenarios. This application does not limit this in order to adapt to diverse and complex security emergency needs.

[0045] In an exemplary embodiment, upon receiving the target alarm message, the security platform immediately initiates a multi-level detection operation on the business traffic in the business system. First, the platform performs the first-level detection based on the business type, and identifies any abnormal behavior that deviates from the normal range by analyzing the traffic pattern related to the business type. Then, in the second-level detection, the platform correlates the target alarm message with the alarm information from other security devices to determine whether there is any associated threat activity. Finally, entering the third-level detection, the platform conducts an in-depth analysis of the terminal devices in the business system to check whether there are signs of infection or abnormal communication behavior.

[0046] Furthermore, when the multi-level detection operation is completed and the aggregated alarm results confirm that the target event exists in the business system, the security platform will automatically call the target script strategy. The strategy contains a series of script nodes, each of which corresponds to a specific operation instruction, such as isolating the affected network segment, updating security rules, running system checks and repair programs, etc. According to the aggregated alarm results and the preset script strategy, the corresponding operation instructions can be automatically selected and executed to quickly and accurately repair the business system and restore its normal operation while minimizing the impact of the security incident.

[0047] Through the embodiments of the present application, a target alarm message sent by a business system is obtained; a multi-level detection operation is performed on the business traffic in the business system according to the target alarm message to determine an aggregate alarm result, wherein the multi-level detection operation represents the detection operation performed in sequence according to the business type, other alarm messages and terminal devices, and the other alarm messages are different from the target alarm message; when the aggregate alarm result indicates that there is a target event in the business system, the business system is repaired according to the operation instructions indicated by the target script policy, wherein the target script policy includes script nodes, and one script node corresponds to one operation instruction. Through deep correlation analysis and an intelligent script response mechanism, the purpose of significantly improving the accuracy of abnormal traffic event detection is achieved, thereby achieving the technical effect of efficient and accurate security incident response and disposal, and further solving the technical problem of low detection accuracy of abnormal traffic events.

[0048] As an optional scheme, before obtaining the target alarm message sent by the business system, the method also includes: obtaining the hardware resources and software resources in the business system; constructing a target network topology model according to the association relationship between the hardware resources and the software resources, wherein the target network topology model is used to indicate the static layout of the hardware resources and the software resources, and the dynamic interaction relationship between the hardware resources and the software resources; controlling the business system to generate the target alarm message according to the target network topology model and the alarm trigger condition.

[0049] Optionally, in the embodiment of the present application, the above-mentioned "hardware resources" refer to the infrastructure part composed of physical entities in the business system, including but not limited to servers, network devices, storage devices and terminal devices, etc. The above-mentioned "software resources" refer to software applications, operating systems, middleware and security software running on hardware resources, which together constitute the logical functions and data processing capabilities of the business system.

[0050] It should be noted that the above-mentioned "target network topology model" not only reflects the static layout of hardware resources and software resources, that is, their physical location and logical structure, but also depicts the dynamic interaction between resources, such as the path of data flow, service call and resource access control, etc. It helps to fully understand the operating status and security situation of the business system, and provides a detailed reference for subsequent alarm triggering and event response. This application does not limit this, and aims to enhance the depth and breadth of security analysis through multi-level resource association.

[0051] In an exemplary embodiment, the security platform first collects information about hardware and software resources in the business system, including server configuration, network device connection status, software application versions, and terminal device activity records. Then, based on the relationship between these resources, the platform builds a detailed target network topology model that clearly shows the distribution and interaction of resources. Subsequently, the platform continuously monitors activities in the business system based on the target network topology model and the preset alarm trigger conditions. Once abnormal behavior that meets the trigger conditions is detected, such as unauthorized access attempts, abnormal data transmission, etc., the platform immediately generates a target alarm message and sends it to the security manager, or directly initiates the preset security response process.

[0052] Through the embodiments of the present application, by constructing a target network topology model, comprehensive monitoring and understanding of business system resources are achieved, which can more accurately identify security incidents and trigger alarms, thereby achieving the purpose of improving security response efficiency and accuracy, and optimizing security resource management.

[0053] As an optional scheme, the above-mentioned multi-level detection operations are performed on the business traffic in the above-mentioned business system according to the above-mentioned target alarm message to determine the aggregated alarm result, including: determining the system event according to the above-mentioned target alarm message; performing event detection operations according to the business type indicated by the above-mentioned system event to obtain the traffic characteristics of a group of terminal devices; determining the target terminal device from the above-mentioned group of terminal devices according to the above-mentioned traffic characteristics, wherein the target traffic characteristics of the above-mentioned target terminal device in the target time period are different from the remaining traffic characteristics of the remaining terminal devices, and the above-mentioned group of terminal devices consists of the above-mentioned target terminal device and the above-mentioned remaining terminals; generating a first alarm result according to the above-mentioned target terminal device and the above-mentioned target traffic characteristics.

