Road traffic network anomaly detection method and device, electronic equipment and storage medium

Abstract

The invention provides a road traffic network anomaly detection method and device, electronic equipment and a storage medium, and the method is applied to a cloud edge cooperative traffic network system, and comprises an equipment layer, an edge calculation layer and a cloud calculation layer. The method comprises the following steps: acquiring network flow data by using a device layer, and sending the network flow data to an edge computing layer; classifying the network traffic data by using the anomaly detection model downloaded by the edge computing layer, determining normal traffic and abnormal traffic, and sending the abnormal traffic to the cloud computing layer; the anomaly detection model is preset in a cloud computing layer; identifying an attack technology of abnormal traffic by using a deep learning model preset in a cloud computing layer, and combining ATTamp according to the attack technology; the CK framework determines an attack path graph; and determining an attack chain by using the attack path graph, and determining an attack target and an attack source according to the attack path graph and the attack chain. And classification of network traffic data and attack behavior identification are processed in a layered manner through a cloud edge collaborative architecture.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a road traffic network anomaly detection method, device, electronic device and storage medium. Background Art

[0002] With the widespread application of intelligent transportation systems (ITS), traffic management and road safety in modern cities are increasingly dependent on information and communication technologies, IoT devices, and networked monitoring systems. These systems have not only improved traffic efficiency and reduced the occurrence of traffic accidents, but also provided data support for intelligent vehicles, traffic light scheduling, public transportation management, etc. However, with the rapid development of intelligent transportation systems, they are also facing the threat of network attacks and abnormal traffic behavior. Summary of the invention

[0003] In view of this, the purpose of the present application is to propose a road traffic network anomaly detection method, device, electronic device and storage medium that overcome the above-mentioned problems or at least partially solve the above-mentioned problems.

[0004] Based on the above purpose, the first aspect of the present application provides a road traffic network anomaly detection method, which is characterized by being applied to a cloud-edge collaborative traffic network system, including: a device layer, an edge computing layer, and a cloud computing layer; the method includes: Using the device layer to collect network traffic data, and sending the network traffic data to the edge computing layer; The network traffic data is classified using the anomaly detection model downloaded by the edge computing layer to determine normal traffic and abnormal traffic, and the abnormal traffic is sent to the cloud computing layer; the anomaly detection model is preset in the cloud computing layer; The deep learning model preset in the cloud computing layer is used to identify the attack technology of the abnormal traffic, and an attack path diagram is determined according to the attack technology; the attack path diagram is used to determine the attack chain, and the attack target and attack source are determined according to the attack path diagram and the attack chain.

[0005] Optionally, the anomaly detection model includes multiple decision trees; The utilizing the anomaly detection model downloaded by the edge computing layer to classify the network traffic data and determine normal traffic and abnormal traffic includes: Input the network traffic data one by one into each decision tree in sequence, each decision tree continuously splits the characteristic value of the network traffic data until the leaf node of the decision tree represents a classification result, and outputs the classification result of each decision tree; wherein different decision trees select different characteristic values ​​of the network traffic data; The classification results of the multiple decision trees are voted, and the network traffic data is divided into normal traffic and abnormal traffic according to the voting results.

[0006] Optionally, the preset deep learning model includes: a convolutional neural network layer, a long short-term memory network layer and a fully connected output layer; Using the deep learning model preset in the cloud computing layer to identify the attack technology of the abnormal traffic includes: Determining attribute characteristics of the abnormal traffic using the convolutional neural network layer; Determine the time characteristics of the abnormal traffic by using the long short-term memory network layer, and establish the time dependency of the abnormal traffic; Concatenating the attribute features and the dependency relationship to form a first feature vector; The first feature vector is classified using the multiple fully connected output layers to determine the abnormal type of the first feature vector.

[0007] Optionally, determining the attack path diagram according to the attack technology type includes: Determining a mapping table between the anomaly type and at least one attack technique; Determine the technical dependency relationship between the attack technologies according to the mapping table; Determine the time sequence of abnormal traffic corresponding to the attack technique according to the mapping table; The attack path graph is determined by taking the attack technology as a node and the technology dependency and the time sequence as directed edges.

