SASE network terminal abnormal traffic detection and speed limit method, device and storage medium

Abstract

The present application provides a method, device and storage medium for detecting and limiting abnormal traffic in a SASE network terminal, and relates to the field of network security technology. The following steps are included: S1, data collection; S2, data modeling, using multidimensional Poisson distribution to model network traffic; S3, model parameter estimation, estimating the parameters of the multidimensional Poisson distribution model to obtain the average arrival rate and average traffic size of events in each dimension; S4, anomaly detection, calculating the probability density function value of the current traffic data, if the probability density function value of the current traffic data is lower than the probability density threshold, it is identified as abnormal traffic; S5, alarm, when abnormal traffic is detected, trigger an alarm and limit the speed of the abnormal traffic. By introducing multidimensional Poisson distribution, the present application simultaneously incorporates multiple influencing factors into the modeling, captures the correlation between multiple random events, and thus more accurately reflects the complexity and diversity of network traffic.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device and storage medium for detecting and limiting abnormal traffic in a SASE network terminal. Background Art

[0002] SASE (Secure Access Service Edge) is an emerging network architecture and security solution. SASE integrates network security functions and network edge services into a unified, cloud-native platform to provide a more efficient and secure network access and connection experience.

[0003] The core goal of the SASE system is to integrate network security functions and network access control functions to provide integrated security and network services. The SASE system combines network edge and cloud services to provide users with more flexible, secure and efficient network connections and access. In the process of achieving this goal, network traffic monitoring and speed limiting functions are crucial.

[0004] SASE systems face various types of network traffic from various sources, such as web browsing, video transmission, real-time communication, and big data transmission. These traffics have different characteristics and requirements, and the system needs to be able to accurately classify and process them to achieve personalized services. Network traffic changes very quickly, especially in cloud environments, where users' access patterns and data transmission requirements may change at any time. SASE systems need to be able to monitor traffic changes in real time and quickly make corresponding adjustments and optimizations. Summary of the invention

[0005] The present application provides a SASE network terminal abnormal traffic detection and speed limiting method, device and storage medium based on multi-dimensional Poisson distribution, so as to at least solve the above technical problems existing in the prior art.

[0006] According to a first aspect of the present application, a SASE network terminal abnormal traffic detection and rate limiting method is provided, comprising the following steps: S1, data collection, obtaining real-time traffic data; S2, data modeling, uses multidimensional Poisson distribution to model network traffic and obtains a multidimensional Poisson distribution model; S3, model parameter estimation, estimates the parameters of the multidimensional Poisson distribution model to obtain the average arrival rate and average flow size of events in each dimension; S4, abnormality detection, calculating the probability density function value of the current traffic data according to the multidimensional Poisson distribution model, if the probability density function value of the current traffic data is lower than the probability density threshold, it is identified as abnormal traffic; S5, alarm, when abnormal traffic is detected, an alarm is triggered and the speed of the abnormal traffic is limited.

[0007] In certain embodiments of the first aspect of the present application, in S1, the acquired traffic data is also preprocessed, including data cleaning, removal of outliers and missing value processing.

[0008] In certain embodiments of the first aspect of the present application, in S2, the method for modeling network traffic using multidimensional Poisson distribution is as follows: Assuming that network traffic has n dimensions, we define n parameters , , …, Represents the average number of events in each dimension. Assuming that the network traffic data is X= ( , , …, ),in, , , …, Respectively represent the number of traffic occurrences in each dimension, and the joint probability is expressed as:

[0009] in, is the joint probability, Represents the total average number of occurrences of the event across all dimensions.

[0010] In certain embodiments of the first aspect of the present application, in S3, the parameters of the multidimensional Poisson distribution model are estimated using maximum likelihood estimation and least squares method.

[0011] In certain embodiments of the first aspect of the present application, after S4, the step further includes: Dynamically adjust and set a second threshold. If the current traffic exceeds the second threshold, it is considered as abnormal data.

[0012] In certain embodiments of the first aspect of the present application, in S5, when abnormal traffic is detected, a log of the abnormal event is also generated for subsequent analysis and auditing.

[0013] In certain embodiments of the first aspect of the present application, in S1, the specific method of data collection is: using a traffic monitoring device at the POP point to obtain real-time traffic data, including the arrival time and size of the traffic flow.

[0014] According to a second aspect of the present application, an electronic device is provided, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the present application.

