Industrial Internet abnormal traffic detection method and device

Abstract

The present invention discloses an abnormal traffic detection method and device for the industrial Internet, the method comprising: obtaining traffic data of multiple devices in the industrial Internet in continuous time periods; calculating the variance of the traffic data of all devices in each time period; calculating the difference between the variance of the traffic data of all devices in the current time period and the variance of the traffic data of all devices in the previous time period; judging whether there is abnormal traffic in the industrial Internet according to the difference; when it is judged that there is abnormal traffic, determining the time period in which each traffic data exists; when there is no traffic data in the time period in which the traffic data exists, judging the traffic data to be abnormal traffic data. Real-time and accurate detection of abnormal traffic in the industrial Internet can be achieved by statistical means, which improves the efficiency and real-time performance of detection.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal flow detection, and in particular to a method and device for detecting abnormal flow in an industrial Internet. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Abnormal traffic in the industrial Internet network can seriously affect the normal operation of industrial facilities, so monitoring abnormal traffic is crucial. At present, many studies on abnormal traffic detection will detect and analyze by maintaining the status of each flow. However, since the scale of the industrial Internet is usually large, in the actual application process, maintaining the status of each flow will bring huge space overhead, and it is difficult to find problems in a large-scale network in time, so it is difficult to perform online detection on the industrial Internet network.

[0004] Currently, abnormal traffic in industrial Internet networks is mainly detected through deep learning methods. However, this type of traffic anomaly detection method requires the use of a large amount of labeled data for training, and the model construction and training process is relatively complex and time-consuming, and cannot flexibly adapt to the changing industrial Internet environment. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes an industrial Internet abnormal traffic detection method and device, which can realize real-time and accurate detection of industrial Internet abnormal traffic through statistical methods, thereby improving the efficiency and real-time performance of detection.

[0006] To achieve the above object, the present invention adopts the following technical solution:

[0007] First, a method for detecting abnormal traffic in the industrial Internet is proposed, including:

[0008] Obtain traffic data of multiple devices in the Industrial Internet over a continuous period of time;

[0009] Calculate the variance of all device traffic data in each time period;

[0010] Calculate the difference between the variance of all device flow data in the current time period and the variance of all device flow data in the previous time period;

[0011] According to the difference, determine whether there is abnormal traffic in the industrial Internet;

[0012] When it is determined that abnormal traffic exists, the time period in which each traffic data exists is determined;

[0013] When there is no flow data within the time period in which the flow data exists, the flow data is determined to be abnormal flow data.

[0014] Furthermore, the characteristic information of each flow data is extracted; the characteristic information of all flow data is counted using the Sketch table structure to construct an industrial Internet table structure, in which the horizontal direction of the industrial Internet table structure represents different devices, and the vertical direction represents different times; based on the industrial Internet table structure, the variance of the flow data of all devices in each time period is calculated and determined.

[0015] Furthermore, the feature information includes quintuple information and statistical feature information.

[0016] Furthermore, a Bloom filter is used to record the node information of each node in the industrial Internet table structure, and the node information judged to have abnormal traffic in the industrial Internet is input into the Bloom filter corresponding to the node; the Bloom filter determines whether the input node information is recorded; when it is not recorded, the traffic data corresponding to the node information is judged to be abnormal.

[0017] Furthermore, when the difference is greater than the set detection threshold, it is determined that abnormal traffic exists in the industrial Internet.

[0018] Furthermore, the detection threshold is the mean of the variance of all device traffic data in multiple time periods without abnormal traffic.

[0019] In the second aspect, an industrial Internet abnormal traffic detection device is proposed, comprising:

[0020] A flow acquisition unit, used to acquire flow data of multiple devices in the industrial Internet within a continuous time period;

[0021] Traffic data statistics unit, used to calculate the variance of all device traffic data in each time period;

[0022] A difference calculation unit, used to calculate the difference between the variance of all device flow data in the current time period and the variance of all device flow data in the previous time period;

[0023] A traffic anomaly judgment unit is used to judge whether there is abnormal traffic in the industrial Internet based on the difference degree;

[0024] The abnormal flow determination unit is used to determine the time period in which each flow data exists when it is determined that abnormal flow exists; when there is no flow data within the time period in which the flow data exists, determine that the flow data is abnormal flow data.