[0008] Optionally, determining an attack chain using an attack path diagram, and determining an attack target and an attack source according to the attack path diagram and the attack chain, includes: Traversing the attack path graph, determining the technical dependency relationship of each node in the attack path graph, and determining the attack behavior of the attack technology according to the technical dependency relationship; Determine the shortest attack path of the attack technology according to the directed edges; Using a community detection algorithm to identify each of the nodes in the attack path graph, and determine the jump paths between different attack techniques; Determine an attack target and an attack source according to the attack behavior and the shortest attack path; According to the jump path and the attack behavior, potential attack targets and potential attack sources are determined.

[0009] Optionally, after collecting network traffic data using the device layer, the following steps are included: Converting the network traffic data into a preset standardized format; Using Z-Score to standardize continuous numerical data in the network traffic data; One-hot encoding is used for discrete categorical variables in the network traffic data.

[0010] Optionally, the method further includes: in response to determining the abnormal traffic by using the edge computing layer and determining the attack technology of the abnormal traffic by using the cloud computing layer, sending warning information to the device layer, wherein the warning information includes the attack target, attack source, potential attack target and potential attack source, and the location of the node in the attack path graph; Block the access connection of the attack source corresponding to the abnormal traffic in the device layer or disconnect the access connection of the attack technology corresponding to the abnormal traffic.

[0011] Based on the same inventive concept, the embodiment of the present application also provides a road traffic network anomaly detection device, which is applied to a cloud-edge collaborative traffic network system, including: a device layer, an edge computing layer, and a cloud computing layer; The device comprises: A collection module, used to collect network traffic data using the device layer and send the network traffic data to the edge computing layer; A classification module, which classifies the network traffic data using the anomaly detection model preset by the cloud computing layer downloaded by the edge computing layer, determines normal traffic and abnormal traffic, and sends the abnormal traffic to the cloud computing layer; A determination module uses the deep learning model preset in the cloud computing layer to identify the attack technology type of the abnormal traffic, and determines the attack path diagram according to the attack technology type; determines the attack chain using the attack path diagram, and determines the attack target and attack source according to the attack path diagram and the attack chain.

[0012] Based on the same inventive concept, an embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the road traffic network anomaly detection method as described in the first aspect is implemented.

[0013] Based on the same inventive concept, an embodiment of the present application also provides a non-transitory computer-readable storage medium, which stores computer instructions, characterized in that the computer instructions are used to enable a computer to execute the road traffic network anomaly detection method described in the first aspect.

[0014] From the above, it can be seen that the road traffic network anomaly detection method, device, electronic device and storage medium provided by the present application, through the cloud-edge collaborative architecture, adopts two-stage traffic anomaly detection, classifies a large amount of network traffic data at the edge computing layer, and further identifies the abnormal traffic obtained by classification to determine the attack technology type, attack path diagram and attack chain of the abnormal traffic at the cloud computing layer, and determines the attack target, attack source and potential attack target through the attack path diagram and attack chain. Provide a more accurate defense strategy for network security protection, identify attackers in time and effectively block the spread of attacks. Further classify the network traffic data at the edge computing layer, analyze the attack technology type of abnormal traffic, attack path diagram and attack chain at the cloud computing layer, and the layered processing mode improves the response speed to possible attack behaviors in the network traffic data, optimizes the use of bandwidth, and ensures efficient resource utilization. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 This is a flow chart of a road traffic network anomaly detection method 100 according to an embodiment of the present application; Figure 2 A flow chart of classifying network traffic data according to an embodiment of the present application; Figure 3 This is a flowchart of the attack technology for identifying abnormal traffic in an embodiment of the present application; Figure 4 A flow chart of determining an attack path diagram according to an embodiment of the present application; Figure 5 A flowchart for determining attack targets and attack sources according to an embodiment of the present application; Figure 6 A schematic diagram of a road traffic network anomaly detection device according to an embodiment of the present application; Figure 7 A schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0018] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0019] As described in the above background technology, the intelligent transportation system faces threats from network attacks and abnormal traffic behavior. The core of the intelligent transportation system lies in networked devices and sensors, which provide key support for traffic management by collecting traffic flow, vehicle information, environmental monitoring data, etc. as network traffic data in real time. However, it is precisely because of the high connectivity and data dependence of these devices and sensors that they become potential targets of attack. For example, malicious DDoS (distributed denial of service) attacks may cause the intelligent transportation system to be paralyzed, such as traffic lights failing or surveillance cameras being out of service. Through port scanning or malicious intrusion, attackers may obtain sensitive traffic data or tamper with traffic flow information, thereby disrupting traffic order, causing accidents, and even implementing malicious traffic manipulation behaviors. Therefore, how to timely detect and determine abnormal traffic and intrusion behaviors has become the key to ensuring the safe and stable operation of the intelligent transportation system.