[0054] Optionally, in the embodiment of the present application, the above-mentioned "system event" refers to a security event triggered by a target alarm message, including specific alarm information and security threat types, including but not limited to network intrusion, abnormal traffic, system vulnerability exploitation, etc. The above-mentioned "event detection operation" is an in-depth analysis of business traffic under the business type indicated by the system event, aiming to identify specific traffic patterns or abnormal behaviors associated with security events.

[0055] It should be noted that the "traffic characteristics" obtained may include but are not limited to the number of network connections, data transmission volume, access mode, etc. These characteristics will be used to distinguish the target terminal device from the remaining terminal devices. At the same time, the above-mentioned "target period" refers to the specific time window that the event detection operation focuses on. The selection of this period should be based on the characteristics of the security event, such as the duration of the attack or the peak period of the business system, which is not limited in this application.

[0056] In an exemplary embodiment, after receiving the target alarm message, the security platform first parses the message content to determine the system event, such as detecting a suspected DDoS attack. Based on the business type indicated by this event, the platform performs a first-level event detection operation on the relevant business traffic and extracts the traffic characteristics of each terminal device in a specific period of time. Through comparative analysis, the platform finds that one of a group of terminal devices has a significantly different traffic pattern, such as an abnormal increase in the number of connections, and this terminal is determined to be the target terminal device. Subsequently, the platform generates the first alarm result based on the abnormal traffic characteristics of the target terminal device, providing a basis for subsequent event aggregation and response measures.

[0057] Through the embodiments of the present application, multi-level detection operations on business traffic are adopted to achieve accurate positioning and early warning of security incidents, which can effectively distinguish normal traffic from abnormal traffic, reduce false alarms, and timely lock the affected terminal devices, thereby achieving the purpose of improving security response efficiency and reducing the scope of incident impact.

[0058] As an optional scheme, after generating the first alarm result according to the target terminal device and the target traffic characteristics, the method further includes: obtaining the business-related data in the target time period; determining the target business traffic data having the target traffic characteristics from the business-related data; and generating a second alarm result according to the target business traffic data and the first alarm result.

[0059] Optionally, in an embodiment of the present application, the above-mentioned "business-related data" refers to other data or logs related to the target traffic characteristics generated in the business system during the target period, including but not limited to application logs, system logs, network logs, etc. These data can provide additional contextual information to help deeply understand the overall picture of the target traffic characteristics. The above-mentioned "target business traffic data" is data records directly related to the target traffic characteristics determined through specific screening and association analysis in the business-related data. They contain detailed information on abnormal behavior and are used to further verify and refine the first alarm result.

[0060] It should be noted that there are various ways to obtain "business-related data", which can be real-time collection or retrieval from a historical database, and this application does not limit this. The sources of these data can include various components of the business system, such as servers, network devices, security devices, etc. Through the comprehensive analysis of multi-source data, the impact and scope of security incidents can be more comprehensively evaluated.

[0061] In an exemplary embodiment, after generating the first alarm result, the security platform further collects business-related data within the target period, including system logs and application logs. Through in-depth analysis of these data, especially records related to target traffic characteristics, the platform can identify specific business traffic data, such as abnormal user login attempts, changes in data access behavior, etc. Based on the comprehensive analysis of the target business traffic data and the first alarm result, the platform generates a second alarm result, which not only contains the terminal device information of the traffic anomaly, but also describes in detail the nature of the abnormal behavior, the time of occurrence, and the attack method, providing richer information support for subsequent security incident analysis and disposal.

[0062] Through the embodiment of the present application, the method of business-related data analysis is adopted to achieve the deepening and verification of the first alarm result. The technical effect is reflected in the ability to refine the alarm information, improve the accuracy and depth of security incident analysis, and achieve the purpose of enhancing the basis for security response decision-making and optimizing the emergency response process.

[0063] As an optional scheme, after generating the second alarm result based on the target business traffic data and the first alarm result, the method further includes: obtaining the other alarm messages other than the target alarm message in the target time period; determining other terminal devices based on the other alarm messages, wherein the other terminal devices represent terminal devices in the business system that have business associations with the target terminal devices and have issued the other alarm messages; and generating the aggregate alarm result based on the other terminal devices and the second alarm result.

[0064] Optionally, in an embodiment of the present application, "other alarm messages" refer to security warnings or exception notifications generated by the business system or its security components in addition to the target alarm messages during the target time period, including but not limited to system anomalies, network intrusion attempts, software vulnerability warnings, etc. These messages also record the activities and status of the business system at the security level. "Other terminal devices" refer to those devices in the business system that have business associations with the target terminal device and have issued other alarm messages during the target time period. Business association refers to the interaction between terminal devices such as data exchange and service calls during the business operation process. Therefore, a security incident on one terminal device can affect the security status of other associated devices.

