Marketing service sensitive data network flow anomaly analysis monitoring method

Abstract

The invention discloses a marketing service sensitive data network flow anomaly analysis and monitoring method, and belongs to the technical field of anomaly detection. Establishing an OSPF-LS acquisition channel, and monitoring link state change; an sFlow acquisition channel is established, and link flow changes are monitored; collecting network traffic information, judging abnormal traffic according to a traffic early warning threshold configured by a system, generating real-time network traffic early warning, triggering network traffic scheduling, and synchronizing the network traffic information to a big data analysis platform; and the abnormal traffic is effectively classified and identified through a CNN-BiLSTM network model. According to the invention, efficient and timely multi-vector attack threat identification and detection are realized; the problem of noise in network traffic data is solved, interference of noise on abnormal traffic detection is reduced, and key features are extracted more effectively.

Description

Technical Field

[0001] The present invention relates to the technical field of anomaly detection, and in particular to a method for analyzing and monitoring anomaly of sensitive data network traffic in marketing business. Background Art

[0002] At present, State Grid Corporation and provincial companies are still in the data security 1.0 stage in the field of data security. This stage mainly focuses on the security of a single system, especially database security and content auditing. Database security is the core component of data security during this period, and data security mainly focuses on boundary protection. The marketing business application system includes sensitive data such as customer information, electricity consumption, electricity charges, business expansion registration, and meter asset information. In the process of marketing data sharing, there is a lack of access trace tracking methods and information security risks. At present, the data security system for traffic auditing has the following problems: the security systems of different manufacturers cannot effectively communicate with each other, making it difficult to achieve unified data security management capabilities; different security systems have differences in data collection focus and identification protocol types, resulting in the existence of audit and monitoring blind spots; different security systems have different design concepts and capabilities, so it is difficult to organically integrate them within the organization to form an integrated audit monitoring system or data security governance capabilities.

[0003] At present, intrusion anomaly detection technology can be divided into three categories: traditional methods, machine learning methods, and deep learning methods. Traditional methods focus on security experts studying the characteristics of attack categories and setting relatively reasonable thresholds. Machine learning methods automatically identify malicious traffic patterns through pre-given models. Deep learning has demonstrated powerful pattern recognition capabilities in many fields and is a hot topic in current research.

[0004] Deep learning methods have also begun to be used in intrusion anomaly detection. However, due to the huge amount of data in network intrusion detection, most of which are normal non-attack data, training models is time-consuming and easily affected by data imbalance, which may lead to overfitting or underfitting of the model, thereby reducing the detection effect. The existing intrusion detection methods have a series of problems in several key aspects, including but not limited to low accuracy, difficulty in adapting to complex data distribution, and inaccurate feature extraction. The cumulative effect of these problems leads to a relatively high overall false alarm rate, especially in the process of judging attack traffic. In view of the current situation, it is urgent to find more feasible and effective methods to improve the overall performance of intrusion detection systems. The urgency of this need lies in the fact that the shortcomings of current methods may pose a potential threat to network security. In order to deal with the above problems, it is urgent to study and promote the development of more advanced and reliable intrusion detection methods. These new methods should be able to improve accuracy, complexity of data distribution, and accuracy of feature extraction, so as to achieve more significant results in practical applications, improve accuracy and reduce false alarm rates, so as to meet the increasingly complex network security needs. Summary of the invention

[0005] The purpose of the present invention is to provide a method for analyzing and monitoring abnormal network traffic of sensitive data of marketing business, comprising:

[0006] Establish an OSPF-LS collection channel to monitor link status changes;

[0007] Establish an sFlow collection channel to monitor link traffic changes;

[0008] Collect network traffic information, determine abnormal traffic based on the traffic warning threshold configured by the system, generate real-time network traffic warning and trigger network traffic scheduling, and synchronize network traffic information to the big data analysis platform;

[0009] Abnormal traffic is effectively classified and identified through the CNN-BiLSTM network model.

