Network traffic analysis method and device, electronic equipment and readable medium

Abstract

The embodiment of the invention provides a network traffic analysis method and device, electronic equipment and a readable medium. The method comprises the steps of determining a to-be-analyzed time period; obtaining a key parameter of each target key data packet in a plurality of target key data packets corresponding to the to-be-analyzed time period by using a P2 algorithm; wherein the key parameters of each target key data packet comprise the first position of the target key data packet in all the average data flow gaps and the corresponding average data flow gap; according to the sequence of the first positions, constructing a target vector by using the average data flow gap corresponding to each target key data packet; and inputting the target vector into a pre-trained neural network for network flow analysis to obtain a network flow analysis result, thereby reducing the storage overhead compared with the existing method.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic analysis, and in particular to a network traffic analysis method, a network traffic analysis device, an electronic device and a readable medium. Background Art

[0002] Network traffic analysis is a method of monitoring and analyzing data about the data traffic flowing through a computer network, which helps to discover various network problems and optimize network performance.

[0003] At present, the existing network traffic analysis method is to analyze the network traffic in units of data packets. Specifically, the analysis method in units of data packets refers to capturing, decoding and analyzing each data packet transmitted in the network to obtain detailed information of the network traffic, such as protocol type, source address, destination address, port number, data content, etc.

[0004] However, since the existing network traffic analysis method needs to store the analysis results of all data packets, it at least has a technical problem of high storage overhead.

[0005] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0006] The embodiments of the present application provide a network traffic analysis method, device, electronic device and readable medium to solve the technical problem of high storage overhead in the prior art.

[0007] The present application discloses a network traffic analysis method, including: determining a time period to be analyzed; using P 2 The algorithm obtains the key parameters of each target key data packet in multiple target key data packets corresponding to the time period to be analyzed; wherein the key parameters of each target key data packet include its first position in all average data flow gaps and its corresponding average data flow gap; according to the order of the first positions, a target vector is constructed using the average data flow gap corresponding to each target key data packet; the target vector is input into a pre-trained neural network for network traffic analysis to obtain a network traffic analysis result.

[0008] In one possible embodiment, using P 2The algorithm obtains the key parameters of each target key data packet in multiple target key data packets corresponding to the time period to be analyzed, including: determining the key parameters of each candidate key data packet in multiple candidate key data packets according to the first n data packets; when the n+1th data packet is obtained, calculating the average data flow gap corresponding to the n+1th data packet; comparing the average data flow gap corresponding to the n+1th data packet with two specified values ​​to obtain a comparison result; wherein the two specified values ​​are respectively the minimum average data flow gap and the maximum average data flow gap among the corresponding average data flow gaps of all candidate key data packets; generating the key parameters of a new candidate key data packet according to the comparison result, and after obtaining a new data packet, repeating the above process until no more data packets are obtained, then stopping the loop.

[0009] In one possible embodiment, key parameters of a new candidate key data packet are generated based on the comparison results, including: when the comparison results of a preset number of consecutive data packets including the n+1th data packet are consistent, the comparison results of the n+1th data packet are used to generate key parameters of a new candidate key data packet.

[0010] In one possible embodiment, the comparison result of the n+1th data packet is used to generate key parameters of a new candidate key data packet, including: when the comparison result is that the average data flow gap corresponding to the n+1th data packet is less than or equal to the minimum average data flow gap, the key parameters of the candidate key data packet corresponding to the minimum average data flow gap are replaced with the key parameters of the n+1th data packet.

[0011] In one possible embodiment, the comparison result of the n+1th data packet is used to generate key parameters of a new candidate key data packet, including: when the comparison result is that the average data flow gap corresponding to the n+1th data packet is greater than or equal to the maximum average data flow gap, the key parameters of the candidate key data packet corresponding to the maximum average data flow gap are replaced with the key parameters of the n+1th data packet.

[0012] In one possible embodiment, key parameters of new candidate key data packets are generated based on comparison results, including: when the comparison result is that the average data flow gap corresponding to the n+1th data packet is greater than the minimum average data flow gap and the average data flow gap corresponding to the n+1th data packet is less than the maximum average data flow gap, then the deviation values ​​of the average data flow gap corresponding to the n+1th data packet and multiple intermediate average data flow gaps are calculated in sequence, and the key parameters of the candidate key data packet with the largest deviation value are replaced with the key parameters of the n+1th data packet; wherein the deviation value of the multiple intermediate average data flow gaps is the average data flow gap between the minimum average data flow gap and the maximum average data flow gap.