[0065] It should be noted that the determination of "other terminal devices" may include but is not limited to association analysis based on network topology, link tracking based on business logic, etc., and this application does not limit this.

[0066] In an exemplary embodiment, after generating the second alarm result, the security platform continues to collect other alarm messages within the target period, and by analyzing these messages, determines other terminal devices that have business associations with the target terminal device. For example, if the target alarm message involves data leakage, the platform will check other devices that have data exchange records with the terminal to see if there are related alarms or abnormal behaviors. Based on these association analyses, the platform integrates the information of other terminal devices with the second alarm result to generate an aggregated alarm result, which not only covers the original target terminal, but also extends to the entire affected business chain, providing security managers with a more complete and in-depth overview of security events.

[0067] Through the embodiments of the present application, a multi-source alarm information fusion mechanism based on business association is adopted to realize the aggregate alarm generation of security incidents, which can effectively integrate alarm information from different sources, provide a more comprehensive event perspective, and achieve the purpose of improving the accuracy of security incident identification and response efficiency.

[0068] As an optional scheme, when the above-mentioned aggregate alarm result indicates that the above-mentioned business system has a target event, the above-mentioned business system is repaired according to the operation instructions indicated by the target script strategy, including: determining the above-mentioned target script strategy from a set of script strategies according to the type of the above-mentioned target event, wherein the above-mentioned set of script strategies is pre-obtained by calling the above-mentioned script nodes by calling a visual process orchestration tool; executing the above-mentioned operation instructions in sequence according to each of the above-mentioned script nodes in the above-mentioned target script strategy, and the processing flow between each script node, so as to repair the above-mentioned business system; when the above-mentioned business system is repaired, generating a target prompt message, wherein the above-mentioned target prompt message indicates that the above-mentioned business system is repaired, and the above-mentioned target prompt message is used to respond to the above-mentioned target alarm message.

[0069] Optionally, in an embodiment of the present application, "a set of script strategies" refers to a series of response processes pre-configured for different types of network security incidents, each process consisting of multiple script nodes, including but not limited to isolating infected terminals, updating firewall rules, running system checks and repair programs, notifying relevant personnel, etc. These strategies are pre-set through visual process orchestration tools so that they can be quickly started when corresponding security incidents occur, thereby improving the speed and efficiency of emergency response. The above-mentioned "target script strategy" specifically refers to the most appropriate response process selected from a set of script strategies after identifying a specific type of target event. The selection process is based on the nature and severity of the incident and the characteristics of the business system to ensure that the measures taken are both effective and minimize the impact on normal business.

[0070] It should be noted that the order and conditions for executing the "operation instructions" can vary according to the actual situation and the setting of the script nodes. For example, some instructions need to be executed under specific conditions, or some operations need to be processed in parallel. In addition, the processing flow between script nodes can be fixed or dynamically adjusted, and this application does not limit this.

[0071] In an exemplary embodiment, after the security platform aggregates the alarm results indicating the existence of a target event in the business system, it automatically matches the most appropriate "target script strategy" according to the event type. For example, if the target event is a DDoS attack, the platform will select a strategy from a set of script strategies that contains instructions such as traffic cleaning, attack source blocking, and system status monitoring. The platform will follow the process defined in the script, first perform traffic cleaning to mitigate the impact of the attack, then block the identified attack source, and start system status monitoring to observe the repair effect. Once the repair is completed, that is, the business system returns to normal operation, the platform will generate a "target prompt message" indicating that the system has been repaired, and respond to the initial target alarm message to complete the closed-loop management of the security incident.

[0072] Through the embodiments of the present application, a scripted response process is adopted to achieve automated and semi-automated repair of security incidents. The technical effect is reflected in the ability to take action quickly and accurately, reducing delays and errors in manual intervention, thereby achieving the purpose of improving the efficiency of security incident handling and reducing the burden on security managers.