[0010] Collect network traffic information, determine abnormal traffic based on the traffic warning threshold configured by the system, generate real-time network traffic warning and trigger network traffic scheduling. The specific steps are as follows:

[0011] Step A1: collect network traffic data in real time; then go to step A2;

[0012] Step A2: Detect network traffic data; then go to step A3;

[0013] Step A3: Determine whether there is network congestion. If so, go to step A4; if not, the network is normal;

[0014] Step A4: send to CNN-BiLSTM network model; then go to step A5;

[0015] Step A5: Generate a comparison flow rate change baseline; then go to step A6;

[0016] Step A6: Determine whether the detection is abnormal, if so, go to step A7; if not, go to step A13;

[0017] Step A7: Train the CNN-BiLSTM network model; then go to step A8;

[0018] Step A8: Detect abnormal network traffic; then go to step A9;

[0019] Step A9: Determine whether to associate with traffic warning, if yes, go to step A10; if no, go to step A11;

[0020] Step A10: Generate congestion-related warning information; then go to step A13;

[0021] Step A11: Generate unknown cause congestion warning information; then go to step A12;

[0022] Step A12: Perform NetFlow analysis and diagnosis; then go to step A13;

[0023] Step A13: Triggering abnormal network traffic scheduling.

[0024] The specific steps for effectively classifying and identifying abnormal traffic through the CNN-BiLSTM network model are as follows:

[0025] Step B1: Obtain and preprocess the original data set;

[0026] Step B2: Re-evaluate the input features of the dataset processed in step B1 through the CBAM attention layer, and calculate new weights to optimize the effective feature space and channel information while suppressing useless feature space and channel information;

[0027] Step B3: Use the CNN-BiLSTM network model to extract network traffic features, select Cross-entropy as the loss function, Adam as the optimization algorithm for model training, and use the softmax classifier to detect abnormal traffic;

[0028] Step B4: Evaluate the abnormal traffic results detected in step B3, test the test set, and comprehensively evaluate the performance of the intrusion detection model in the task according to accuracy, precision, F1 score and recall rate.

[0029] The process of constructing the CNN-BiLSTM network model in step B3 is as follows:

[0030] CNN adopts a hierarchical structure including input layer, convolution layer, pooling layer, fully connected layer and output layer; in the convolution layer of CNN, the relu activation function is selected to extract key features from the input data through one-dimensional convolution operation; the fully connected layer maps the features extracted by the convolution layer and the pooling layer to the output layer to achieve global integration of features; the data of the CNN output layer is passed to the BiLSTM network to extract bidirectional long-term temporal features.

[0031] A marketing business sensitive data network traffic abnormality analysis and monitoring device, comprising:

[0032] Status monitoring module, used to establish OSPF-LS collection channel and monitor link status changes;

[0033] Traffic monitoring module, used to establish sFlow collection channels and monitor link traffic changes;

[0034] Traffic analysis module, which is used to collect network traffic information, judge abnormal traffic according to the traffic warning threshold configured by the system, generate real-time network traffic warning and trigger network traffic scheduling, and synchronize network traffic information to the big data analysis platform;

[0035] The traffic processing module is used to effectively classify and identify abnormal traffic through the CNN-BiLSTM network model.

[0036] The traffic analysis module collects network traffic information, determines abnormal traffic based on the traffic warning threshold configured by the system, generates real-time network traffic warnings and triggers network traffic scheduling. The specific steps are as follows:

[0037] Step A1: collect network traffic data in real time; then go to step A2;

[0038] Step A2: Detect network traffic data; then go to step A3;

[0039] Step A3: Determine whether there is network congestion. If so, go to step A4; if not, the network is normal;

[0040] Step A4: send to CNN-BiLSTM network model; then go to step A5;

[0041] Step A5: Generate a comparison flow rate change baseline; then go to step A6;

[0042] Step A6: Determine whether the detection is abnormal, if so, go to step A7; if not, go to step A13;

[0043] Step A7: Train the CNN-BiLSTM network model; then go to step A8;

[0044] Step A8: Detect abnormal network traffic; then go to step A9;

[0045] Step A9: Determine whether to associate with traffic warning, if yes, go to step A10; if no, go to step A11;

[0046] Step A10: Generate congestion-related warning information; then go to step A13;

[0047] Step A11: Generate unknown cause congestion warning information; then go to step A12;

[0048] Step A12: Perform NetFlow analysis and diagnosis; then go to step A13;

[0049] Step A13: Triggering network abnormal traffic scheduling.