[0015] According to a third aspect of the present application, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the present application.

[0016] Compared with the prior art, this application has the following beneficial effects: 1. Traditional network traffic monitoring methods usually use a single probability distribution to model traffic. However, this application introduces a multi-dimensional Poisson distribution to simultaneously incorporate multiple influencing factors into the modeling, capturing the correlation between multiple random events, thereby more accurately reflecting the complexity and diversity of network traffic.

[0017] 2. This application can monitor changes in network traffic in real time, and dynamically adjust model parameters and thresholds according to actual conditions to adapt to changes in the network environment and traffic, and achieve timely discovery and processing of abnormal traffic.

[0018] 3. This application can not only help discover abnormal situations in the network, but also adopt corresponding speed limit strategies to limit abnormal traffic, which can enhance the security of the network, prevent network attacks and abuse of traffic, and optimize the use of network bandwidth and improve network performance.

[0019] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become readily understood. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, wherein: In the drawings, the same or corresponding reference numerals represent the same or corresponding parts.

[0021] Figure 1 A schematic diagram of the implementation process of the first embodiment of the present application is shown.

[0022] Figure 2 A schematic diagram of the implementation process of the second embodiment of the present application is shown.

[0023] Figure 3 A schematic diagram of the structure of an electronic device according to a third embodiment of the present application is shown. DETAILED DESCRIPTION

[0024] In order to make the purpose, features, and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0025] Embodiment 1: Please refer to Figure 1 , this embodiment 1 provides a SASE network terminal abnormal traffic detection and rate limiting method, including the following steps: S1, data collection, obtains real-time traffic data.

[0026] The specific method of data collection is: use traffic monitoring equipment (or network equipment, or traffic sensor) at the POP point to obtain real-time traffic data, including the arrival time and size of the traffic flow. It should be noted that POP is the abbreviation of point-of-presence, which stands for point of entry.

[0027] During the data collection process, the acquired traffic data is also preprocessed, including data cleaning, removal of outliers and missing value processing, to ensure the accuracy and completeness of the data.

[0028] S2, data modeling, in abnormal network traffic detection and speed limiting, multidimensional Poisson distribution is used to model network traffic and obtain a multidimensional Poisson distribution model.

[0029] Multidimensional Poisson distribution is a statistical distribution used for multidimensional data modeling. It can capture the correlation between multiple random events at the same time. In network traffic, it is usually necessary to pay attention to traffic conditions in multiple dimensions, such as source IP address, destination IP address, port number, protocol type, etc. For these different dimensions of traffic data, we can establish multiple independent Poisson distributions.

[0030] The specific method of modeling network traffic using multidimensional Poisson distribution is as follows: Assuming that network traffic has n dimensions, we define n parameters , , …, Represents the average number of events in each dimension. Assuming that the network traffic data is X= ( , , …, ),in, , , …, Respectively represent the number of traffic occurrences in each dimension, and the joint probability is expressed as:

[0031] in, is the joint probability, Represents the total average number of occurrences of the event across all dimensions.

[0032] S3, model parameter estimation, estimates the parameters of the multidimensional Poisson distribution model to obtain the average arrival rate and average flow size of events in each dimension.

[0033] In order to obtain the average arrival rate and average traffic size of events in each dimension, we need to estimate the parameters of the multidimensional Poisson distribution model. This is usually achieved through maximum likelihood estimation (MLE).

[0034] 1. Collect data: First, collect the traffic data x1, x2, ..., xn in each dimension.

[0035] 2. Construct the likelihood function: According to the joint probability distribution of the multidimensional Poisson distribution, construct the likelihood function:

[0036] Find the log-likelihood function: For ease of solution, the log-likelihood function is usually maximized instead of directly maximizing the likelihood function. The log-likelihood function is:

[0037] Take partial derivatives and set them equal to 0: Take the partial derivatives with respect to each parameter λi and set them equal to 0 to find the parameter value that maximizes the log-likelihood function.

[0038] The solution is: λi=xi But it should be noted here that the above solution is based on a single observation. In practical applications, we usually have multiple observations (i.e., traffic data for multiple time periods), so we need to average these observations to estimate λi.

[0039] Estimating the average arrival rate and average flow size: The average arrival rate λi can be estimated by averaging all observations:

[0040] where m is the number of observations and xij is the jth observation in the ith dimension. The average flow size in this context is the same as the average arrival rate, since the intensity parameter λi in the Poisson distribution represents both the average arrival rate per unit time and the average flow size per unit time (in a given time unit).