[0020] With the changes in network environment and the evolution of attack methods, network traffic anomaly detection methods are also constantly evolving. Initially, the rule-based network traffic anomaly detection method always detected attack patterns by matching manually set rules. Although it was simple and low in implementation cost, it could not identify the location of the attack and required frequent rule updates to deal with new attack patterns.

[0021] After that, statistical methods became the mainstream for detecting network traffic anomalies. This method analyzes the statistical characteristics of network traffic, builds a model of normal traffic, and determines whether there is an anomaly based on traffic changes (such as sudden increases or decreases). Although statistical methods can detect some text attacks and are suitable for large-scale traffic detection, they have limitations when facing highly complex or frequently changing attack patterns.

[0022] In some embodiments of the present application, in most network traffic data, normal traffic accounts for the majority, while abnormal traffic is relatively scarce. In network attack behaviors, merely effectively distinguishing between normal traffic and abnormal traffic in network traffic data to determine whether there is a network attack and security incident cannot effectively determine the attacker's behavior pattern. Further identification of the attacker, the attack target, and the potential attack target is required to effectively respond to the attack and improve the safety and anti-attack capabilities of the road traffic network.

[0023] The embodiment of the present application provides a road traffic anomaly detection method, which is applied to a cloud-edge collaborative traffic network system, including: a device layer, an edge computing layer and a cloud computing layer; the method includes: using the device layer to collect network traffic data, and sending the network traffic data to the edge computing layer; using the anomaly detection model downloaded by the edge computing layer to classify the network traffic data, determine normal traffic and abnormal traffic, and send the abnormal traffic to the cloud computing layer; the anomaly detection model is preset in the cloud computing layer; using the deep learning model preset in the cloud computing layer to identify the attack technology type of abnormal traffic, determine the attack path diagram according to the attack technology type combined with the ATT&CK framework, determine the attack chain using the attack path diagram, and determine the attack target and attack source according to the attack path diagram and the attack chain. Through the cloud-edge collaborative architecture, a two-stage traffic anomaly detection is adopted, a large amount of network traffic data is classified at the edge computing layer, and at the cloud computing layer, the abnormal traffic obtained by classification is further identified to determine the attack technology type of abnormal traffic and the attack path diagram and attack chain, and the attack target, attack source and potential attack target are determined through the attack path diagram and attack chain. Provide a more accurate defense strategy for network security protection, identify attackers in time and effectively block the spread of attacks. The network traffic data is further classified at the edge computing layer, and the attack technology types of abnormal traffic, as well as the attack path diagram and attack chain analysis are analyzed at the cloud computing layer. The layered processing mode improves the response speed to possible attack behaviors in the network traffic data, optimizes the use of bandwidth, and ensures efficient resource utilization.