[0013] In a possible embodiment, the neural network is any one of a convolutional neural network, a recurrent neural network, an autoencoder neural network and a variational autoencoder neural network.

[0014] The embodiment of the present application also provides a network traffic analysis device, including: a determination module, used to determine the time period to be analyzed; an acquisition module, used to use the P2 algorithm to obtain the key parameters of each target key data packet in multiple target key data packets corresponding to the time period to be analyzed; wherein the key parameters of each target key data packet include its first position in all average data flow gaps and its corresponding average data flow gap; a construction module, used to construct a target vector using the key parameters of each target key data packet in the order of the first position; an input module, used to input the target vector into a pre-trained neural network for network traffic analysis to obtain a network traffic analysis result.

[0015] The present application also provides a storage medium in an embodiment, on which a computer program is stored. When the computer program is executed by a processor, the method described in the embodiment of the present application is executed.

[0016] The present application also provides an electronic device in an embodiment, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the method described in the embodiment of the present application is performed.

[0017] The present application also provides a computer program product. When the computer program product is run on a computer, it enables the computer to execute the method described in the embodiments of the present application.

[0018] The embodiments of the present application include the following advantages:

[0019] The embodiments of the present application provide a network traffic analysis method, device, electronic device and readable medium, by determining a time period to be analyzed and using P 2The algorithm obtains the key parameters of each target key data packet in multiple target key data packets corresponding to the time period to be analyzed, wherein the key parameters of each target key data packet include its first position in all average data flow gaps and its corresponding average data flow gap, and in the order of the first position, uses the key parameters of each target key data packet to construct a target vector, and inputs the target vector into a pre-trained neural network for network traffic analysis to obtain a network traffic analysis result. Compared with the existing network traffic analysis method, it only needs to save the key parameters of each target key data packet in multiple target key data packets, and does not need to save the analysis results of all data packets. Therefore, it only needs to use limited memory to maintain the key storage of multiple target key data packets, thereby reducing storage overhead.

[0020] In order to make the above-mentioned objectives, features and advantages to be achieved by the embodiments of the present application more obvious and understandable, the following specifically cites preferred embodiments and describes them in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 A flow chart of a network traffic analysis method provided by an embodiment of the present application is shown;

[0023] Figure 2 A schematic diagram of a data stream gap provided in an embodiment of the present application is shown;

[0024] Figure 3 A structural block diagram of a network traffic analysis device provided in an embodiment of the present application is shown;

[0025] Figure 4 A block diagram of an electronic device provided by an embodiment of the present application is shown;

[0026] Figure 5 It is a schematic diagram of a readable medium provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The following will clearly and completely describe the technical solutions of various embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0028] In order to solve the technical problem of high storage overhead in the prior art, the embodiments of the present application provide a network traffic analysis method, device, electronic device and readable medium, by determining a time period to be analyzed and using P 2 The algorithm obtains the key parameters of each target key data packet in multiple target key data packets corresponding to the time period to be analyzed, wherein the key parameters of each target key data packet include its first position in all average data flow gaps and its corresponding average data flow gap, and in the order of the first position, uses the key parameters of each target key data packet to construct a target vector, and inputs the target vector into a pre-trained neural network for network traffic analysis to obtain a network traffic analysis result. Compared with the existing network traffic analysis method, it only needs to save the key parameters of each target key data packet in multiple target key data packets, and does not need to save the analysis results of all data packets. Therefore, it only needs to use limited memory to maintain the key storage of multiple target key data packets, thereby reducing storage overhead.

[0029] In order to better understand the above technical solution, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer and more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0030] In order to facilitate understanding of the embodiments of the present application, the terms involved in the present application are explained as follows:

[0031] “Network Traffic Analysis (NTA)”: It is the process of identifying and resolving network performance issues, security threats, and abnormal behavior by monitoring and analyzing network traffic.

[0032] "Data flow gap": It is the sum of the number of data packets received by all other data flows during the time interval between two adjacent data packets received in a specific data flow.

[0033] "Average Data Flow Interval": It is the average value of the sum of the number of data packets received by all other data flows within the time interval between two adjacent data packets in a specific data flow.

[0034] "Convolutional Neural Network": It is a deep learning model that is specialized for processing data with a grid structure (e.g., images, time series data, etc.). And, convolutional neural networks have achieved great success in the field of computer vision, but they can also be applied to other fields such as natural language processing and network traffic analysis.