[0025] In a third aspect, a computer device is provided, the device comprising:

[0026] a processor adapted to execute a computer program;

[0027] A memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, an industrial Internet abnormal traffic detection method disclosed in Example 1 is implemented.

[0028] In a fourth aspect, a computer-readable storage medium is proposed, wherein the computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor and executing an industrial Internet abnormal traffic detection method proposed in the first aspect.

[0029] In a fifth aspect, a computer program product is proposed, which includes a computer program. When the computer program is executed by a processor, it implements an industrial Internet abnormal traffic detection method proposed in the first aspect.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] The present invention proposes a method and device for detecting abnormal traffic in the industrial Internet. The method calculates the variance of the traffic data of all devices in each time period; then calculates the difference between the variance of the traffic data of all devices in the current time period and the variance of the traffic data of all devices in the previous time period; according to the difference, determines whether there is abnormal traffic in the industrial Internet; when it is determined that there is abnormal traffic, determines the time period in which each traffic data exists; when there is no traffic data in the time period in which the traffic data exists, determines that the traffic data is abnormal traffic data. Through statistics, it is possible to simultaneously realize real-time detection of the traffic of multiple devices in the industrial Internet and location of abnormal traffic; the calculation process is simple, improves the real-time performance of traffic anomaly detection, and can flexibly adapt to various detection and analysis scenarios.

[0032] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings in the specification, which constitute a part of the present application, are used to provide further understanding of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0034] Figure 1 A flow chart of an abnormal traffic detection method for industrial Internet disclosed in an embodiment;

[0035] Figure 2 A flow chart of traffic anomaly detection and analysis disclosed in the embodiment;

[0036] Figure 3 It is a diagram of the Sketch table structure disclosed in the embodiment;

[0037] Figure 4 A structural block diagram of an abnormal traffic detection device for industrial Internet disclosed in an embodiment;

[0038] Figure 5 The figure is a block diagram of the computer device structure disclosed in the embodiment. DETAILED DESCRIPTION

[0039] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0040] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0041] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0042] It should be noted that all data is obtained in compliance with laws and regulations and user consent, and the data is used legally.

[0043] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0044] Example 1

[0045] With the continuous development of communication technology, the scale of the industrial Internet is growing, the types of services carried by the network are increasing, and the network traffic related to the services is also increasing. In order to better understand the operation of the network, enterprises need to promptly understand the services carried in the network and the characteristics of the network traffic that implements the services, so as to better implement the network bandwidth optimization configuration, prevent network risks, and promptly discover and solve network function and performance problems. By detecting and analyzing abnormal data in network traffic, it can help enterprises effectively understand the operation of the industrial Internet and promptly discover the bottleneck of network performance, thereby providing an effective reference for the network optimization and network equipment replacement of the industrial Internet. At the same time, the industrial Internet has the characteristics of high network real-time requirements and huge network data volume. How to efficiently, promptly and accurately detect abnormal traffic to discover existing congestion, delay and other problems is an important problem that network measurement technology needs to solve.

[0046] Existing solutions include:

[0047] (1) Abnormal traffic detection method based on spatiotemporal fusion deep learning. This method preprocesses the class-imbalanced traffic data to form a traffic data set with a relatively balanced sample distribution. It uses a deep learning model that integrates an aggregated residual transform network and a gated recurrent unit to extract traffic data features from the spatial and temporal dimensions, realizes the comprehensive extraction of spatiotemporal fusion traffic data features, and finally classifies the traffic data through a Softmax classifier.

[0048] (2) Abnormal traffic detection method based on the combination of edge computing and cloud computing. According to real-time computing requirements and network conditions, some data processing tasks are placed on edge devices, and complex deep learning reasoning and training tasks are performed in the cloud, and the results are returned to the edge devices. The edge devices perform further operations based on the results returned by the cloud, such as alarming and controlling equipment.