[0050] The specific steps for effectively classifying and identifying abnormal traffic through the CNN-BiLSTM network model in the traffic processing module are as follows:

[0051] Step B1: Obtain and preprocess the original data set;

[0052] Step B2: Re-evaluate the input features of the dataset processed in step B1 through the CBAM attention layer, and calculate new weights to optimize the effective feature space and channel information while suppressing useless feature space and channel information;

[0053] Step B3: Use the CNN-BiLSTM network model to extract network traffic features, select Cross-entropy as the loss function, Adam as the optimization algorithm for model training, and use the softmax classifier to detect abnormal traffic;

[0054] Step B4: Evaluate the abnormal traffic results detected in step B3, test the test set, and comprehensively evaluate the performance of the intrusion detection model in the task according to accuracy, precision, F1 score and recall rate.

[0055] The process of constructing the CNN-BiLSTM network model in step B3 is as follows:

[0056] CNN adopts a hierarchical structure including input layer, convolution layer, pooling layer, fully connected layer and output layer; in the convolution layer of CNN, the relu activation function is selected to extract key features from the input data through one-dimensional convolution operation; the fully connected layer maps the features extracted by the convolution layer and the pooling layer to the output layer to achieve global integration of features; the data of the CNN output layer is passed to the BiLSTM network to extract bidirectional long-term temporal features.

[0057] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step in a method for analyzing and monitoring abnormalities in network traffic of sensitive marketing business data is implemented.

[0058] A storage medium stores a computer program, which, when executed by a processor, implements each step of a method for analyzing and monitoring abnormalities in a network flow of sensitive marketing business data.

[0059] The beneficial effects of the present invention are:

[0060] 1. The present invention realizes efficient and timely identification and detection of multi-vector attack threats; solves the noise problem in network traffic data, reduces the interference of noise on abnormal traffic detection, and more effectively extracts key features.

[0061] 2. The present invention enables the model to better understand the time evolution of traffic, further improving detection performance; it can accurately identify different types of abnormal traffic, which helps to detect potential threats and attacks in a timely manner.

[0062] 3. The present invention can automatically extract, identify, track and trace sensitive data such as customer information, electricity consumption, electricity charges, meter asset information, etc., and promptly issue warnings for suspicious operations on sensitive data to avoid security risks such as sensitive data leakage. It can significantly reduce manual intervention and operations, improve network security and stability, and reduce network operating costs and maintenance difficulties.

[0063] 4. Traffic time series feature extraction based on the bidirectional long short-term memory network (BiLSTM) can extract network traffic features more comprehensively and further improve classification accuracy; it can capture long-term dependencies and short-term features in traffic sequences, enabling the model to better understand the dynamic changes of network traffic.

[0064] 5. The method of combining CNN and BiLSTM can effectively improve the accuracy and robustness of network traffic anomaly detection.

[0065] 6. This method uses CNN-BiLSTM to combine the advantages of convolution and bidirectional long short-term memory networks to prevent gradient vanishing and gradient explosion problems during model training. It can better capture the timing relationship when processing network traffic, thereby realizing real-time monitoring of anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 A schematic diagram of a method for analyzing and monitoring abnormal network traffic of sensitive data of marketing business according to the present invention;

[0067] Figure 2 This is a flow chart of the network traffic anomaly detection and analysis method of the present invention;

[0068] Figure 3 The overall flow chart for network abnormal traffic model detection;

[0069] Figure 4 This is the specific structure diagram of the CNN-BiLSTM model. DETAILED DESCRIPTION

[0070] The present invention provides a method for analyzing and monitoring abnormal network traffic of sensitive data of marketing business, which will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0071] Figure 1 It is a schematic diagram of the abnormal analysis and monitoring method of marketing business sensitive data network traffic in the present invention; specifically, it includes: establishing an OSPF-LS collection channel to monitor link status changes; establishing an sFlow collection channel to monitor link traffic changes; collecting network traffic information, judging abnormal traffic according to the traffic warning threshold configured by the system, generating real-time network traffic warning and triggering network traffic scheduling, and synchronizing network traffic information to the big data analysis platform; effectively classifying and identifying abnormal traffic through the CNN-BiLSTM network model.

