A network traffic analysis method and device, electronic equipment and readable medium

Abstract

Embodiments of the present application provide a network traffic analysis method and device, electronic equipment and readable medium, comprising: determining a time period to be analyzed; using a P 2 algorithm, obtaining the key parameters of each target key data packet in the plurality of target key data packets corresponding to the time period to be analyzed; wherein the key parameters of each target key data packet include a first position thereof in all average data flow gaps and an average data flow gap corresponding thereto; constructing a target vector using the average data flow gap corresponding to each target key data packet in the order of the first positions; inputting the target vector into a pre-trained neural network for network traffic analysis to obtain a network traffic analysis result, which reduces storage overhead compared with existing methods.

Description

Technical Field

[0001] This invention relates to the field of network traffic analysis technology, and in particular to a network traffic analysis method, a network traffic analysis device, an electronic device, and a readable medium. Background Technology

[0002] Network traffic analysis is a method for monitoring and analyzing data traffic flowing through a computer network. It helps to identify various network problems and optimize network performance.

[0003] Currently, existing network traffic analysis methods are based on data packets. Specifically, data packet-based analysis involves capturing, decoding, and analyzing each data packet transmitted in the network to obtain detailed information about the network traffic, such as protocol type, source address, destination address, port number, and data content.

[0004] However, existing network traffic analysis methods require storing the analysis results of all data packets, which at least presents a technical problem of high storage overhead.

[0005] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0006] This application provides a network traffic analysis method, apparatus, electronic device, and readable medium to solve the technical problem of high storage overhead in the prior art.

[0007] This application discloses a network traffic analysis method, including: determining the time period to be analyzed; and using P... 2 The algorithm obtains the key parameters of each target key data packet from multiple target key data packets corresponding to the time period to be analyzed. The key parameters of each target key data packet include its first position in all average data stream gaps and its corresponding average data stream gap. According to the order of the first positions, a target vector is constructed using the average data stream gap corresponding to each target key data packet. The target vector is input into a pre-trained neural network for network traffic analysis to obtain the network traffic analysis results.

[0008] In one possible embodiment, using P 2The algorithm obtains key parameters for each target key data packet from multiple target key data packets corresponding to the time period to be analyzed. This includes: determining the key parameters for each candidate key data packet from multiple candidate key data packets based on the first n data packets; calculating the average data flow gap corresponding to the (n+1)th data packet when the (n+1)th data packet is obtained; comparing the average data flow gap corresponding to the (n+1)th data packet with two specified values ​​to obtain a comparison result; where the two specified values ​​are the minimum and maximum average data flow gaps among all candidate key data packets; generating key parameters for new candidate key data packets based on the comparison result; and repeating the above process after obtaining new data packets until no more data packets are obtained, at which point the loop stops.

[0009] In one possible embodiment, generating key parameters for new candidate key data packets based on the comparison results includes: if the comparison results of a preset number of consecutive data packets, including the (n+1)th data packet, are all consistent, then using the comparison result of the (n+1)th data packet, generating key parameters for new candidate key data packets.

[0010] In one possible embodiment, the key parameters of a new candidate key data packet are generated using the comparison result of the (n+1)th data packet, including: if the comparison result shows that the average data flow gap corresponding to the (n+1)th data packet is less than or equal to the minimum average data flow gap, then the key parameters of the candidate key data packet corresponding to the minimum average data flow gap are replaced with the key parameters of the (n+1)th data packet.

[0011] In one possible embodiment, the key parameters of a new candidate key data packet are generated using the comparison result of the (n+1)th data packet, including: if the comparison result shows that the average data flow gap corresponding to the (n+1)th data packet is greater than or equal to the maximum average data flow gap, then the key parameters of the candidate key data packet corresponding to the maximum average data flow gap are replaced with the key parameters of the (n+1)th data packet.