[0073] As an optional solution, the method further includes: obtaining hardware resources and software resources in the business system; constructing a target network topology model according to the association relationship between the hardware resources and the software resources, wherein the target network topology model is used to indicate the static layout of the hardware resources and the software resources, and the dynamic interaction relationship between the hardware resources and the software resources; controlling the business system to generate the target alarm message according to the target network topology model and the alarm triggering condition; obtaining the target alarm message; determining a system event according to the target alarm message; performing the event detection operation according to the business type indicated by the system event to obtain the traffic characteristics of a group of terminal devices; determining a target terminal device from the group of terminal devices according to the traffic characteristics, wherein the target traffic characteristics of the target terminal device in the target time period are different from the remaining traffic characteristics of the remaining terminal devices, and the group of terminal devices consists of the target terminal device and the remaining terminals; generating a first alarm result according to the target terminal device and the target traffic characteristics; after generating the first alarm result, obtaining the business association data in the target time period; According to the business association data, the target business flow data with the target flow characteristics is determined from the business association data; the second alarm result is generated according to the target business flow data and the first alarm result; the other alarm messages in the target time period are obtained; other terminal devices are determined based on the other alarm messages, wherein the other terminal devices represent the terminal devices in the business system that have business associations with the target terminal devices and have issued the other alarm messages; the aggregate alarm result is generated according to the other terminal devices and the second alarm result; when the aggregate alarm result indicates that the target event exists in the business system, the target script strategy is determined from a set of script strategies obtained by configuring the script nodes in advance by calling the visual process orchestration tool according to the type of the target event; the operation instructions are executed in sequence according to the script nodes in the target script strategy and the processing flow between the script nodes to repair the business system; when the business system is repaired, a target prompt message is generated, wherein the target prompt message indicates that the business system is repaired, and the target prompt message is used to respond to the target alarm message.

[0074] In an exemplary embodiment, taking the network environment application scenario of the bank security platform as an example, the security platform first performs a comprehensive resource scan on the business system and obtains hardware and software resource information including servers, network devices, storage devices, and various software applications and security software running on these hardware. Subsequently, the platform constructs a target network topology model based on the associations between these resources, such as network connections, data flows, and application calls. This model not only shows the static layout of resources, but also describes the dynamic interaction between them, providing a basic framework for the identification and response of security incidents.

[0075] Next, the control business system generates a target alarm message based on the target network topology model and the preset alarm trigger conditions. For example, when a server is detected to be communicating abnormally with multiple unknown source addresses, an alarm is triggered. After the platform obtains these target alarm messages, it further analyzes and determines specific system events, such as potential malware propagation events. Based on the business type indicated by the system event, the platform performs event detection operations and identifies target terminal devices with abnormal traffic characteristics by analyzing the traffic characteristics of a group of terminal devices. This process compares the traffic data of each terminal during the target period to screen out devices that deviate significantly from normal business patterns.

[0076] It should be noted that there is a difference in level and time sequence between the "system events" and "target events" here. System events refer to potential security issues or abnormal behaviors that are initially identified from massive logs or alarms through monitoring and analysis. They occur at the stage of event detection operations and are the basis for triggering further analysis and alarm aggregation. Target events are more specific and clear security events that are determined after the alarm results are aggregated through comprehensive analysis of system events and other alarm information. They contain more detailed information and a higher level of confirmation, and are the direct basis for initiating emergency response and repair strategies.

[0077] In other words, system events can be regarded as precursors or preliminary signals of target events, while target events are verified and aggregated security event entities.

[0078] Furthermore, the platform generates a first alarm result based on the target terminal device and abnormal traffic characteristics, providing a focus for further analysis. Then, by collecting business-related data within the target time period and extracting business traffic data related to the abnormal traffic characteristics from these data, a second alarm result is generated, which further refines the nature and scope of impact of the abnormal behavior.

[0079] After obtaining other alarm messages in the business system except the target alarm message, the platform continues to determine other terminal devices that have business associations with the target terminal device through correlation analysis. These devices also issue alarms, and based on this, generate aggregate alarm results that cover all related terminal and system events.

[0080] When the aggregated alarm results confirm that there is a target event in the business system, the platform selects the most appropriate "target script strategy" from a set of pre-configured script strategies based on the type of target event. For example, for a discovered network intrusion event, the platform will select a script containing operation instructions such as network isolation, system scanning, and log review. According to each script node in the target script strategy and its processing flow, the platform automatically or semi-automatically executes the operation instructions to repair the affected business system, such as isolating infected terminals and updating firewall rules.

[0081] After the business system is repaired, the platform generates a target prompt message indicating that the system has been repaired. This message is used to respond to the initial target alarm message and complete the closed-loop management of security incidents.

[0082] Through the embodiments of the present application, a combination of comprehensive scanning of network resources, construction of network topology models, fusion of multi-source alarm information and scripted repair processes is adopted to achieve the technical effects of accurate identification, rapid response and effective repair of network security incidents, thereby achieving the purpose of improving the overall network security protection capabilities, reducing the security incident processing time, and ensuring business continuity and data security.

[0083] In an exemplary embodiment, the abnormal traffic event detection method proposed in this application can be applied to a network security alarm analysis and handling system based on an extended detection and response platform, specifically:

[0084] As the complexity of the network security environment increases year by year, the improvement of security attack methods makes the offensive and defensive battles in cyberspace more intense. The traditional manual response method is completely insufficient to deal with the current huge amount of changing threat information and attacks day and night. In order to deal with different types of network attacks, a variety of security devices are deployed in various network areas, and these security devices generate a large number of logs and alarm events every day. These logs include both real attack logs and false alarms triggered by normal business. Security managers need to carefully distinguish and judge, which makes it difficult to quickly distinguish useful alarm information from a large number of logs, so as to quickly deal with emergencies. Furthermore, due to the high false alarm rate and the high business continuity requirements of banking business, in order to avoid business interruption, it is impossible to directly link other security devices to block with one click when an attack alarm occurs, and manual analysis and disposal are required.