[0072] Through the above methods, in the event of abnormal changes, the system will conduct in-depth analysis of abnormal traffic changes by comparing actual traffic with the baseline generated by the time series prediction model. Regardless of whether the network anomaly is successfully detected, the system will actively trigger network-level traffic scheduling to ensure network stability and other performance.

[0073] Figure 2 The present invention is a flow chart of the network traffic anomaly detection and analysis method; it includes the following steps:

[0074] Step A1: collect network traffic data in real time; then go to step A2;

[0075] Step A2: Detect network traffic data; then go to step A3;

[0076] Step A3: Determine whether there is network congestion. If so, go to step A4; if not, the network is normal;

[0077] Step A4: send to CNN-BiLSTM network model; then go to step A5;

[0078] Step A5: Generate a comparison flow rate change baseline; then go to step A6;

[0079] Step A6: Determine whether the detection is abnormal, if so, go to step A7; if not, go to step A13;

[0080] Step A7: Train the CNN-BiLSTM network model; then go to step A8;

[0081] Step A8: Detect abnormal network traffic; then go to step A9;

[0082] Step A9: Determine whether to associate with traffic warning, if yes, go to step A10; if no, go to step A11;

[0083] Step A10: Generate congestion-related warning information; then go to step A13;

[0084] Step A11: Generate unknown cause congestion warning information; then go to step A12;

[0085] Step A12: Perform NetFlow analysis and diagnosis; then go to step A13;

[0086] Step A13: Triggering network abnormal traffic scheduling.

[0087] By establishing an sFlow collection channel, the system can monitor the changes in link traffic in real time, and collect current network traffic information in a timely manner, providing strong data support for traffic analysis and network performance evaluation. The system monitors the traffic warning threshold in real time to ensure that it can promptly determine whether there is abnormal traffic in the network to prevent potential network problems. Once the system detects abnormal traffic, it immediately generates a real-time traffic warning and starts network traffic scheduling, taking corresponding measures to quickly and effectively respond to abnormal situations and maintain network stability.

[0088] The collected live network traffic information is sent to the big data analysis platform in real time and synchronously, providing data support for further in-depth analysis and processing, ensuring that the system has a comprehensive understanding of the network status when handling abnormal situations.

[0089] By collecting network traffic in a timely manner, the system can continuously monitor various information during data transmission, including the number, size, source and destination of data packets, to obtain a comprehensive picture of network activity. The system performs complex calculations to compare and evaluate the real-time traffic on each link with the available bandwidth. This involves a comprehensive consideration of factors such as transmission rate and data throughput to more accurately understand the current utilization of network links. By comprehensively considering the ratio of real-time traffic and available bandwidth, the system can accurately determine the utilization of the current link and identify whether there is potential congestion or performance issues. The system is configured with a traffic warning threshold, which is a pre-set warning line. When the traffic on the link approaches or exceeds this threshold, the system will take corresponding measures to avoid potential congestion and performance degradation. The system not only focuses on a single link, but also monitors the entire link range to ensure comprehensive control of network traffic. Based on real-time monitoring and traffic warning thresholds, the system adopts corresponding traffic congestion warning mechanisms. Once the current utilization of the link exceeds the warning threshold, the system immediately triggers a traffic congestion warning and promptly notifies the traffic scheduling system to take corresponding countermeasures. The traffic scheduling system formulates intelligent scheduling strategies based on congestion warning information and takes effective measures in the direction of congestion to ensure efficient operation of the network.