[0049] The abnormal traffic detection method based on spatiotemporal fusion deep learning uses a deep learning model that fuses aggregated residual transform networks and gated recurrent units to extract traffic data features. The deep learning method requires a large amount of labeled data for training, and the model construction and training process is relatively complex and time-consuming, and cannot flexibly adapt to the changing industrial Internet environment.

[0050] The abnormal traffic detection method based on the combination of edge computing and cloud computing utilizes the real-time processing capability of edge computing to achieve rapid response capabilities, but the deployment and maintenance of edge computing may require a large amount of hardware investment and is costly.

[0051] Therefore, the above technologies are not the preferred choice for abnormal traffic detection in the industrial Internet. This embodiment aims to solve the above problems at least to a certain extent.

[0052] This embodiment discloses a method for detecting abnormal traffic in the industrial Internet. Figure 1-Figure 3 As shown, including:

[0053] Obtain traffic data of multiple devices in the Industrial Internet over a continuous period of time;

[0054] Calculate the variance of all device traffic data in each time period;

[0055] Calculate the difference between the variance of all device flow data in the current time period and the variance of all device flow data in the previous time period;

[0056] According to the difference, determine whether there is abnormal traffic in the industrial Internet;

[0057] When it is determined that abnormal traffic exists, the time period in which each traffic data exists is determined;

[0058] When there is no flow data within the time period in which the flow data exists, the flow data is determined to be abnormal flow data.

[0059] The flow data acquired in this embodiment may be flow data collected online or offline; by analyzing the offline data, the historical data can be traced back.

[0060] After acquiring the flow data, this embodiment first pre-processes the acquired data and discards data packets with error information, including but not limited to errors such as data packet checksum error and network layer checksum error.

[0061] Based on the preprocessed data, the variance of all device flow data in each time period is calculated. The process includes:

[0062] Extract the characteristic information of each flow data; use the Sketch table structure to count the characteristic information of all flow data and construct the industrial Internet table structure; according to the industrial Internet table structure, calculate and determine the variance of all device flow data in each time period, where the horizontal direction of the industrial Internet table structure represents different devices and the vertical direction represents different times. The nodes in the industrial Internet table structure store the characteristic information of the flow data corresponding to the node.

[0063] The characteristic information includes quintuple information and statistical characteristic information.

[0064] The five-tuple information includes the source IP address, source port number, destination IP address, destination port number and network protocol type of the traffic data; the statistical feature information includes the length, timestamp and data flow direction of the traffic data.

[0065] The timestamp records the time information when the data flow arrives at the detection system. To avoid a large number of data packets having the same timestamp, the timestamp is accurate to the nanosecond level; the data flow direction records whether the data flows into or out of the current network node.

[0066] This embodiment identifies the traffic data according to the five-tuple information of the traffic data; and regards the traffic data with the same five-tuple information as the data flow of the same service.

[0067] This embodiment uses a hash algorithm to create an identifier for each traffic data according to the five-tuple information, and uses the identifier as a structural index of the Sketch table structure.

[0068] Preferably, a hash algorithm (MurmurHash) is used to generate a data flow identifier with a length of 64 bits for a part of the 5-tuple information or a combination of the contents of the 5-tuple information.

[0069] This embodiment uses the Sketch table structure (summary data structure) to collect statistics on the characteristic information of the flow data of each device in the industrial Internet. The Sketch table structure for performing statistics consists of M×N Sketch nodes, such as Figure 3 shown.

[0070] In the Sketch table structure:

[0071] Each Sketch node stores the traffic data of the device in a specific time period. For example, the Sketch node where (Device 1, Time 1) is located describes the traffic data of Device 1 in Time Period 1.

[0072] Each Sketch node uses the identifier of the traffic data generated above as the key value of Sketch and adopts the TupleSketch algorithm to perform real-time statistics of the characteristic information of the traffic data.

[0073] In order to avoid hash collisions, improve statistical accuracy, and reduce computing and storage overhead, the Sketch nodes of different devices in this structure are processed using the same hash function, and different nodes of the same device are processed using different hash functions.