[0041] Through maximum likelihood estimation, we can obtain the average arrival rate and average flow size in each dimension.

[0042] This embodiment preferably uses maximum likelihood estimation and least squares method to estimate the parameters of the multidimensional Poisson distribution model.

[0043] S4, anomaly detection, after establishing the multidimensional Poisson distribution model, the system can monitor network traffic in real time. According to the multidimensional Poisson distribution model, the probability density function value of the current traffic data is calculated. If the probability density function value of the current traffic data is low, much smaller than the expected probability density function value, then it can be considered that this is an abnormal traffic.

[0044] The probability density function can be further written as:

[0045] This formula is the specific expression for calculating the probability density function value (or probability mass function value) of given traffic data under multidimensional Poisson distribution.

[0046] In practical applications, when we observe a new set of traffic data (x′1, x′2, …, x′n), we can substitute this set of data into the above formula to calculate the probability density function value (or probability mass function value) of this set of data. If this value is much smaller than a certain threshold we set based on historical data or expectations, then we can consider this set of traffic data to be abnormal.

[0047] It should be noted that since the Poisson distribution is a discrete distribution, in actual calculations, we usually use the cumulative distribution function (CDF) or probability estimates based on observed data for anomaly detection rather than directly comparing the probability density function values ​​of a single observation. However, in the context of multidimensional Poisson distribution, directly calculating the joint probability mass function value is still an effective method, especially when the events in each dimension are relatively independent and the number of observations is small.

[0048] In addition, since the calculation of the probability density function value may involve a large number of multiplication and division operations, it may be necessary to pay attention to the issues of numerical stability and computational efficiency in practical applications.

[0049] Therefore, this embodiment sets a probability density threshold. If the probability density function value of the current traffic data is lower than the probability density threshold, it is identified as abnormal traffic.

[0050] S5, alarm, when abnormal traffic is detected, an alarm is triggered to notify the administrator or network management personnel to take timely measures and limit the speed of the abnormal traffic.

[0051] At the same time, logs of abnormal events are also generated for subsequent analysis and auditing.

[0052] Embodiment 2: Please refer to Figure 2 Based on the first embodiment, the second embodiment adds a dynamic adjustment step after S4.

[0053] That is, the overall approach includes the following steps: S1, data collection, obtaining real-time traffic data; S2, data modeling, uses multidimensional Poisson distribution to model network traffic and obtains a multidimensional Poisson distribution model; S3, model parameter estimation, estimates the parameters of the multidimensional Poisson distribution model to obtain the average arrival rate and average flow size of events in each dimension; S4, abnormality detection, calculating the probability density function value of the current traffic data according to the multidimensional Poisson distribution model, if the probability density function value of the current traffic data is lower than the probability density threshold, it is identified as abnormal traffic; S5, dynamic adjustment, based on historical traffic data and statistical analysis, a certain threshold can be set to determine whether it is abnormal traffic. For example, a second threshold is set, and if the current traffic exceeds the second threshold, it is considered abnormal data.

[0054] To set the second threshold based on historical traffic data and statistical analysis, and fully explain the dynamic adjustment steps, we can follow the following steps: 1. Historical traffic data analysis 1. Data collection: First, collect the traffic data of the website over the past period of time, including key indicators such as visits, visit time, page views, user behavior, etc. Ensure the integrity and accuracy of the data for subsequent statistical analysis.

[0055] 2. Data preprocessing: Clean the collected data and remove invalid data such as abnormal values ​​and duplicate values. Standardize the data for unified comparison and analysis.

[0056] 3. Statistical analysis: Calculate the mean, standard deviation, median and other statistics of traffic data to understand the overall distribution characteristics of the data. Use visualization tools such as box plots and histograms to intuitively display the distribution of data. Analyze the trends and periodic changes of traffic data to identify potential abnormal patterns.

[0057] 2. Set the first threshold 1. Based on statistical analysis: A reasonable first threshold is set based on the statistical analysis results of historical traffic data. For example, the number of visits exceeding the average plus or minus two standard deviations can be considered abnormal, thus determining the first threshold.

[0058] 2. Business experience adjustment: Based on business experience and actual needs, the first threshold is adjusted appropriately to ensure that the first threshold can effectively identify abnormal traffic and does not falsely report excessive normal traffic.