[0090] Using the time series prediction model CNN-BiLSTM trained on the big data analysis platform, the system conducts comprehensive tracking and analysis of abnormal traffic. The model generates a predicted traffic change baseline for in-depth understanding of network traffic anomalies. By comparing the predicted baseline with the actual traffic currently collected in detail, the system deeply analyzes the difference in abnormal traffic. In the abnormal traffic tracking analysis, when the difference between the actual traffic and the predicted baseline is less than the preset threshold, the system determines it as normal congestion and automatically handles it to maintain the normal operation of the network. If the difference exceeds the preset threshold, it is regarded as congestion of unknown cause, and actively attempts to associate it with warning events of network anomalies to better understand the nature of the problem. In the face of warning events that cannot be directly associated with network anomalies, the IPFIX analysis and diagnosis tool is quickly launched. By adopting a comprehensive approach, various network traffic anomalies can be fully understood and responded to. This includes automatic processing of normal congestion, association of unknown cause congestion events, and in-depth analysis of anomalies through IPFIX analysis and diagnosis.

[0091] Figure 3 This is the overall flow chart of network abnormal traffic model detection; the specific process is as follows:

[0092] Step B1: Obtain and preprocess the original data set;

[0093] Step B2: Re-evaluate the input features of the dataset processed in step B1 through the CBAM attention layer, and calculate new weights to optimize the effective feature space and channel information while suppressing useless feature space and channel information;

[0094] Step B3: Use the CNN-BiLSTM network model to extract network traffic features, select Cross-entropy as the loss function, Adam as the optimization algorithm for model training, and use the softmax classifier to detect abnormal traffic;

[0095] Step B4: Evaluate the abnormal traffic results detected in step B3, test the test set, and comprehensively evaluate the performance of the intrusion detection model in the task according to accuracy, precision, F1 score and recall rate.

[0096] The formula for calculating the accuracy of the model prediction is as follows:

[0097]

[0098] The formula for calculating the accuracy of the model prediction is as follows:

[0099]

[0100] The formula for calculating the recall rate of the model prediction is as follows:

[0101]

[0102] The formula for calculating the F1 score of the model prediction is as follows:

[0103]

[0104] In the above scenario, TP (True Positive) and TN (True Negative) represent the correct predictions of the model, that is, the successfully classified instances. In contrast, FP (False Positive) and FN (False Negative) represent the misclassification events of the model, that is, the instances are incorrectly judged as positive or negative.

[0105] With the help of the CNN-BiLSTM model construction method, the convolutional neural network (CNN) and the bidirectional long short-term memory network (BiLSTM) are cleverly integrated to achieve comprehensive capture of network traffic characteristics and timing information. In order to enhance the ability to extract traffic features, this method introduces the CBAM attention layer at the front end of CNN. The CBAM attention layer weights the key features in the network, allowing the model to focus more specifically on important information, thereby improving the efficiency and accuracy of feature extraction. Using the BiLSTM network, this stage focuses on capturing the timing characteristics of traffic. BiLSTM processes time series data in a bidirectional manner, more comprehensively understands the changing laws of traffic, and helps the model better adapt to complex traffic dynamics. The extracted features are classified by the softmax classifier, and the results of abnormal traffic detection are finally obtained. This classification stage enables the model to map the learned features to the corresponding categories, realizing effective classification and identification of abnormal traffic. Figure 4This is the specific structure diagram of the CNN-BiLSTM model. The specific steps of its work are as follows:

[0106] Step 3-1: The extracted data is passed into the convolutional neural network (CNN), whose convolutional structure helps to mine network traffic characteristics.

[0107] Step 3-2: CNN adopts a hierarchical structure, including input layer, convolution layer, pooling layer, fully connected layer and output layer. In the convolution layer of CNN, a one-dimensional convolution operation is used to extract key features from the input data through the convolution operation. The pooling layer is introduced in the CNN structure, and its main function is to reduce the size of the feature map while retaining important feature information, thereby reducing the amount of calculation and improving the efficiency of the model. The fully connected layer maps the features extracted in the convolution and pooling stages to the output layer to achieve global integration of features. In the convolution layer, the relu activation function is selected. This nonlinear activation function introduces nonlinear characteristics, which helps the network better capture and represent the complex relationships of the data and improve the network's expression and fitting capabilities.