[0074] Device 1 to device N represent the industrial Internet devices connected to the network node where the current detection device is located; M represents the Sketch node of the Mth time period. M can be adjusted according to the memory size of the current detection device. In order to ensure the accuracy of the detection, M≥3, that is, at least 3 time periods are required as data for detection. The time period T is in days or weeks. T can be determined by the completion of a production task of the industrial Internet device, or it can be adjusted according to actual needs. The default time is the time to complete a production task. The same device uses the same time period T, and different devices can use different time periods T.

[0075] The M Sketch nodes of the same device are stored in a queue. These Sketch nodes are arranged in chronological order. The Sketch node closest to the current time is always saved at the end of the queue, and the historical data is always saved at the head of the queue. For example, at a certain moment, the statistical result saved by the device is {time TP1, time TP2}. When entering the next time period, the statistical result saved by the device is {time TP1, time TP2, time TP3}, which increases backward in sequence until the saved result is {time TP1, time TP2, time TP3..., time TPM}. At the same time, the content in the queue changes with time, such as from {time TP1, time TP2, time TP3..., time TPM} to {time TP2, time TP3, time TP4..., time TPM+1}, the number of Sketch nodes saved in the queue remains unchanged, and the data leaving the queue, such as TP1, will be temporarily stored in the memory of the detection device.

[0076] Based on the data stored in the Sketch table structure, traffic detection and analysis can be performed in both horizontal and vertical directions:

[0077] The horizontal Sketch node represents the traffic statistics of all devices in the same industrial Internet sub-network in a certain time period;

[0078] The vertical Sketch nodes represent the traffic statistics of a device in several time periods.

[0079] In order to save memory resources, the data of these Sketch nodes will be updated regularly, and the data before the update will be pushed to the memory of the detection device to provide historical data for further analysis. The update cycle is in days or weeks.

[0080] This embodiment implements abnormal traffic detection of the Industrial Internet based on the Industrial Internet table structure, combined with sliding windows and variance. The process is as follows: Figure 2 shown.

[0081] Set a sliding window and a sliding distance d of the window; the length of the sliding window is k, and the value range of k is 1 to M / 2. For example, when k=2, the sliding window can be expressed as {time TP1, time TP2}; the sliding distance d≥1, which means sliding forward one Sketch node each time. For example, when k=2, the initial state of the sliding window is {time TPx, time TPx+1}, then after sliding once, the data in the window is {time TPx+1, time TPx+2}.

[0082] The window slides when the current time falls into the time of the next time period.

[0083] Each time the window is slid, the variance of all node information in the window is calculated as the variance of all device traffic data in the time period; the difference between the variance D(x) obtained in the current window and the variance D(x-1) obtained in the previous window is calculated.

[0084] When the difference is greater than the set detection threshold, it is determined that there is abnormal traffic in the industrial Internet.

[0085] When the difference is less than or equal to the set detection threshold, it is determined that there is no abnormal traffic in the industrial Internet.

[0086] The detection threshold is the mean of the variance of all device traffic data in multiple time periods without abnormal traffic. That is, the mean of {D(1), D(2), ..., D(L-1), D(L)} is calculated as the detection threshold. L is the number of window slides, and D(L) is the variance calculated after the window slides L times; when calculating the detection threshold, there is no abnormal traffic in all traffic data during the sliding period of L times.

[0087] Under normal circumstances, network traffic will not change significantly in a short period of time. However, when abnormal traffic occurs, the distribution of traffic will usually change significantly, resulting in obvious differences between the Sketch under normal circumstances and the Sketch under abnormal traffic.

[0088] After determining that there is abnormal traffic in the industrial Internet, this embodiment also determines the location of the abnormal traffic, specifically:

[0089] This embodiment creates a Bloom filter for each node in the industrial Internet table structure; the number of bit arrays in the Bloom filter is greater than the number of industrial Internet devices in the network where the Sketch node is located;

[0090] In the abnormal traffic detection process, the Bloom filter is used to record the node information of each node in the industrial Internet table structure. Preferably, for each traffic data detected by the Sketch node, the hash function is used to calculate the position in the bit array, and the value of the bit at these positions is set to 1, so that the node information of the node is recorded by the Bloom filter. The hash function here is an unbiased hash function that performs a mapping operation, and the input of the hash function is the five-tuple information of the data packet;