[0012] In one possible embodiment, based on the comparison results, key parameters for new candidate key data packets are generated, including: if the comparison result shows that the average data flow gap corresponding to the (n+1)th data packet is greater than the minimum average data flow gap and the average data flow gap corresponding to the (n+1)th data packet is less than the maximum average data flow gap, then the deviation values ​​of the average data flow gap corresponding to the (n+1)th data packet and multiple intermediate average data flow gaps are calculated sequentially, and the key parameter of the candidate key data packet with the largest deviation value is replaced with the key parameter of the (n+1)th data packet; wherein, the deviation value of the multiple intermediate average data flow gaps is the average data flow gap between the minimum average data flow gap and the maximum average data flow gap.

[0013] In one possible embodiment, the neural network is any one of a convolutional neural network, a recurrent neural network, an autoencoder neural network, and a variational autoencoder neural network.

[0014] This application also provides a network traffic analysis device, including: a determining module for determining the time period to be analyzed; and an acquiring module for using P... 2 The algorithm obtains the key parameters of each target key data packet from multiple target key data packets corresponding to the time period to be analyzed. The key parameters of each target key data packet include its first position in all average data stream gaps and its corresponding average data stream gap. The construction module is used to construct a target vector using the key parameters of each target key data packet according to the order of the first position. The input module is used to input the target vector into a pre-trained neural network for network traffic analysis to obtain the network traffic analysis results.

[0015] This application also provides a storage medium storing a computer program, which is executed by a processor as described in the embodiments of this application.

[0016] This application also provides an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the method described in the embodiments of this application.

[0017] This application also provides a computer program product that, when run on a computer, causes the computer to perform the methods described in the embodiments of this application.

[0018] The embodiments of this application have the following advantages:

[0019] This application provides a network traffic analysis method, apparatus, electronic device, and readable medium, which determines the time period to be analyzed and utilizes P 2The algorithm obtains the key parameters of each target key data packet from multiple target key data packets corresponding to the time period to be analyzed. The key parameters of each target key data packet include its first position in all average data stream gaps and its corresponding average data stream gap. According to the order of the first position, the key parameters of each target key data packet are used to construct a target vector. The target vector is then input into a pre-trained neural network for network traffic analysis to obtain the network traffic analysis results. Compared with existing network traffic analysis methods, it only needs to save the key parameters of each target key data packet in multiple target key data packets, and does not need to save the analysis results of all data packets. Therefore, it only needs to use limited memory to maintain the key storage of multiple target key data packets, reducing storage overhead.

[0020] To make the above-mentioned objectives, features and advantages to be achieved by the embodiments of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A flowchart of a network traffic analysis method provided in an embodiment of this application is shown;

[0023] Figure 2 A schematic diagram of a data stream gap provided in an embodiment of this application is shown;

[0024] Figure 3 This paper shows a structural block diagram of a network traffic analysis device provided in an embodiment of this application;

[0025] Figure 4 A block diagram of an electronic device provided according to an embodiment of this application is shown;

[0026] Figure 5 This is a schematic diagram of a readable medium provided in an embodiment of this application. Detailed Implementation

[0027] The technical solutions of various embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] To address the high storage overhead problem in existing technologies, embodiments of this application provide a network traffic analysis method, apparatus, electronic device, and readable medium. This involves determining the time period to be analyzed and utilizing P... 2 The algorithm obtains the key parameters of each target key data packet from multiple target key data packets corresponding to the time period to be analyzed. The key parameters of each target key data packet include its first position in all average data stream gaps and its corresponding average data stream gap. According to the order of the first position, the key parameters of each target key data packet are used to construct a target vector. The target vector is then input into a pre-trained neural network for network traffic analysis to obtain the network traffic analysis results. Compared with existing network traffic analysis methods, it only needs to save the key parameters of each target key data packet in multiple target key data packets, and does not need to save the analysis results of all data packets. Therefore, it only needs to use limited memory to maintain the key storage of multiple target key data packets, reducing storage overhead.

[0029] To better understand the above technical solutions, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present invention can be understood more clearly and thoroughly, and that the scope of the present invention can be fully conveyed to those skilled in the art.

[0030] To facilitate understanding of the embodiments of this application, the terms involved in this application are explained below:

[0031] Network Traffic Analysis (NTA) is the process of identifying and resolving network performance problems, security threats, and abnormal behavior by monitoring and analyzing network traffic.