[0085] Based on this, the embodiments of the present application can use certain technical means to clean, reduce and aggregate massive security logs, reduce the number of logs that need to be analyzed to below a certain order of magnitude, and sort out and partition existing assets, fully perform correlation analysis from a global perspective, and finally restore the complete attack chain to help security managers grasp the system's vulnerabilities. At the same time, using a semi-automatic prefabricated script handling mechanism to customize handling scripts for different types of attack events, security managers only need to make simple judgments and choices to achieve a rapid, semi-automatic response to security events, greatly shortening the identification and response time to threats, and thus improving emergency response efficiency.

[0086] Specifically, the embodiment of the present application establishes an extended detection and response platform and associates the specific asset information within the bank to improve the reduction of security alerts and event aggregation capabilities. At the same time, the micro-script capabilities built into the platform are used to achieve rapid process handling of security incidents and improve security operation efficiency. The main functions can be summarized as follows:

[0087] S1, asset information import: Through the platform's asset management module, solve the problem of asset dispersion and difficulty in positioning, classify and identify assets, sort out access relationships, and partition assets, etc., to lay the foundation for subsequent alarm analysis and event response. When an alarm occurs later, the platform can automatically combine the current asset information to determine whether normal business traffic in the current business scenario may generate such an alarm, and filter it.

[0088] S2, false alarm reduction and event aggregation: When an alarm occurs, the platform combines the environment to perform strong contextual correlation analysis. Figure 3 is a schematic diagram of an optional abnormal traffic event detection method according to an embodiment of the present application, such as Figure 3 As shown in the figure, a funnel-shaped three-level detection mechanism is used to achieve event aggregation and alarm reduction, and improve the accuracy of attack analysis. The three-level detection mechanism is as follows:

[0089] The first level is the event detection at the system event level. Each terminal has its own established business scenario and relatively fixed traffic characteristics. When completely different traffic characteristics appear, it can be judged that an abnormal attack event is discovered and the analysis results are output, which is the above-mentioned "generating the first alarm result based on the target terminal device and target traffic characteristics";

[0090] The second level is multi-alarm correlation detection, which is based on a large amount of correlation data and then deeply detects and deeply correlates abnormal traffic with other alarms to suppress false alarms, that is, "generating a second alarm result based on the target business traffic data and the first alarm result";

[0091] The third level is cross-terminal multi-source detection. After a successful network attack, it often penetrates horizontally across terminals. Correlating and aggregating multi-terminal and multi-source data traffic helps to confirm security incidents and restore attack scenarios, which is the above-mentioned "generating aggregated alarm results based on other terminal devices and the second alarm results."

[0092] Through the above three-level detection engine, high-quality, low-false-positive aggregate analysis results are output.

[0093] S3, process-based disposal: Use the platform's own visual process orchestration tool to orchestrate the response and disposal process of security incidents in the form of scripts, and use customized scripts to achieve intelligent operational process assurance for security incidents at different levels. In order to meet complex security operation and maintenance needs, the platform has built-in rich script nodes. By dragging nodes in a visual form and configuring a variety of operations, a customized disposal process is formed. It is also necessary to set up scripts for both automatic execution and manual execution strategies to meet emergency disposal requirements in different scenarios. For example, the platform can link various security devices to achieve one-click blocking, and pre-make a variety of scripts according to needs. Security managers can choose different blocking methods according to the actual business situation and execute them with one click.

[0094] Through the embodiments of the present application, the compatibility of the platform is ensured. The platform can aggregate and analyze various security logs of existing security devices in the bank, and adopt scripted handling. The script strategy is divided into two modes: manual execution and automatic execution. Manual execution is performed after an event associated with the script occurs. On the event details page, the workflow will display the script name and prompt the user to manually execute the triggered script. Automatic execution is for the administrator to selectively configure the trigger conditions. When the trigger conditions are met, the script is automatically executed. Furthermore, due to the particularity of banking business, most security incidents need to be handled manually, but the timeliness requirements for handling some major security incidents are high, and manual handling is difficult to meet the timeliness requirements. Therefore, these two modes are flexibly allocated to achieve efficient and timely closed-loop processing of security incidents.

[0095] In general, the embodiments of the present application enhance the aggregation and analysis capabilities of security data, and can clean and aggregate large amounts of diverse, high-value basic security data, promote the integration of various security devices within the bank and the sharing of security data, and achieve the elimination of false alarms and the aggregation of security incidents; and effectively improve the automated handling capabilities. Specifically, process orchestration technology is used to automatically execute different handling processes according to different types of risks, and the response handling process is orchestrated in the form of scripts. Once a security issue is discovered, the management personnel will initiate a predefined script to quickly close the loop on the security incident.