[0091] When abnormal traffic is detected in the industrial Internet, the node information that is determined to have abnormal traffic in the industrial Internet is input into the Bloom filter corresponding to the node; the Bloom filter determines whether the input node information is recorded; when it is not recorded, the traffic data corresponding to the node information is determined to be abnormal. Specifically, according to the correspondence between the node and the Bloom filter in the industrial Internet table structure, the five-tuple information of the node information with abnormal traffic is input into the Bloom filter corresponding to the node, and according to the time period in which the information exists, the Bloom filter is used to check whether the node information in the time period is recorded. If the Bloom filter does not record the traffic data, it is considered that the traffic data is abnormal, the abnormal data is saved, and the abnormal information is uploaded and submitted to a higher layer for further analysis and confirmation. The abnormal information includes the characteristic information of the abnormal traffic and the time period in which it is located.

[0092] This embodiment discloses an abnormal traffic detection method for the industrial Internet, which calculates the variance of all device traffic data in each time period; then calculates the difference between the variance of all device traffic data in the current time period and the variance of all device traffic data in the previous time period; based on the difference, determines whether there is abnormal traffic in the industrial Internet; when it is determined that there is abnormal traffic, determines the time period in which each traffic data exists; when there is no traffic data in the time period in which the traffic data exists, determines that the traffic data is abnormal traffic data. Through statistics, it is possible to simultaneously realize real-time detection of multiple device traffic in the industrial Internet and abnormal traffic location; the calculation process is simple, which improves the real-time performance of traffic anomaly detection, and can flexibly adapt to various detection and analysis scenarios.

[0093] Example 2

[0094] In this embodiment, an industrial Internet abnormal traffic detection device is disclosed, such as Figure 4 As shown, including:

[0095] A flow acquisition unit, used to acquire flow data of multiple devices in the industrial Internet within a continuous time period;

[0096] Traffic data statistics unit, used to calculate the variance of all device traffic data in each time period;

[0097] A difference calculation unit, used to calculate the difference between the variance of all device flow data in the current time period and the variance of all device flow data in the previous time period;

[0098] A traffic anomaly judgment unit is used to judge whether there is abnormal traffic in the industrial Internet based on the difference degree;

[0099] The abnormal flow determination unit is used to determine the time period in which each flow data exists when it is determined that abnormal flow exists; when there is no flow data within the time period in which the flow data exists, determine that the flow data is abnormal flow data.

[0100] Among them, the traffic acquisition unit, the traffic data statistics unit, the difference calculation unit, the traffic anomaly judgment unit and the abnormal traffic determination unit can be combined into a network traffic detection and analysis node module.

[0101] The network traffic detection and analysis node module is used to collect traffic data, extract traffic data features, perform statistics on traffic data features, and calculate whether the traffic data is abnormal; when abnormal traffic data is determined, an alarm is issued and abnormal information is uploaded.

[0102] The network traffic detection and analysis node module is configured on the network node of the industrial Internet to collect network data flowing through the network node, perform data anomaly detection and analysis, and automatically take corresponding network protection measures based on the analysis results. The network traffic detection and analysis node module supports direct connection, series connection and embedded working modes. The direct connection mode is to connect the network where the current network node is located through a specific network device (such as a network probe), the series connection mode refers to the use of two network ports to access the network where the current network node is located, as a network device of the network, and the embedded mode refers to being installed in the device of the current network node in software or hardware mode as a functional module of the current network node.

[0103] To achieve the above functions, the network traffic detection and analysis node module has the following functions:

[0104] (1) Network traffic collection

[0105] The module is configured with port mirroring function, which can collect and count the data flow passing through the current network node in real time; it has traffic filtering function, which can filter the data flow according to the configuration parameters; it has data preprocessing function, which discards damaged data packets and supports data packet reassembly; it has temporary storage function, which provides data cache for subsequent data processing; it has time label function, which adds timestamps to the collected data to facilitate subsequent analysis and backtracking.

[0106] (2) Network traffic feature extraction

[0107] During traffic learning, the collected data is parsed using dynamic feature extraction to extract identification information of each data stream as traffic features, including but not limited to data stream length, physical address, IP address, protocol type, port number, and timestamp.