[0032] "Data stream gap": It is the sum of the number of data packets received by all other data streams within the time interval between the receipt of two adjacent data packets in a specific data stream.

[0033] "Average data stream gap": It is the average of the sum of the number of data packets received by all other data streams within the time interval between two adjacent data packets in a specific data stream.

[0034] "Convolutional Neural Network" (CNN): It is a deep learning model specifically designed for processing data with a grid structure (e.g., images, time series data, etc.). While CNNs have achieved great success in computer vision, they can also be applied to other fields such as natural language processing and web traffic analysis.

[0035] "Recurrent Neural Network": It is a neural network model specifically designed for processing sequential data. Unlike traditional feedforward neural networks, recurrent neural networks (RNNs) have a recurrent structure that allows information to be passed between time steps, making them particularly suitable for processing time series data, text sequences, speech signals, etc.

[0036] "Autoencoder Neural Network": This is a type of neural network model primarily used for unsupervised learning tasks such as dimensionality reduction, feature learning, and anomaly detection. The core idea of ​​an autoencoder neural network is to use an encoder to compress the input data into a low-dimensional representation (encode), and then a decoder to restore this low-dimensional representation back to the high-dimensional input data. In this way, the autoencoder neural network can learn the important features of the input data.

[0037] Furthermore, this autoencoder neural network can also be called an autoencoder.

[0038] Variational Autoencoder Neural Networks (VANs) are generative models that combine the ideas of autoencoders with Bayesian inference methods. Unlike traditional autoencoders, VANs can not only learn low-dimensional representations of data but also generate new data samples. VANs generate new data points by introducing the distribution of a latent variable, enabling the model to smoothly interpolate in the latent space.

[0039] Furthermore, this variational autoencoder neural network can also be called a variational autoencoder.

[0040] Please see Figure 1 , Figure 1 A flowchart of a network traffic analysis method provided in an embodiment of this application is shown. It should be understood that this network traffic analysis method can be executed by a network traffic analysis device, and the specific device can be configured according to actual needs; this embodiment is not limited thereto. For example, the network traffic analysis device can be a computer or a server, etc. Specifically, the steps of the network traffic analysis method include:

[0041] Step S110: Determine the time period to be analyzed.

[0042] It should be understood that the specific time period to be analyzed can be set according to actual needs, and the embodiments of this application are not limited thereto.

[0043] For example, the time period to be analyzed can be a specified historical time period;

[0044] For example, the time period to be analyzed can be a real-time time period, etc.

[0045] Step S120, using P 2 The algorithm obtains key parameters for each target key data packet from multiple target key data packets corresponding to the time period to be analyzed. The key parameters for each target key data packet include its first position within all average data stream gaps and its corresponding average data stream gap. The specific number of target key data packets can be set according to actual needs, and this application embodiment is not limited to this.

[0046] It should be understood that the process of obtaining the average data stream gap can be set according to actual needs, and the embodiments of this application are not limited to prediction.

[0047] Specifically, for a given data stream f, this application uses the data stream gap value Δf to measure the time difference between data packets within the same data stream, i.e., the instantaneous data stream change at the current moment. This application also uses the average data stream gap value over a period of time. This measures the overall congestion level of the data stream. The following section provides the data stream gap value Δf and the average data stream gap value. Specific definition:

[0048] The data stream gap value Δf refers to the sum of the number of data packets received by all other data streams within the time interval between the reception of two adjacent data packets in a specific data stream f. This time interval includes the time between receiving the first data packet and receiving the second data packet. See [link to documentation] for details. Figure 2 .

[0049] Furthermore, this application may also define g to represent a global packet counter, o f This represents the old global counter when the last packet of data stream f arrives, i.e., the packet counter before the update; c f Let this be the packet counter for data stream f. Based on this, the data stream gap value when the last packet of data stream f arrives is calculated as follows:

[0050] Δf=go f -1.