[0059] 3. Set the second threshold 1. Dynamic adjustment strategy: Based on the first threshold, the second threshold is dynamically adjusted according to real-time traffic data and statistical analysis results. The second threshold can be set to a stricter or looser threshold than the first threshold, depending on business needs and the actual situation of traffic data.

[0060] 2. Statistical analysis method: Use time series analysis methods such as moving average method and exponential smoothing method to predict and analyze the trend of real-time traffic data. Dynamically adjust the second threshold according to the prediction results and trend changes.

[0061] 3. Machine learning model: Consider using machine learning models (such as supervised learning algorithms, unsupervised learning algorithms, etc.) to automatically identify anomalies and trends in traffic data. By training the model, you can automatically identify and set a reasonable second threshold.

[0062] 4. Dynamic Adjustment Steps 1. Real-time monitoring: Continuously monitor and analyze real-time traffic data to ensure timely detection of abnormal traffic.

[0063] 2. Threshold comparison: compare the real-time traffic data with the first threshold and the second threshold. If the real-time traffic exceeds the first threshold but does not reach the second threshold, an early warning signal is issued; if the real-time traffic exceeds the second threshold, the exception handling mechanism is triggered.

[0064] 3. Exception handling: Further analyze and handle the identified abnormal traffic. Take corresponding defense measures (such as restricting access, strengthening identity authentication, etc.) according to the type and characteristics of the abnormal traffic.

[0065] 4. Feedback and optimization: Feedback and optimization of the first and second thresholds are performed based on the results of exception processing and changes in real-time traffic data. Continuously iterate and adjust threshold settings and dynamic adjustment strategies to improve the accuracy and efficiency of abnormal traffic identification.

[0066] Through the above steps, we can set the second threshold based on historical traffic data and statistical analysis, and fully explain the steps of dynamic adjustment. This helps us identify and handle abnormal traffic more effectively and ensure user data security.

[0067] Combine user behavior and access patterns to conduct behavioral analysis on traffic data. If you find a traffic pattern that is obviously inconsistent with normal user behavior, it may be abnormal traffic. The following is a specific case analysis to illustrate how to find a traffic pattern that is obviously inconsistent with normal user behavior and determine that it may be abnormal traffic.

[0068] Case background: An e-commerce platform recently detected significant anomalies in its website traffic. Under normal circumstances, user access patterns should show certain regularity and stability, such as peak access time, user stay time, page browsing path, etc. However, the platform found that some traffic data clearly deviated from these normal patterns.

[0069] Traffic data analysis can be performed from four aspects: 1. Abnormal distribution of access time: Under normal circumstances, user access time should show a certain degree of volatility, but the overall trend is stable. However, the platform found that the number of visits in certain time periods suddenly surged, and these time periods did not match the previous peak access periods. For example, the number of visits was abnormally high during non-normal working hours such as late at night or early in the morning.

[0070] 2. Abnormal page browsing path: Under normal circumstances, users should browse pages in a certain logical order, such as going from the home page to the product details page, and then to the shopping cart or checkout page. However, the platform found that some users' browsing paths clearly did not conform to this logic. For example, a large number of users directly visited the product details page without going through the home page or other related pages.

[0071] 3. Abnormal user stay time: Under normal circumstances, the time a user stays on a page should reflect their interest and engagement in the content. However, the platform found that some users stayed on the page for a very short time, even lower than the normal browsing time. This indicates that these users may not be really interested in the page content, but visit for some other reason.

[0072] 4. Abnormal access sources: Under normal circumstances, user access sources should be diverse, such as search engines, social media, direct access, etc. However, the platform found that some access sources were obviously concentrated on a specific IP address or domain name. This indicates that these visits may not come from real users, but from a specific entity or machine.

[0073] Next, we can judge abnormal traffic based on the above analysis. The platform judges that these traffic data are obviously inconsistent with normal user behavior and may be abnormal traffic. Specifically, the following are: abnormal access time distribution, indicating that these visits may not be initiated by real users, but by some automated tools or scripts. Abnormal page browsing path, indicating that these users may not actually participate in the browsing and shopping process of the website, but visit for a specific purpose. Abnormal user stay time, indicating that these users may not be interested in the content of the page, but quickly browse or skip the page for some reason. Abnormal access source, indicating that these visits may not come from real user groups, but attacks or crawler behaviors initiated by a specific entity or machine.