[0108] (3) Network traffic anomaly detection

[0109] Based on the anomaly detection algorithm designed above, the collected data is detected and analyzed to identify abnormal traffic that is significantly different from normal behavior patterns. During the operation cycle of the detection system, network traffic detection is performed regularly.

[0110] (4) Network traffic anomaly alarm and response

[0111] When abnormal traffic information is detected, an abnormal alarm is sent to the system, an abnormal report is generated, and the abnormal traffic feature information detected is recorded. According to the abnormal alarm strategy, corresponding security measures are taken, including resetting network configuration, isolating network equipment, etc.

[0112] (5) Detection information feedback

[0113] During the detection and analysis process, the network traffic detection and analysis node module will return some basic operating information to the network traffic anomaly detection control module. The operating information includes the basic information of the node module, the statistical data volume and the detected anomaly information.

[0114] The present embodiment discloses an industrial Internet abnormal traffic detection device, which also includes a network traffic anomaly detection control module and a network traffic detection analysis node module.

[0115] The network traffic anomaly detection control module is used to control and manage the network traffic detection and analysis node module, such as: managing the network traffic collection function of the network traffic detection and analysis node module, including starting and stopping traffic collection, configuring collection strategies, and viewing collection status. It supports viewing the collection status of the node and can configure different collection strategies for each detection node module; managing the network traffic anomaly alarm and response function of the network traffic detection and analysis node module, including anomaly triggering strategies and anomaly response strategies, and can configure different alarm strategies for different nodes.

[0116] The network traffic data storage module includes the Sketch traffic statistics database, the collection statistics strategy database, and the abnormal alarm strategy database. This module is used to store, maintain, and update various parameter data used by the network traffic anomaly detection control module.

[0117] The Sketch traffic statistics database is used to store data flow identifiers and one or more Sketch tables, and maps the data flow identifiers to specific count values ​​through each independent hash function.

[0118] Collection statistics strategy database:

[0119] (1) storing the filtering parameters of the detection device for the incoming data, which parameters include but are not limited to the data stream length, physical address, IP address, protocol type, port number and other information, and the filtering is divided into removal or retention; when removal is selected, the detection device will not collect data that meets the filtering parameters; when retention is selected, the detection device will only collect data that meets the filtering parameters;

[0120] (2) Sketch node statistical strategies defined based on statistical feature information, including length condition count, source address technology count, protocol type count, port number count, etc.; all Sketch nodes can use the same statistical strategy or different statistical strategies.

[0121] Abnormal alarm strategy database:

[0122] Defines the actions that the detection device performs when abnormal traffic is detected. This includes setting up facilities for receiving alarm information and the content of the alarm information (report time, abnormal feature information, time period information, traffic information for a specific time period, etc.). All Sketch nodes can use the same alarm strategy or different alarm strategies.

[0123] The present invention also discloses a computer device, such as Figure 5 As shown, the device includes:

[0124] a processor adapted to execute a computer program;

[0125] A memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, an industrial Internet abnormal traffic detection method disclosed in Example 1 is implemented.

[0126] The computer device also includes a data acquisition interface, a communication interface and a bus interface.

[0127] The data collection interface is used to collect traffic data of devices in the Industrial Internet.

[0128] Communication interface, providing communication services between the processor and the memory data and acquisition interface, and providing services for the electronic device to communicate with the outside world;

[0129] The bus interface provides an interface for the computer device to access the industrial Internet.

[0130] The processor may be a CPU (Central Processing Unit), an FPGA (Field Programmable Gate Array), or an integrated circuit that performs data processing functions. The data acquisition interface obtains flow data through a bus interface under the control of the processor for analysis by a computer program; the computer program is stored in the memory to implement an abnormal flow detection method for an industrial Internet disclosed in Example 1; the memory includes at least one cache memory for storing instructions frequently used by the CPU; the memory includes at least one or more large-capacity SDRAMs (Synchronous Dynamic Random Access Memory) to provide memory for running computer programs; the memory includes at least one disk storage for storing detection and analysis results; the communication interface provides services for mutual access between the electronic devices and communication between the electronic devices and the outside world. The processor uses the services provided by the communication interface to control the data acquisition interface to obtain data from the industrial Internet from the bus interface, and stores the collected data in the memory through the services provided by the communication interface; the processor reads and analyzes data from the memory through the bus interface, and writes the analysis results into the memory; in the bus interface, the bus may be an EtherCAT (Ethernet for Control Automation Technology), a CAN (Control Area Network) bus, etc. The above-mentioned bus interface can be one or more types of buses. The bus interface has a network probe function, which can realize the connection of the above-mentioned electronic devices in series in the network, so as not to affect the normal communication of the network while collecting data.