[0035] "Recurrent Neural Network": It is a neural network model specifically designed to process sequence data. Unlike traditional feedforward neural networks, recurrent neural networks (RNNs) have a cyclic structure that allows information to be passed between time steps, which makes them particularly suitable for processing time series data, text sequences, speech signals, etc.

[0036] "Autoencoder neural network": It is a neural network model that is mainly used for unsupervised learning tasks such as dimensionality reduction, feature learning, and anomaly detection. The core idea of ​​the autoencoder neural network is to compress the input data into a low-dimensional representation (encoding) through an encoder, and then restore this low-dimensional representation back to the high-dimensional input data through a decoder. In this way, the autoencoder neural network can learn the important features of the input data.

[0037] In addition, the autoencoding neural network can also be called an autoencoder.

[0038] "Variational Autoencoder Neural Network": It is a generative model that combines the idea of ​​autoencoders and the method of Bayesian inference. Unlike traditional autoencoders, variational autoencoder neural networks can not only learn low-dimensional representations of data, but also generate new data samples. Variational autoencoder neural networks introduce a latent variable distribution, allowing the model to smoothly interpolate in the latent space to generate new data points.

[0039] In addition, the variational autoencoder neural network can also be called a variational autoencoder.

[0040] See also Figure 1 , Figure 1 A flow chart of a network traffic analysis method provided by an embodiment of the present application is shown. It should be understood that the network traffic analysis method can be performed by a network traffic analysis device, and the specific device of the network traffic analysis device can be set according to actual needs, and the embodiment of the present application is not limited thereto. For example, the network traffic analysis device can be a computer, or a server, etc. Specifically, the steps of the network traffic analysis method include:

[0041] Step S110, determining the time period to be analyzed.

[0042] It should be understood that the specific time period of the time period to be analyzed can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0043] For example, the time period to be analyzed may be a specified time period in history;

[0044] For another example, the time period to be analyzed may be a real-time time period.

[0045] Step S120, using P 2 The algorithm obtains the key parameters of each target key data packet in the multiple target key data packets corresponding to the time period to be analyzed. The key parameters of each target key data packet include its first position in all average data flow gaps and its corresponding average data flow gap. The specific number of the multiple target key data packets can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0046] It should be understood that the process of obtaining the average data flow gap can be set according to actual needs, and the embodiments of the present application are not limited to prediction.

[0047] Specifically, for a specific data flow f, the present application measures the time difference between data packets in the same data flow by the data flow gap value Δf, that is, the instantaneous data flow change at the current moment, and the present application also measures the average data flow gap value over a period of time. To measure the overall congestion level of data flow. The following gives the data flow gap value Δf and the average data flow gap value Specific definition:

[0048] The data flow gap value Δf refers to the sum of the number of data packets received by all other data flows within the time interval between receiving two adjacent data packets in a specific data flow f, and this time interval includes the time between receiving the first data packet and receiving the second data packet. For details, see Figure 2 .

[0049] And, the present application may also define g to represent a global data packet counter, o f represents the old global counter when the last data packet of data flow f arrives, that is, the data packet counter before update; c f To represent the data packet counter of data stream f. Based on this, the data stream gap value when the last data packet of data stream f arrives is calculated as:

[0050] Δf=go f -1.

[0051] And, the average data flow gap value It is the average value of the sum of the number of packets received by all other data flows in the time interval between two adjacent packets in a specific data flow f, and this time interval includes the time between the first packet and the second packet. f To represent the total number of data packets received by data flow f, the average data flow gap is calculated recursively, specifically:

[0052] When cf = 1,

[0053] In the case of cf ≥ 2,

[0054]

[0055] In addition, the data flow gap value and the average data flow gap value help to more comprehensively understand the data traffic situation. Compared with recording the timestamp of each data packet to analyze the burstiness of data traffic, the method of using the average data flow gap can provide better performance and efficiency advantages. The average data flow gap can reflect the changes in data traffic to a certain extent, while avoiding the problem of frequent operations on the timestamp of each data packet. By calculating the average data flow gap, the trend of data traffic changes over a period of time can be more accurately understood, and a large number of recording and comparison operations can be avoided to a certain extent, thereby improving calculation efficiency.

[0056] To facilitate understanding of step S120, a specific embodiment is used to describe it below.