[0051] And, average data stream gap value It is the average of the number of packets received by all other data streams within the time interval between two adjacent packets in a specific data stream f, and this time interval includes the time between the first and second packets. (Using c) f Let f represent the total number of data packets received by data stream f. The average data stream gap is calculated recursively. Specifically:

[0052] When cf=1,

[0053] When cf≥2,

[0054]

[0055] Furthermore, the data stream gap value and average data stream gap value help to provide a more comprehensive understanding of data traffic. Compared to analyzing the burstiness of data traffic by recording the timestamp of each data packet, using the average data stream gap method offers better performance and efficiency advantages. The average data stream gap can reflect changes in data traffic to a certain extent, while avoiding the problem of frequent operations on the timestamp of each data packet. By calculating the average data stream gap, we can more accurately understand the trend of data traffic changes over a period of time and, to some extent, avoid a large number of recording and comparison operations, thereby improving computational efficiency.

[0056] To facilitate understanding of step S120, it will be described below through specific embodiments.

[0057] Specifically, based on the first n data packets, the key parameters of each candidate key data packet are determined from multiple candidate key data packets. When the (n+1)th data packet is acquired, the average data flow gap corresponding to the (n+1)th data packet is calculated. The average data flow gap corresponding to the (n+1)th data packet is compared with two specified values ​​to obtain a comparison result. The two specified values ​​are the minimum and maximum average data flow gaps among all candidate key data packets, respectively. Based on the comparison result, the key parameters of new candidate key data packets are generated. After acquiring new data packets, the above process is repeated until no more data packets are acquired, at which point the loop stops.

[0058] In cases where the comparison result shows that the average data flow gap corresponding to the (n+1)th data packet is less than or equal to the minimum average data flow gap, the key parameters of the candidate key data packet corresponding to the minimum average data flow gap are replaced with the key parameters of the (n+1)th data packet.

[0059] If the comparison result shows that the average data flow gap corresponding to the (n+1)th data packet is greater than or equal to the maximum average data flow gap, then the key parameters of the candidate key data packet corresponding to the maximum average data flow gap are replaced with the key parameters of the (n+1)th data packet.

[0060] If the comparison result shows that the average data flow gap corresponding to the (n+1)th data packet is greater than the minimum average data flow gap and less than the maximum average data flow gap, then the deviation values ​​of the average data flow gap corresponding to the (n+1)th data packet and multiple intermediate average data flow gaps are calculated sequentially, and the key parameter of the candidate key data packet with the largest deviation value is replaced with the key parameter of the (n+1)th data packet; where the deviation value of the multiple intermediate average data flow gaps is the average data flow gap between the minimum and the maximum average data flow gap.

[0061] It should be understood that the specific calculation process for the deviation value can be set according to actual needs, and the embodiments of this application are not limited thereto.

[0062] For example, the calculation process for this deviation value is as follows:

[0063] The absolute value of the difference between the average data stream gap corresponding to the (n+1)th data packet and the current intermediate average data stream gap can be calculated, and the ratio of the absolute value of this difference to the average data stream gap corresponding to the (n+1)th data packet can be calculated. This ratio is then used as the deviation value corresponding to the current intermediate average data stream gap.

[0064] Furthermore, it should be noted that, considering the delay of the (n+1)th data packet due to temporary network fluctuations, if the comparison results of a predetermined number of consecutive data packets, including the (n+1)th data packet, are consistent, then the comparison result of the (n+1)th data packet can be used to generate key parameters for a new candidate key data packet. This allows the accuracy of the (n+1)th data packet to be verified using multiple consecutive data packets. Simultaneously, the process of generating key parameters for a new candidate key data packet using the comparison result of the (n+1)th data packet is performed after verifying the accuracy of the (n+1)th data packet.

[0065] Step S130: Construct a target vector by using the average data stream gap corresponding to each target key data packet, according to the order of the first position.

[0066] It should be understood that, given the key parameters of the final n target key data packets, the target vector can be constructed using the average data stream gaps corresponding to the n target key data packets.

[0067] Step S140: Input the target vector into a pre-trained neural network to perform network traffic analysis and obtain the network traffic analysis results.