[0131] In the implementation process, the processor, the communication interface and the memory can be integrated on a single chip, and they communicate with each other through an internal interface. When the processor, the communication interface and the memory are not integrated on a single chip, they communicate with each other through the communication interface.

[0132] The present invention also discloses a computer-readable storage medium, which stores a computer program. The computer program is suitable for being loaded by a processor and executing an industrial Internet abnormal traffic detection method disclosed in Example 1.

[0133] The present invention also discloses a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements an industrial Internet abnormal traffic detection method disclosed in Example 1.

[0134] The method disclosed in Example 1 can be directly embodied as a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0135] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with this embodiment can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0136] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A method for detecting abnormal traffic in industrial Internet, characterized in that: include: Obtain traffic data of multiple devices in the Industrial Internet over a continuous period of time; Calculate the variance of all device traffic data in each time period; Calculate the difference between the variance of all device flow data in the current time period and the variance of all device flow data in the previous time period; According to the difference, determine whether there is abnormal traffic in the industrial Internet; When it is determined that abnormal traffic exists, the time period in which each traffic data exists is determined; When there is no flow data within the time period in which the flow data exists, the flow data is determined to be abnormal flow data.

2. The method for detecting abnormal traffic in industrial Internet according to claim 1, characterized in that: Extract the characteristic information of each flow data; use the Sketch table structure to count the characteristic information of all flow data and construct the industrial Internet table structure, where the horizontal direction of the industrial Internet table structure represents different devices and the vertical direction represents different times; according to the industrial Internet table structure, calculate and determine the variance of the flow data of all devices in each time period.

3. The method for detecting abnormal traffic in industrial Internet according to claim 2, characterized in that: The feature information includes quintuple information and statistical feature information.

4. The method for detecting abnormal traffic in industrial Internet according to claim 2, characterized in that: Use Bloom filter to record the node information of each node in the industrial Internet table structure, and input the node information that is determined to have abnormal traffic in the industrial Internet into the Bloom filter corresponding to the node; The Bloom filter determines whether the input node information is recorded; if it is not recorded, the traffic data corresponding to the node information is determined to be abnormal.

5. The method for detecting abnormal traffic in industrial Internet according to claim 1, characterized in that: When the difference is greater than the set detection threshold, it is determined that there is abnormal traffic in the industrial Internet.

6. The method for detecting abnormal traffic in industrial Internet according to claim 5, characterized in that: The detection threshold is the mean of the variance of all device traffic data in multiple time periods without abnormal traffic.

7. An industrial Internet abnormal traffic detection device, characterized in that: include: A flow acquisition unit, used to acquire flow data of multiple devices in the industrial Internet within a continuous time period; Traffic data statistics unit, used to calculate the variance of all device traffic data in each time period; A difference calculation unit, used to calculate the difference between the variance of all device flow data in the current time period and the variance of all device flow data in the previous time period; A traffic anomaly judgment unit is used to judge whether there is abnormal traffic in the industrial Internet based on the difference degree; The abnormal flow determination unit is used to determine the time period in which each flow data exists when it is determined that abnormal flow exists; when there is no flow data within the time period in which the flow data exists, determine that the flow data is abnormal flow data.

8. An electronic device, characterized in that: The device comprises: a processor adapted to execute a computer program; A memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, an industrial Internet abnormal traffic detection method as described in any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor and executing an industrial Internet abnormal traffic detection method as described in any one of claims 1-6.

10. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, it implements an industrial Internet abnormal traffic detection method as described in any one of claims 1-6.

Images