[0024] refer to Figure 1 As shown, a flow chart of a road traffic network anomaly detection method 100 provided in an embodiment of the present application is applied to a cloud-edge collaborative traffic network system, including a device layer, an edge computing layer and a cloud computing layer; the method 100 starts at step S101, uses the device layer to collect network traffic data, and sends the network traffic data to the edge computing layer.

[0025] In some embodiments, the device layer includes: various hardware devices in the traffic road network, such as cameras, sensors, etc. The network traffic data includes various network traffic data, device logs, and other information collected by the device layer.

[0026] In some embodiments, after collecting network traffic data using the device layer, the method further includes: Convert network traffic data into a preset standardized format.

[0027] In this step, considering that the network traffic data collected by the device layer comes from different data sources, that is, different hardware devices, the data formats of different data sources will be different. In order to facilitate the subsequent edge computing layer to classify the network traffic data, and the cloud computing layer to identify the attack technology type, attack path diagram and attack chain of abnormal traffic in the network traffic data.

[0028] At the same time, this process includes clearing invalid data, removing unobjectionable features in network traffic data, and standardizing information fields, such as unifying timestamp formats and IP address representation methods.

[0029] Use Z-Score standardization for continuous numerical data in network traffic data.

[0030] In this step, different features in the network traffic data have different dimensions and value ranges (such as length in meters and time in hours, minutes and seconds). Directly using these data may cause the subsequent anomaly detection model of the edge computing layer and the deep learning model of the cloud computing layer to allocate unreasonable weights to certain features. Z-Score standardization converts numerical data into a distribution with a mean of 0 and a standard deviation of 1, eliminating dimension and scale differences and making different features comparable. At the same time, Z-Score standardization has a certain robustness to outliers, because it is based on the mean and standard deviation of numerical data. Outliers have a greater impact on the mean and standard deviation. Through Z-Score standardization, the distribution of continuous numerical data is relatively stable.

[0031] One-hot encoding is used for discrete categorical variables in network traffic data.

[0032] In this step, for non-numeric data in network traffic data, one-hot encoding is used to convert categorical variables (non-numeric data) into binary vectors (0 and 1), so that the subsequent decision tree and preset deep learning model can understand and process the relevant non-numeric data. One-hot encoding is easy to understand and implement, and it represents categories through binary vectors, avoiding misleading information caused by numerical values.

[0033] Afterwards, in step S102, the network traffic data is classified using the anomaly detection model downloaded from the edge computing layer to determine normal traffic and abnormal traffic, and the abnormal traffic is sent to the cloud computing layer; the anomaly detection model is preset in the cloud computing layer.

[0034] In some embodiments, the edge computing layer may be a server close to the device layer, wherein the edge computing layer classifies the network traffic data by downloading a preset anomaly detection model to the cloud computing layer.

[0035] It is understandable that the anomaly detection model is preset in the cloud computing layer to reduce the memory usage of the edge computing layer, and during the updating process of the anomaly detection model, the computing resource usage of the edge computing layer is reduced.

[0036] It should be noted that after the anomaly detection model is updated in the cloud computing layer, the edge computing layer also updates the downloaded anomaly detection model by downloading the update package from the cloud computing layer.

[0037] Before using the anomaly detection model to classify network traffic data, the anomaly detection model needs to be created and trained.

[0038] In some embodiments, creating an anomaly detection model includes: Determine a preset second normal flow and a preset second abnormal flow, and divide the second normal flow and the second abnormal flow into a training set and a test set; The training set is convenient for subsequent training of the anomaly detection model, and the test set is convenient for subsequent verification of the performance of the model. It can be understood that the second normal traffic and the second abnormal traffic can be the normal traffic and abnormal traffic known in the database.

[0039] The training set is randomly divided into multiple subsets, and multiple decision trees are generated using the multiple subsets; each decision tree continuously splits the characteristic values ​​of the second normal flow and the second abnormal flow in each subset until each leaf node of the decision tree represents a classification result.