[0057] Specifically, key parameters of each candidate key data packet among multiple candidate key data packets are determined based on the first n data packets; when the n+1th data packet is obtained, the average data flow gap corresponding to the n+1th data packet is calculated; the average data flow gap corresponding to the n+1th data packet is compared with two specified values ​​to obtain a comparison result; wherein the two specified values ​​are respectively the smallest average data flow gap and the largest average data flow gap among the corresponding average data flow gaps of all candidate key data packets; based on the comparison result, key parameters of a new candidate key data packet are generated, and after obtaining a new data packet, the above process is repeated until no more data packets are obtained, and the loop is stopped.

[0058] Wherein, when the comparison result is that the average data flow gap corresponding to the n+1th data packet is less than or equal to the minimum average data flow gap, the key parameters of the candidate key data packet corresponding to the minimum average data flow gap are replaced with the key parameters of the n+1th data packet;

[0059] If the comparison result shows that the average data flow gap corresponding to the n+1th data packet is greater than or equal to the maximum average data flow gap, the key parameters of the candidate key data packet corresponding to the maximum average data flow gap are replaced with the key parameters of the n+1th data packet;

[0060] When the comparison result is that the average data flow gap corresponding to the n+1th data packet is greater than the minimum average data flow gap and the average data flow gap corresponding to the n+1th data packet is less than the maximum average data flow gap, the deviation values ​​of the average data flow gap corresponding to the n+1th data packet and multiple intermediate average data flow gaps are calculated in sequence, and the key parameters of the candidate key data packet with the largest deviation value are replaced with the key parameters of the n+1th data packet; wherein the deviation value of the multiple intermediate average data flow gaps is the average data flow gap between the minimum average data flow gap and the maximum average data flow gap.

[0061] It should be understood that the specific calculation process of the deviation value can be set according to actual needs, and the embodiments of the present application are not limited to this.

[0062] For example, the deviation value is calculated as follows:

[0063] The absolute value of the difference between the average data flow gap corresponding to the n+1th data packet and the current middle average data flow gap can be calculated, and the ratio of the absolute value of the difference to the average data flow gap corresponding to the n+1th data packet can be calculated, and the ratio can be used as the deviation value corresponding to the current middle average data flow gap.

[0064] In addition, it should be noted that, considering the delay of the n+1th data packet caused by temporary network fluctuations, when the comparison results of the preset number of consecutive data packets including the n+1th data packet are consistent, the comparison result of the n+1th data packet can be used to generate the key parameters of the new candidate key data packet, thereby verifying the accuracy of the n+1th data packet using multiple consecutive data packets. At the same time, the process of generating the key parameters of the new candidate key data packet using the comparison result of the n+1th data packet is performed after verifying the accuracy of the n+1th data packet.

[0065] Step S130 , constructing a target vector using the average data flow gap corresponding to each target key data packet according to the order of the first position.

[0066] It should be understood that, when the key parameters of the final n target key data packets are obtained, the target vector can be constructed using the average data flow gaps corresponding to the n target key data packets.

[0067] Step S140, inputting the target vector into a pre-trained neural network to perform network traffic analysis to obtain a network traffic analysis result.

[0068] It should be understood that the specific network of the neural network can be set according to actual needs, and the embodiments of the present application are not limited to this.

[0069] Optionally, the neural network is any one of a convolutional neural network, a recurrent neural network, an autoencoder neural network and a variational autoencoder neural network.

[0070] Therefore, by means of the above technical solution, the present application determines the time period to be analyzed and uses P 2 The algorithm obtains the key parameters of each target key data packet in the multiple target key data packets corresponding to the time period to be analyzed, wherein the key parameters of each target key data packet include its first position in all average data flow gaps and its corresponding average data flow gap, and according to the order of the first position, the key parameters of each target key data packet are used to construct a target vector, and the target vector is input into a pre-trained neural network for network traffic analysis to obtain a network traffic analysis result. Compared with the existing network traffic analysis method, it only needs to save the key parameters of each target key data packet in the multiple target key data packets, and does not need to save the analysis results of all data packets. Therefore, it only needs to use limited memory to maintain the key storage of multiple target key data packets, reducing storage overhead. At the same time, the present application can also meet the needs of real-time traffic analysis.

[0071] It should be understood that the above-mentioned network traffic analysis method is only exemplary, and those skilled in the art may make various modifications based on the above-mentioned method, and the modified scheme also falls within the protection scope of this application.