[0096] It is understandable that in the specific implementation of this application, related data such as user information is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0097] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0098] According to another aspect of the embodiments of the present application, there is also provided a detection device for abnormal traffic events for implementing the above-mentioned detection method for abnormal traffic events. Figure 4 As shown, the device comprises:

[0099] The acquisition module 402 is used to acquire the target alarm message sent by the business system;

[0100] An execution module 404 is used to perform a multi-level detection operation on the service traffic in the service system according to the target alarm message to determine an aggregate alarm result, wherein the multi-level detection operation means a detection operation performed in sequence according to the service type, other alarm messages and terminal devices, and the other alarm messages are different from the target alarm message;

[0101] Repair module 406 is used to repair the business system according to the operation instructions indicated by the target script policy when the aggregated alarm result indicates that the business system has a target event, wherein the target script policy includes script nodes, and one script node corresponds to one operation instruction.

[0102] As an optional solution, the above-mentioned device is also used to: obtain the hardware resources and software resources in the business system before obtaining the target alarm message sent by the business system; construct a target network topology model according to the association relationship between the hardware resources and the software resources, wherein the target network topology model is used to indicate the static layout of the hardware resources and the software resources, and the dynamic interaction relationship between the hardware resources and the software resources; control the business system to generate a target alarm message according to the target network topology model and the alarm trigger conditions.

[0103] As an optional scheme, the above-mentioned device is used to perform multi-level detection operations on the business traffic in the business system according to the target alarm message in the following manner to determine the aggregate alarm result: determine the system event according to the target alarm message; perform event detection operations according to the business type indicated by the system event to obtain the traffic characteristics of a group of terminal devices; determine the target terminal device from a group of terminal devices according to the traffic characteristics, wherein the target traffic characteristics of the target terminal device in the target time period are different from the remaining traffic characteristics of the remaining terminal devices, and a group of terminal devices consists of the target terminal device and the remaining terminals; generate a first alarm result according to the target terminal device and the target traffic characteristics.

[0104] As an optional solution, the above-mentioned device is also used to: after generating a first alarm result based on the target terminal equipment and target traffic characteristics, obtain business-related data in the target time period; determine the target business traffic data with the target traffic characteristics from the business-related data; and generate a second alarm result based on the target business traffic data and the first alarm result.

[0105] As an optional scheme, the above-mentioned device is also used to: after generating the second alarm result based on the target business traffic data and the first alarm result, obtain other alarm messages other than the target alarm message in the target time period; determine other terminal devices based on other alarm messages, wherein the other terminal devices represent terminal devices in the business system that have business associations with the target terminal device and have issued other alarm messages; generate an aggregated alarm result based on the other terminal devices and the second alarm result.

[0106] As an optional solution, the above-mentioned device is used to repair the business system according to the operating instructions indicated by the target script policy when the aggregated alarm result indicates that the business system has a target event in the following manner: determine the target script policy from a set of script policies according to the type of the target event, wherein the set of script policies is pre-obtained by calling a visual process orchestration tool to configure the script nodes; execute the operating instructions in sequence according to each script node in the target script policy and the processing flow between each script node to repair the business system; when the business system is repaired, generate a target prompt message, wherein the target prompt message indicates that the business system is repaired, and the target prompt message is used to respond to the target alarm message.

[0107] As an optional solution, the above-mentioned device is also used to: obtain hardware resources and software resources in the business system; construct a target network topology model based on the association relationship between the hardware resources and the software resources, wherein the target network topology model is used to indicate the static layout of the hardware resources and the software resources, as well as the dynamic interaction relationship between the hardware resources and the software resources; control the business system to generate a target alarm message according to the target network topology model and the alarm triggering condition; obtain the target alarm message; determine the system event according to the target alarm message; perform event detection operations according to the business type indicated by the system event to obtain the traffic characteristics of a group of terminal devices; determine the target terminal device from a group of terminal devices according to the traffic characteristics, wherein the target traffic characteristics of the target terminal device in the target time period are different from the remaining traffic characteristics of the remaining terminal devices, and a group of terminal devices consists of the target terminal device and the remaining terminals; generate a first alarm result according to the target terminal device and the target traffic characteristics; after generating the first alarm result, by obtaining the business association in the target time period data, and determine the target business flow data with the target flow characteristics from the business association data; generate a second alarm result according to the target business flow data and the first alarm result; obtain other alarm messages in the target time period; determine other terminal devices based on other alarm messages, wherein other terminal devices represent terminal devices in the business system that have business associations with the target terminal device and have issued other alarm messages; generate an aggregated alarm result according to other terminal devices and the second alarm result; when the aggregated alarm result indicates that there is a target event in the business system, determine the target script strategy from a set of script strategies obtained in advance by calling a visual process orchestration tool to configure the script nodes according to the type of the target event; execute the operation instructions in sequence according to each script node in the target script strategy and the processing flow between each script node to repair the business system; when the business system is repaired, generate a target prompt message, wherein the target prompt message indicates that the business system is repaired, and the target prompt message is used to respond to the target alarm message.