[0068] It should be understood that the specific network of the neural network can be set according to actual needs, and the embodiments of this application are not limited thereto.

[0069] Optionally, the neural network can be any one of the following: convolutional neural network, recurrent neural network, autoencoder neural network, and variational autoencoder neural network.

[0070] Therefore, by utilizing the above technical solution, this application determines the time period to be analyzed and uses P 2 The algorithm obtains key parameters for each target key data packet from multiple target key data packets corresponding to the time period to be analyzed. Each target key data packet's key parameters include its first position within all average data stream gaps and its corresponding average data stream gap. A target vector is constructed using the key parameters of each target key data packet according to the order of its first position. The target vector is then input into a pre-trained neural network for network traffic analysis to obtain the network traffic analysis results. Compared to existing network traffic analysis methods, this method only needs to store the key parameters of each target key data packet from multiple target key data packets, and does not need to store the analysis results of all data packets. Therefore, it only requires limited memory to maintain the key storage of multiple target key data packets, reducing storage overhead. Furthermore, this application can also meet the needs of real-time traffic analysis.

[0071] It should be understood that the above network traffic analysis method is merely exemplary, and those skilled in the art can make various modifications based on the above method, and the modified solutions also fall within the protection scope of this application.

[0072] Please see Figure 3 , Figure 3 A structural block diagram of a network traffic analysis device 300 provided in an embodiment of this application is shown. It should be understood that the network traffic analysis device 300 is capable of performing the various steps in the above method embodiments. The specific functions of the network traffic analysis device 300 can be found in the description above; detailed descriptions are omitted here to avoid repetition. The network traffic analysis device 300 includes at least one software function module that can be stored in a memory or embedded in the operating system (OS) of the network traffic analysis device 300 in the form of software or firmware. Specifically, the network traffic analysis device 300 includes:

[0073] Module 310 is used to determine the time period to be analyzed.

[0074] Acquisition module 320, used to utilize P2 The algorithm obtains the key parameters of each target key data packet from multiple target key data packets corresponding to the time period to be analyzed; wherein, the key parameters of each target key data packet include its first position in all average data stream gaps and its corresponding average data stream gap;

[0075] Module 330 is used to construct a target vector by using the key parameters of each target key data packet in the order of the first position.

[0076] The input module 340 is used to input the target vector into a pre-trained neural network for network traffic analysis and obtain the network traffic analysis results.

[0077] In one possible embodiment, the acquisition module 320 is specifically configured to: determine the key parameters of each candidate key data packet among multiple candidate key data packets based on the first n data packets; when the (n+1)th data packet is acquired, calculate the average data flow gap corresponding to the (n+1)th data packet; compare the average data flow gap corresponding to the (n+1)th data packet with two specified values ​​to obtain a comparison result; wherein the two specified values ​​are the minimum average data flow gap and the maximum average data flow gap among the average data flow gaps corresponding to all candidate key data packets, respectively; generate the key parameters of new candidate key data packets based on the comparison result, and repeat the above process after acquiring new data packets until no more data packets are acquired, at which point the loop stops.

[0078] In one possible embodiment, the acquisition module 320 is specifically used to generate key parameters of a new candidate key data packet by utilizing the comparison result of the (n+1)th data packet when the comparison results of a preset number of consecutive data packets, including the (n+1)th data packet, are all consistent.

[0079] In one possible embodiment, the acquisition module 320 is specifically used to replace the key parameters of the candidate key data packet corresponding to the minimum average data flow gap with the key parameters of the (n+1)th data packet when the comparison result is that the average data flow gap corresponding to the (n+1)th data packet is less than or equal to the minimum average data flow gap.

[0080] In one possible embodiment, the acquisition module 320 is specifically used to replace the key parameters of the candidate key data packet corresponding to the largest average data flow gap with the key parameters of the n+1 data packet if the comparison result is that the average data flow gap corresponding to the (n+1)th data packet is greater than or equal to the largest average data flow gap.