[0072] See also Figure 3 , Figure 3 The structural block diagram of a network traffic analysis device 300 provided in an embodiment of the present application is shown. It should be understood that the network traffic analysis device 300 can perform each step in the above method embodiment. The specific functions of the network traffic analysis device 300 can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here. The network traffic analysis device 300 includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the operating system (OS) of the network traffic analysis device 300. Specifically, the network traffic analysis device 300 includes:

[0073] A determination module 310 is used to determine a time period to be analyzed;

[0074] The acquisition module 320 is used to acquire key parameters of each target key data packet in the multiple target key data packets corresponding to the time period to be analyzed by using the P2 algorithm; wherein the key parameters of each target key data packet include its first position in all average data flow gaps and its corresponding average data flow gap;

[0075] A construction module 330, configured to construct a target vector using key parameters of each target key data packet in the order of the first position;

[0076] The input module 340 is used to input the target vector into a pre-trained neural network to perform network traffic analysis and obtain a network traffic analysis result.

[0077] In one possible embodiment, the acquisition module 320 is specifically used to: determine the key parameters of each candidate key data packet in multiple candidate key data packets based on the first n data packets; when the n+1th data packet is obtained, calculate the average data flow gap corresponding to the n+1th data packet; compare the average data flow gap corresponding to the n+1th data packet with two specified values ​​to obtain a comparison result; wherein the two specified values ​​are respectively the smallest average data flow gap and the largest average data flow gap among the corresponding average data flow gaps of all candidate key data packets; based on the comparison result, generate the key parameters of a new candidate key data packet, and after obtaining a new data packet, repeat the above process until no more data packets are obtained, then stop the loop.

[0078] In a possible embodiment, the acquisition module 320 is specifically used to generate key parameters of a new candidate key data packet using the comparison result of the n+1th data packet when the comparison results of a preset number of consecutive data packets including the n+1th data packet are consistent.

[0079] In one possible embodiment, the acquisition module 320 is specifically used to replace the key parameters of the candidate key data packet corresponding to the minimum average data flow gap with the key parameters of the n+1th data packet when the comparison result is that the average data flow gap corresponding to the n+1th data packet is less than or equal to the minimum average data flow gap.

[0080] In one possible embodiment, the acquisition module 320 is specifically used to replace the key parameters of the candidate key data packet corresponding to the largest average data flow gap with the key parameters of the n+1th data packet when the comparison result is that the average data flow gap corresponding to the n+1th data packet is greater than or equal to the largest average data flow gap.

[0081] In one possible embodiment, the acquisition module 320 is specifically used to: when the comparison result is that the average data flow gap corresponding to the n+1th data packet is greater than the minimum average data flow gap and the average data flow gap corresponding to the n+1th data packet is less than the maximum average data flow gap, then sequentially calculate the deviation values ​​of the average data flow gap corresponding to the n+1th data packet and multiple intermediate average data flow gaps, and replace the key parameters of the candidate key data packet with the largest deviation value with the key parameters of the n+1th data packet; wherein the deviation value of the multiple intermediate average data flow gaps is the average data flow gap between the minimum average data flow gap and the maximum average data flow gap.

[0082] In a possible embodiment, the acquisition module 320 is specifically used for: the neural network is any one of a convolutional neural network, a recurrent neural network, an autoencoder neural network and a variational autoencoder neural network.

[0083] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0084] In addition, the present application also provides an electronic device, such as Figure 4 As shown, it includes a processor 401, a communication interface 402, a memory 403 and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404.

[0085] Memory 403, used for storing computer programs;

[0086] The processor 401 is used to execute the program stored in the memory 403 to implement the following steps:

[0087] Determine the time period to be analyzed;

[0088] Using P 2 The algorithm obtains key parameters of each target key data packet in a plurality of target key data packets corresponding to the time period to be analyzed; wherein the key parameters of each target key data packet include its first position in all average data flow gaps and its corresponding average data flow gap;

[0089] Constructing a target vector using the average data flow gap corresponding to each target key data packet in the order of the first position;

[0090] The target vector is input into the pre-trained neural network for network traffic analysis to obtain the network traffic analysis results.

[0091] Among them, the communication interface 402 of the device in the embodiment of the present application is used to communicate signaling or data with other node devices. The processor 401 can be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 401 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor 401 can also be any conventional processor, etc.

[0092] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0093] The communication interface is used for communication between the above terminal and other devices.

[0094] The memory can be, but is not limited to, random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), etc.

[0095] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0096] Understandably, Figure 4 The structure shown is for illustration only. The electronic device may also include Figure 4 More or fewer components as shown, or with Figure 4 Different configurations are shown. Figure 4 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0097] like Figure 5 As shown, in another embodiment provided by the present invention, a readable medium 501 is also provided, in which instructions are stored, and when the instructions are run on a computer, the computer executes the abnormal behavior identification method on campus described in the above embodiment. The readable medium refers to a computer-readable storage medium.