[0108] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0109] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0110] According to one aspect of the present application, a computer program product is provided. The computer program product includes a computer program.

[0111] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0112] Figure 5 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown.

[0113] It should be noted that Figure 5 The computer system 500 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0114] like Figure 5 As shown, the computer system 500 includes a central processing unit 501 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 502 (ROM) or the program loaded from the storage part 508 to the random access memory 503 (RAM). Various programs and data required for system operation are also stored in the random access memory 503. The central processing unit 501, the read-only memory 502 and the random access memory 503 are connected to each other through a bus 504. The input / output interface 505 (Input / Output interface, i.e., I / O interface) is also connected to the bus 504.

[0115] The following components are connected to the input / output interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a local area network card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed so that a computer program read therefrom is installed into the storage section 508 as needed.

[0116] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processor 501, various functions defined in the system of the present application are executed.

[0117] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processor 501, various functions provided by the embodiment of the present application are performed.

[0118] According to another aspect of the embodiment of the present application, an electronic device for implementing the above-mentioned abnormal traffic event detection method is also provided. The electronic device may be Figure 1 The terminal device or server shown in the figure. This embodiment is described by taking the electronic device as a terminal device as an example. Figure 6 As shown, the electronic device includes a memory 602 and a processor 604. The memory 602 stores a computer program, and the processor 604 is configured to execute the steps in any of the above method embodiments through the computer program.

[0119] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0120] Optionally, in this embodiment, the above-mentioned processor can be configured to execute the methods in each embodiment of the present application through a computer program.

[0121] Alternatively, a person skilled in the art may understand that: Figure 6 The structure shown is for illustration only. Figure 6 The structure of the electronic device is not limited. Figure 6 More or fewer components (such as network interfaces, etc.) as shown in, or with Figure 6 Different configurations shown.

[0122] Among them, the memory 602 can be used to store software programs and modules, such as the program instructions / modules corresponding to the abnormal traffic event detection method and device in the embodiment of the present application. The processor 604 executes various functional applications and data processing by running the software programs and modules stored in the memory 602, that is, to implement the above-mentioned abnormal traffic event detection method. The memory 602 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 602 may further include a memory remotely located relative to the processor 604, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 602 can be specifically, but not limited to, used to store information such as target alarm messages and target script strategies. As an example, such as Figure 6 As shown, the memory 602 may include but is not limited to the acquisition module 402, execution module 404 and repair module 406 in the abnormal traffic event detection device. In addition, it may also include but is not limited to other module units in the abnormal traffic event detection device, which will not be repeated in this example.

[0123] Optionally, the transmission device 606 is used to receive or send data via a network. Specific examples of the network may include a wired network and a wireless network. In one example, the transmission device 606 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 606 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0124] In addition, the electronic device further includes: a display 608 for displaying the processing flow of the target warning message and the target scenario strategy; and a connection bus 610 for connecting the various module components in the electronic device.

[0125] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. The nodes may form a peer-to-peer network, and any form of computing device, such as a server, terminal or other electronic device, may become a node in the blockchain system by joining the peer-to-peer network.

[0126] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes the abnormal traffic event detection method provided in various optional implementations of the above-mentioned abnormal traffic event detection.

[0127] Optionally, in this embodiment, the above-mentioned computer-readable storage medium can be configured to store data for executing the methods in various embodiments of the present application.

[0128] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0129] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0130] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for one or more electronic devices to execute all or part of the steps of the methods described in each embodiment of the present application.

[0131] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0132] In the several embodiments provided in the present application, it should be understood that the disclosed application can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0133] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0134] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0135] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting abnormal traffic events, characterized in that: include: Get the target alarm message sent by the business system; Performing a multi-level detection operation on the service traffic in the service system according to the target alarm message to determine an aggregate alarm result, wherein the multi-level detection operation represents a detection operation performed in sequence according to the service type, other alarm messages and terminal devices, and the other alarm messages are different from the target alarm message; When the aggregate alarm result indicates that the business system has a target event, the business system is repaired according to the operation instructions indicated by the target script policy, wherein the target script policy includes a script node, and one script node corresponds to one operation instruction.