[0081] In one possible embodiment, the acquisition module 320 is specifically configured to: if the comparison result shows that the average data flow gap corresponding to the (n+1)th data packet is greater than the minimum average data flow gap and the average data flow gap corresponding to the (n+1)th data packet is less than the maximum average data flow gap, then sequentially calculate the deviation value between the average data flow gap corresponding to the (n+1)th data packet and multiple intermediate average data flow gaps, and replace the key parameter of the candidate key data packet with the largest deviation value with the key parameter of the (n+1)th data packet; wherein, the deviation value of the multiple intermediate average data flow gaps is the average data flow gap between the minimum average data flow gap and the maximum average data flow gap.

[0082] In one possible embodiment, the acquisition module 320 is specifically used for: the neural network being any one of a convolutional neural network, a recurrent neural network, an autoencoder neural network, and a variational autoencoder neural network.

[0083] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0084] In addition, embodiments of this application also provide an electronic device, such as... Figure 4 As shown, it includes a processor 401, a communication interface 402, a memory 403, and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404.

[0085] Memory 403 is used to store computer programs;

[0086] When processor 401 executes the program stored in memory 403, it performs the following steps:

[0087] Determine the time period to be analyzed;

[0088] Using P 2 The algorithm obtains the key parameters of each target key data packet from multiple target key data packets corresponding to the time period to be analyzed; wherein, the key parameters of each target key data packet include its first position in all average data stream gaps and its corresponding average data stream gap;

[0089] Based on the order of the first position, construct the target vector using the average data stream gap corresponding to each target key data packet;

[0090] The target vector is input into a pre-trained neural network to perform network traffic analysis, and the network traffic analysis results are obtained.

[0091] In this embodiment, the communication interface 402 of the device is used for signaling or data communication with other node devices. The processor 401 can be an integrated circuit chip with signal processing capabilities. The processor 401 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in this embodiment. The general-purpose processor can be a microprocessor, or the processor 401 can be any conventional processor.

[0092] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0093] The communication interface is used for communication between the aforementioned terminal and other devices.

[0094] The memory can be, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), etc.

[0095] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0096] Understandable. Figure 4 The structure shown is for illustrative purposes only; the electronic device may also include components that are more advanced than those shown. Figure 4 The more or fewer components shown, or having the same Figure 4 The different configurations shown. Figure 4 The components shown can be implemented using hardware, software, or a combination thereof.

[0097] like Figure 5 As shown, in another embodiment of the present invention, a readable medium 501 is also provided, which stores instructions that, when run on a computer, cause the computer to execute the campus abnormal behavior identification method described in the above embodiment. Here, the readable medium refers to a computer-readable storage medium.

[0098] In another embodiment of the present invention, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute the campus abnormal behavior identification method described in the above embodiments.

[0099] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the system described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0100] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0101] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0102] It should be understood, in the several embodiments provided in this application, that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0103] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0104] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks. It should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0105] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0106] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method of network traffic analysis, characterized by, The method comprises the following steps: determining a time period to be analyzed; Utilizing P 2 an algorithm, obtain the key parameters of each target key data packet in the plurality of target key data packets corresponding to the time period to be analyzed; wherein the key parameters of each target key data packet include the first position thereof in all average data stream gaps and the average data stream gap corresponding thereto; the data stream gap is the sum of the number of data packets received by all other data streams within the time interval between the reception of two adjacent data packets in one data stream; and the average data stream gap is the average value of the sum of the number of data packets received by all other data streams within the time interval between two adjacent data packets in one data stream. constructing a target vector according to the average data flow gap corresponding to each target key data packet in the order of the first positions; inputting the target vector into a pre-trained neural network for network traffic analysis to obtain a network traffic analysis result; The use of P 2 The algorithm obtains the key parameters of each target key data packet in the plurality of target key data packets corresponding to the time period to be analyzed, including: determining the key parameters of each candidate key data packet from a plurality of candidate key data packets according to the first n data packets; in the case of obtaining the (n+1)th data packet, calculating the average data flow gap corresponding to the (n+1)th data packet; comparing the average data flow gap corresponding to the (n+1)th data packet with two specified values to obtain a comparison result; wherein the two specified values are the minimum average data flow gap and the maximum average data flow gap among the average data flow gaps corresponding to all the candidate key data packets; generating new key parameters of candidate key data packets according to the comparison result, and repeating the above process after obtaining new data packets until no data packets are obtained, then stopping the cycle.