[0074] In summary, the platform determines that these traffic data are abnormal traffic and recommends taking the following measures to deal with them: strengthen traffic monitoring and analysis capabilities to promptly discover and identify abnormal traffic; track and trace abnormal traffic to determine its source and purpose; take corresponding defense measures based on the type and characteristics of abnormal traffic, such as restricting access, strengthening identity authentication, and improving system security; strengthen user education and safety awareness, guide users to use the website correctly and avoid being affected by abnormal traffic.

[0075] Through the implementation of the above measures, the platform can more effectively deal with the challenges brought by abnormal traffic, ensure the normal operation of its website and the data security of users. This method can automatically learn and identify abnormal patterns and make judgments on complex abnormal traffic.

[0076] S6, alarm, when abnormal traffic is detected, an alarm is triggered and the speed of the abnormal traffic is limited.

[0077] Embodiment three: According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0078] Figure 3 A schematic block diagram of an example electronic device that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0079] like Figure 3As shown, the device includes a computing unit, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) or a computer program loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for the operation of the device can also be stored. The computing unit, ROM, and RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus.

[0080] Multiple components in the device are connected to the I / O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as disks, optical disks, etc.; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunication networks.

[0081] The computing unit may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of computing units include, but are not limited to, central processing units (CPUs), graphics processing units (GPUs), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit performs the various methods and processes described above, such as the SASE network terminal abnormal traffic detection and speed limit method described in Example 1. For example, in some embodiments, the SASE network terminal abnormal traffic detection and speed limit method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the computing unit, one or more steps of the SASE network terminal abnormal traffic detection and speed limit method described above may be performed. Alternatively, in other embodiments, the computing unit may be configured to perform the SASE network terminal abnormal traffic detection and speed limit method in any other appropriate manner (e.g., by means of firmware).

[0082] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0083] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0084] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0085] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0086] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0087] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0088] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0089] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0090] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A SASE network terminal abnormal traffic detection and rate limiting method, characterized in that: The following steps are involved: S1, data collection, obtaining real-time traffic data; S2, data modeling, uses multidimensional Poisson distribution to model network traffic and obtains a multidimensional Poisson distribution model; S3, model parameter estimation, estimates the parameters of the multidimensional Poisson distribution model to obtain the average arrival rate and average flow size of events in each dimension; S4, abnormality detection, calculating the probability density function value of the current traffic data according to the multidimensional Poisson distribution model, if the probability density function value of the current traffic data is lower than the probability density threshold, it is identified as abnormal traffic; S5, alarm, when abnormal traffic is detected, an alarm is triggered and the speed of the abnormal traffic is limited.

2. The SASE network terminal abnormal traffic detection and speed limiting method according to claim 1 is characterized in that: In S1, the acquired traffic data is also preprocessed, including data cleaning, removal of outliers and missing value processing.

3. The SASE network terminal abnormal traffic detection and speed limiting method according to claim 1 is characterized in that: In S2, the method of modeling network traffic using multidimensional Poisson distribution is as follows: Assuming that network traffic has n dimensions, we define n parameters , , …, Represents the average number of events in each dimension. Assuming that the network traffic data is X= ( , , …, ),in, , , …, Respectively represent the number of traffic occurrences in each dimension, and the joint probability is expressed as: in, is the joint probability, Represents the total average number of occurrences of the event across all dimensions.

4. The SASE network terminal abnormal traffic detection and rate limiting method according to claim 1 is characterized in that: In S3, the parameters of the multidimensional Poisson distribution model are estimated using maximum likelihood estimation and least squares method.

5. The SASE network terminal abnormal traffic detection and rate limiting method according to claim 1 is characterized in that: After S4, it also includes: Dynamically adjust and set a second threshold. If the current traffic exceeds the second threshold, it is considered as abnormal data.

6. The SASE network terminal abnormal traffic detection and rate limiting method according to claim 1 is characterized in that: In S5, when abnormal traffic is detected, a log of the abnormal event is also generated for subsequent analysis and auditing.

7. The SASE network terminal abnormal traffic detection and rate limiting method according to claim 1 is characterized in that: In S1, the specific method of data collection is: using traffic monitoring equipment at the POP point to obtain real-time traffic data, including the arrival time and size of the traffic flow.

8. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 7.

Images