2. The method according to claim 1, characterized in that Before obtaining the target alarm message sent by the business system, the method further includes: Acquiring hardware resources and software resources in the business system; Constructing a target network topology model according to the association relationship between the hardware resources and the software resources, wherein the target network topology model is used to indicate the static layout of the hardware resources and the software resources, and the dynamic interaction relationship between the hardware resources and the software resources; The service system is controlled to generate the target alarm message according to the target network topology model and the alarm triggering condition.

3. The method according to claim 1, characterized in that The performing a multi-level detection operation on the service traffic in the service system according to the target alarm message to determine an aggregate alarm result includes: Determine a system event according to the target alarm message; Performing event detection operations according to the service type indicated by the system event to obtain traffic characteristics of a group of terminal devices; Determine a target terminal device from the group of terminal devices according to the traffic characteristics, wherein the target traffic characteristics of the target terminal device in the target period are different from the remaining traffic characteristics of the remaining terminal devices, and the group of terminal devices consists of the target terminal device and the remaining terminals; A first alarm result is generated according to the target terminal device and the target traffic characteristics.

4. The method according to claim 3, characterized in that After generating the first alarm result according to the target terminal device and the target traffic characteristics, the method further includes: Acquire the business-related data in the target period; Determining target service flow data having the target flow characteristics from the service association data; A second alarm result is generated according to the target service flow data and the first alarm result.

5. The method according to claim 4, characterized in that After generating the second alarm result according to the target service flow data and the first alarm result, the method further includes: Acquire the other warning messages except the target warning message in the target time period; Determine other terminal devices based on the other alarm messages, wherein the other terminal devices represent terminal devices in the service system that have a service association with the target terminal device and have issued the other alarm messages; The aggregated alarm result is generated according to the other terminal devices and the second alarm result.

6. The method according to claim 1, characterized in that When the aggregate alarm result indicates that the business system has a target event, repairing the business system according to the operation instructions indicated by the target scenario strategy includes: Determining the target script strategy from a set of script strategies according to the type of the target event, wherein the set of script strategies is obtained in advance by calling a visual process orchestration tool to configure the script node; Executing the operation instructions in sequence according to each of the scenario nodes in the target scenario strategy and the processing flow between each of the scenario nodes to repair the business system; In the case where the business system is repaired, a target prompt message is generated, wherein the target prompt message indicates that the business system is repaired, and the target prompt message is used to respond to the target alarm message.

7. The method according to claim 1, characterized in that The method further comprises: Acquiring hardware resources and software resources in the business system; Constructing a target network topology model according to the association relationship between the hardware resources and the software resources, wherein the target network topology model is used to indicate the static layout of the hardware resources and the software resources, and the dynamic interaction relationship between the hardware resources and the software resources; Controlling the service system to generate the target alarm message according to the target network topology model and the alarm triggering condition; Obtaining the target warning message; Determine a system event according to the target alarm message; Perform the event detection operation according to the service type indicated by the system event to obtain traffic characteristics of a group of terminal devices; Determine a target terminal device from the group of terminal devices according to the traffic characteristics, wherein the target traffic characteristics of the target terminal device in the target period are different from the remaining traffic characteristics of the remaining terminal devices, and the group of terminal devices consists of the target terminal device and the remaining terminals; generate a first alarm result according to the target terminal device and the target traffic characteristics; After the first alarm result is generated, the target service flow data having the target flow characteristics is determined from the service association data by acquiring the service association data in the target time period; and a second alarm result is generated according to the target service flow data and the first alarm result; Obtain the other alarm messages in the target time period; determine other terminal devices based on the other alarm messages, wherein the other terminal devices represent terminal devices in the business system that have a business association with the target terminal device and have issued the other alarm messages; generate the aggregate alarm result according to the other terminal devices and the second alarm result; In the case where the aggregate alarm result indicates that the business system has the target event, determining the target script strategy from a set of script strategies pre-obtained by calling a visual process orchestration tool to configure script nodes according to the type of the target event; Execute the operation instructions in sequence according to each scenario node in the target scenario strategy and the processing flow between each scenario node to repair the business system; In the case where the business system is repaired, a target prompt message is generated, wherein the target prompt message indicates that the business system is repaired, and the target prompt message is used to respond to the target alarm message.

8. A detection device for abnormal traffic events, characterized in that: include: An acquisition module is used to acquire a target alarm message sent by a business system; An execution module, configured to perform a multi-level detection operation on the service traffic in the service system according to the target alarm message, and determine an aggregate alarm result, wherein the multi-level detection operation represents a detection operation performed in sequence according to the service type, other alarm messages and terminal devices, and the other alarm messages are different from the target alarm message; A repair module is used to repair the business system according to the operation instructions indicated by the target script policy when the aggregate alarm result indicates that the business system has a target event, wherein the target script policy includes a script node, and one script node corresponds to one operation instruction.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein the computer program can be executed by an electronic device to perform the method described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 7 are implemented.

11. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 7 through the computer program.

Images