2. The network traffic analysis method of claim 1, wherein, The method of generating new key parameters of candidate key data packets according to the comparison result comprises: in the case that the comparison results of a preset number of continuous data packets including the (n+1)th data packet are consistent, generating new key parameters of candidate key data packets by using the comparison result of the (n+1)th data packet.

3. The network traffic analysis method of claim 2, wherein, The method of generating new key parameters of candidate key data packets according to the comparison result comprises: in the case that the comparison result is that the average data flow gap corresponding to the (n+1)th data packet is less than or equal to the minimum average data flow gap, replacing the key parameters of the candidate key data packet corresponding to the minimum average data flow gap with the key parameters of the (n+1)th data packet.

4. The network traffic analysis method of claim 2, wherein, The method of generating new key parameters of candidate key data packets according to the comparison result comprises: in the case that the comparison result is that the average data flow gap corresponding to the (n+1)th data packet is greater than or equal to the maximum average data flow gap, replacing the key parameters of the candidate key data packet corresponding to the maximum average data flow gap with the key parameters of the (n+1)th data packet.

5. The network traffic analysis method of claim 2, wherein, The method of generating new key parameters of candidate key data packets according to the comparison result comprises: in the case that the comparison result is that the average data flow gap corresponding to the (n+1)th data packet is greater than the minimum average data flow gap and the average data flow gap corresponding to the (n+1)th data packet is less than the maximum average data flow gap, sequentially calculating the deviation values of the average data flow gap corresponding to the (n+1)th data packet and a plurality of intermediate average data flow gaps, and replacing the key parameters of the candidate key data packet with the maximum deviation value with the key parameters of the (n+1)th data packet; wherein the deviation values of the plurality of intermediate average data flow gaps are the average data flow gaps between the minimum average data flow gap and the maximum average data flow gap.

6. The network traffic analysis method of claim 1, wherein, The neural network is any one of a convolutional neural network, a recurrent neural network, a self-encoding neural network, and a variational self-encoding neural network.

7. A network traffic analysis apparatus characterized by comprising: Comprise: The determining module is configured to determine a time period to be analyzed; The acquisition module is configured to acquire, by using a P 2 algorithm, key parameters of each target key data packet in a plurality of target key data packets corresponding to the time period to be analyzed; wherein the key parameters of each target key data packet include a first position of the target key data packet in all average data stream gaps and an average data stream gap corresponding to the target key data packet; the data stream gap is a sum of the number of data packets received by all other data streams in a time interval between two adjacent data packets received in one data stream; and the average data stream gap is an average value of the sum of the number of data packets received by all other data streams in a time interval between two adjacent data packets in one data stream. The constructing module is configured to construct a target vector by using the key parameters of each target key data packet in the order of the first positions; The input module is configured to input the target vector into a pre-trained neural network for network traffic analysis to obtain a network traffic analysis result; The obtaining module comprises: determining the key parameters of each candidate key data packet in a plurality of candidate key data packets according to the first n data packets; in the case that the (n+1)th data packet is obtained, calculating the average data flow gap corresponding to the (n+1)th data packet; comparing the average data flow gap corresponding to the (n+1)th data packet with two specified values to obtain a comparison result; wherein the two specified values are the smallest average data flow gap and the largest average data flow gap among the average data flow gaps corresponding to all candidate key data packets; according to the comparison result, generating the key parameters of a new candidate key data packet, and repeating the above process after obtaining a new data packet until no data packet is obtained, then stopping the cycle.

8. An electronic device, comprising: The processor, the communication interface, and the memory complete mutual communication through the communication bus; The memory is used to store computer programs; The processor is used to execute the programs stored on the memory, and realizes the network traffic analysis method in any one of claims 1-6. 9.A readable medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the network traffic analysis method in any one of claims 1-6.

Images