[0098] In another embodiment provided by the present invention, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the campus abnormal behavior identification method described in the above embodiment.

[0099] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned method, and will not be elaborated here.

[0100] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0101] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0102] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0103] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0104] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk. It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0105] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0106] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network traffic analysis method, characterized in that: include: Determine the time period to be analyzed; Using P 2 algorithm, obtaining key parameters of each target key data packet in the multiple target key data packets corresponding to the time period to be analyzed; wherein the key parameters of each target key data packet include its first position in all average data flow gaps and its corresponding average data flow gap; Constructing a target vector using the average data flow gap corresponding to each target key data packet according to the order of the first positions; The target vector is input into a pre-trained neural network to perform network traffic analysis to obtain a network traffic analysis result.

2. The network traffic analysis method according to claim 1, characterized in that: The use of P 2 The algorithm obtains key parameters of each target key data packet in the multiple target key data packets corresponding to the time period to be analyzed, including: Determine a key parameter of each candidate key data packet in a plurality of candidate key data packets according to the first n data packets; When the n+1th data packet is obtained, an average data flow gap corresponding to the n+1th data packet is calculated; Compare the average data flow gap corresponding to the n+1th data packet with two specified values ​​to obtain a comparison result; wherein the two specified values ​​are respectively the smallest average data flow gap and the largest average data flow gap among the average data flow gaps corresponding to all the candidate key data packets; According to the comparison result, key parameters of new candidate key data packets are generated, and after a new data packet is obtained, the above process is repeated until no more data packets are obtained, and the cycle is stopped.

3. The network traffic analysis method according to claim 2, characterized in that: Generating key parameters of new candidate key data packets according to the comparison result includes: In the case that the comparison results of a preset number of consecutive data packets including the n+1th data packet are consistent, the comparison result of the n+1th data packet is used to generate the key parameters of a new candidate key data packet.

4. The network traffic analysis method according to claim 3, characterized in that: The method of using the comparison result of the n+1th data packet to generate key parameters of a new candidate key data packet includes: When the comparison result is that the average data flow gap corresponding to the n+1th data packet is less than or equal to the minimum average data flow gap, the key parameters of the candidate key data packet corresponding to the minimum average data flow gap are replaced with the key parameters of the n+1th data packet.

5. The network traffic analysis method according to claim 3, characterized in that: The method of using the comparison result of the n+1th data packet to generate key parameters of a new candidate key data packet includes: When the comparison result is that the average data flow gap corresponding to the n+1th data packet is greater than or equal to the maximum average data flow gap, the key parameters of the candidate key data packet corresponding to the maximum average data flow gap are replaced with the key parameters of the n+1th data packet.

6. The network traffic analysis method according to claim 3, characterized in that: Generating key parameters of new candidate key data packets according to the comparison result includes: When the comparison result is that the average data flow gap corresponding to the n+1th data packet is greater than the minimum average data flow gap and the average data flow gap corresponding to the n+1th data packet is less than the maximum average data flow gap, the average data flow gap corresponding to the n+1th data packet and the deviation values ​​of multiple intermediate average data flow gaps are calculated in sequence, and the key parameters of the candidate key data packet with the largest deviation value are replaced with the key parameters of the n+1th data packet; wherein the deviation value of the multiple intermediate average data flow gaps is the average data flow gap between the minimum average data flow gap and the maximum average data flow gap.

7. The network traffic analysis method according to claim 1, characterized in that: The neural network is any one of a convolutional neural network, a recurrent neural network, an autoencoder neural network and a variational autoencoder neural network.

8. A network traffic analysis device, characterized in that: include: A determination module, used to determine the time period to be analyzed; An acquisition module, used to acquire key parameters of each target key data packet in a plurality of target key data packets corresponding to the time period to be analyzed by using a P2 algorithm; wherein the key parameters of each target key data packet include its first position in all average data flow gaps and its corresponding average data flow gap; A construction module, configured to construct a target vector using key parameters of each target key data packet according to the order of the first positions; The input module is used to input the target vector into a pre-trained neural network for network traffic analysis to obtain a network traffic analysis result.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the network traffic analysis method as described in any one of claims 1-7 when executing the program stored in the memory.

10. A readable medium having instructions stored thereon, which, when executed by one or more processors, causes the processors to execute the network traffic analysis method according to any one of claims 1 to 7.

Images