[0108] Step 3-3: Pass the output of CNN to BiLSTM. Since traffic information has the sequential characteristics of the previous and next correlations, the BiLSTM network can extract bidirectional long-term temporal features.

[0109] Step 3-4: Classify the model prediction results by applying the softmax classifier to obtain the prediction results of network traffic model anomaly detection.

[0110] The network traffic anomaly detection and analysis method is applicable to a variety of scenarios, including network congestion, failures, and attacks. When the network quality degrades and real-time adjustments are required, the method can quickly identify the network traffic and link status to be detected, and the traffic scheduling system quickly responds to the generated warning. In addition, the generated network fault warning provides more detailed network traffic anomaly information to the downstream system to select a more appropriate processing strategy.

[0111] This embodiment also includes an electronic device and a storage medium. An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step in the method for analyzing and monitoring abnormal network traffic of sensitive data for marketing business is implemented. A storage medium stores a computer program on it. When the computer program is executed by the processor, each step in the method for analyzing and monitoring abnormal network traffic of sensitive data for marketing business is implemented.

[0112] This embodiment achieves efficient and timely identification and detection of multi-vector attack threats; solves the noise problem in network traffic data, reduces the interference of noise on abnormal traffic detection, and more effectively extracts key features.

[0113] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0114] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0115] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0116] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0117] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0118] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for analyzing and monitoring abnormal network traffic of sensitive marketing business data, characterized in that: include: Establish an OSPF-LS collection channel to monitor link status changes; Establish an sFlow collection channel to monitor link traffic changes; Collect network traffic information, determine abnormal traffic based on the traffic warning threshold configured by the system, generate real-time network traffic warning and trigger network traffic scheduling, and synchronize network traffic information to the big data analysis platform; Abnormal traffic is effectively classified and identified through the CNN-BiLSTM network model.

2. The method for analyzing and monitoring abnormal network traffic of sensitive marketing business data according to claim 1 is characterized in that: Collect network traffic information, determine abnormal traffic based on the traffic warning threshold configured by the system, generate real-time network traffic warning and trigger network traffic scheduling. The specific steps are as follows: Step A1: Collect network traffic data in real time; Then go to step A2; Step A2: Detect network traffic data; then go to step A3; Step A3: Determine whether there is network congestion. If so, go to step A4; if not, the network is normal; Step A4: send to CNN-BiLSTM network model; then go to step A5; Step A5: Generate a comparison flow rate change baseline; then go to step A6; Step A6: Determine whether the detection is abnormal, if so, go to step A7; if not, go to step A13; Step A7: Train the CNN-BiLSTM network model; then go to step A8; Step A8: Detect abnormal network traffic; Then go to step A9; Step A9: Determine whether to associate with traffic warning, if yes, go to step A10; if no, go to step A11; Step A10: generating congestion-related warning information; Then go to step A13; Step A11: generating unknown cause congestion warning information; Then go to step A12; Step A12: Perform NetFlow analysis and diagnosis; then go to step A13; Step A13: Triggering network abnormal traffic scheduling.

3. The method for analyzing and monitoring abnormality of network traffic of sensitive marketing business data according to claim 1 is characterized in that: The specific steps for effectively classifying and identifying abnormal traffic through the CNN-BiLSTM network model are as follows: Step B1: Obtain and preprocess the original data set; Step B2: Re-evaluate the input features of the dataset processed in step B1 through the CBAM attention layer, and calculate new weights to optimize the effective feature space and channel information while suppressing useless feature space and channel information; Step B3: Use the CNN-BiLSTM network model to extract network traffic features, select Cross-entropy as the loss function, Adam as the optimization algorithm for model training, and use the softmax classifier to detect abnormal traffic; Step B4: Evaluate the abnormal traffic results detected in step B3, test the test set, and comprehensively evaluate the performance of the intrusion detection model in the task according to accuracy, precision, F1 score and recall rate.

4. The method for analyzing and monitoring abnormality of network traffic of sensitive marketing business data according to claim 3 is characterized in that: The process of constructing the CNN-BiLSTM network model in step B3 is as follows: CNN adopts a hierarchical structure including input layer, convolution layer, pooling layer, fully connected layer and output layer. In the convolution layer of CNN, the relu activation function is selected to extract key features from the input data through one-dimensional convolution operation. The fully connected layer maps the features extracted by the convolutional layer and the pooling layer to the output layer to achieve global integration of features; the data of the CNN output layer is passed to the BiLSTM network to extract bidirectional long-term temporal features.

5. A marketing business sensitive data network traffic abnormality analysis and monitoring device, characterized in that: include: Status monitoring module, used to establish OSPF-LS collection channel and monitor link status changes; Traffic monitoring module, used to establish sFlow collection channels and monitor link traffic changes; Traffic analysis module, which is used to collect network traffic information, judge abnormal traffic according to the traffic warning threshold configured by the system, generate real-time network traffic warning and trigger network traffic scheduling, and synchronize network traffic information to the big data analysis platform; The traffic processing module is used to effectively classify and identify abnormal traffic through the CNN-BiLSTM network model.

6. The marketing business sensitive data network traffic abnormality analysis and monitoring device according to claim 5 is characterized in that: The traffic analysis module collects network traffic information, determines abnormal traffic according to the traffic warning threshold configured by the system, generates real-time network traffic warning and triggers network traffic scheduling. The specific steps are as follows: Step A1: Collect network traffic data in real time; Then go to step A2; Step A2: Detect network traffic data; then go to step A3; Step A3: Determine whether there is network congestion. If so, go to step A4; if not, the network is normal; Step A4: send to CNN-BiLSTM network model; then go to step A5; Step A5: Generate a comparison flow rate change baseline; then go to step A6; Step A6: Determine whether the detection is abnormal, if so, go to step A7; if not, go to step A13; Step A7: Train the CNN-BiLSTM network model; then go to step A8; Step A8: Detect abnormal network traffic; Then go to step A9; Step A9: Determine whether to associate with traffic warning, if yes, go to step A10; if no, go to step A11; Step A10: generating congestion-related warning information; Then go to step A13; Step A11: generating unknown cause congestion warning information; Then go to step A12; Step A12: Perform NetFlow analysis and diagnosis; then go to step A13; Step A13: Triggering network abnormal traffic scheduling.

7. The marketing business sensitive data network traffic abnormality analysis and monitoring device according to claim 5 is characterized in that: The specific steps of effectively classifying and identifying abnormal traffic through the CNN-BiLSTM network model in the traffic processing module are as follows: Step B1: Obtain and preprocess the original data set; Step B2: Re-evaluate the input features of the dataset processed in step B1 through the CBAM attention layer, and calculate new weights to optimize the effective feature space and channel information while suppressing useless feature space and channel information; Step B3: Use the CNN-BiLSTM network model to extract network traffic features, select Cross-entropy as the loss function, Adam as the optimization algorithm for model training, and use the softmax classifier to detect abnormal traffic; Step B4: Evaluate the abnormal traffic results detected in step B3, test the test set, and comprehensively evaluate the performance of the intrusion detection model in the task according to accuracy, precision, F1 score and recall rate.

8. The marketing business sensitive data network traffic abnormality analysis and monitoring device according to claim 7 is characterized in that: The process of constructing the CNN-BiLSTM network model in step B3 is as follows: CNN adopts a hierarchical structure including input layer, convolution layer, pooling layer, fully connected layer and output layer. In the convolution layer of CNN, the relu activation function is selected to extract key features from the input data through one-dimensional convolution operation. The fully connected layer maps the features extracted by the convolutional layer and the pooling layer to the output layer to achieve global integration of features; the data of the CNN output layer is passed to the BiLSTM network to extract bidirectional long-term temporal features.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, each step of the method for analyzing and monitoring abnormal network traffic of sensitive marketing business data as described in any one of claims 1 to 4 is implemented.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, each step of the method for analyzing and monitoring abnormal network traffic of sensitive marketing business data as claimed in any one of claims 1 to 4 is implemented.

Images