[0040] In network traffic data, normal traffic accounts for the vast majority, while abnormal traffic is relatively rare. The imbalance of data often leads to the tendency to predict normal traffic during model training, thereby reducing the detection effect of abnormal traffic. Even if oversampling, undersampling and other technologies are used to balance data, the scarcity and diversity of abnormal traffic also restrict the training and generalization capabilities of the model, reducing the detection accuracy. Balancing the amount of normal traffic with the amount of abnormal traffic will result in too little training data, affecting the detection accuracy of the model.

[0041] In this step, the training set is randomly divided into multiple subsets, each of which can be sampled with replacement. Each subset is used to train a single decision tree. During the splitting process of the decision tree, the feature values ​​of the second normal flow and the second abnormal flow in each subset are randomly selected and continuously split until each leaf node represents a classification result.

[0042] In some exemplary embodiments, the feature value may be one or more of an IP address, a protocol type, or a packet length. The feature values ​​of each decision tree may be different, and the decision trees obtained using different feature values ​​characterize the classification results of the decision tree from different aspects to avoid overfitting.

[0043] Repeat the above process to generate multiple decision trees to form a random forest.

[0044] In some embodiments, training an anomaly detection model includes: The random forest is trained using the training set, and each decision tree independently classifies the data in the training set (the second normal traffic and the second abnormal traffic).

[0045] During the training process, the feature values ​​of the second normal traffic and the second abnormal traffic are randomly selected to ensure the diversity of each decision tree, thereby improving the generalization ability of the anomaly detection model.

[0046] Finally, the test set can be used to test the trained anomaly detection model (decision tree) and judge the accuracy of the classification results of the anomaly detection model.

[0047] In some embodiments, reference Figure 2 , a flow chart for classifying network traffic data is shown, including: S201, inputting network traffic data one by one into each decision tree in sequence, each decision tree continuously splits the characteristic value of the network traffic data until the leaf node of the decision tree represents a classification result, and outputs the classification result of each decision tree; wherein different decision trees select different characteristic values ​​of the network traffic data; S201. Voting on the classification results of the plurality of decision trees, and dividing the network traffic data into normal traffic and abnormal traffic according to the voting results.

[0048] In this step, the anomaly detection model created and trained by the above embodiment is used to input network traffic data into each decision tree one by one. For each network traffic data, each tree outputs a result, that is, normal or abnormal. The classification results of all decision trees are voted, and the most classification results are taken as the final classification results. This is until all network traffic data are classified.

[0049] In this embodiment, the use of decision trees does not require complex feature selection for network traffic data and is easy to implement. Overfitting is prone to occur when processing complex high-dimensional data such as network traffic data. Therefore, a random forest is formed by multiple decision trees and the output results are voted on, thereby improving the stability and generalization ability of the anomaly detection model.

[0050] In step S103, the deep learning model preset in the cloud computing layer is used to identify the attack technology type of the abnormal traffic, and the attack path diagram is determined according to the attack technology type; the attack path diagram is used to determine the attack chain, and the attack target and attack source are determined according to the attack path diagram and the attack chain.

[0051] In this embodiment, the preset deep learning model includes a convolutional neural network layer (CNN), a long short-term memory network layer (LSTM) and a fully connected output layer.

[0052] refer to Figure 3 As shown, first in step S301, the attribute characteristics of the first abnormal quantity are determined using a convolutional neural network layer.

[0053] In this step, the abnormal traffic is sent to the cloud computing layer in the form of data packets. The convolutional neural network is used to capture the structural features in the abnormal traffic. The convolutional neural network can include a stack of 3 to 5 convolutional layers and pooling layers to automatically extract attribute features in the abnormal traffic, such as IP address fields, protocol types, packet lengths, and other attribute features.

[0054] S302: Determine the time characteristics of abnormal traffic by using the long short-term memory network layer, and establish the time dependency of the abnormal traffic.

[0055] In this step, since the device layer collects network traffic data in real time and sends it to the edge computing layer, the edge computing layer classifies the network traffic data and sends the abnormal traffic to the cloud computing layer. Therefore, the abnormal traffic sent to the cloud computing layer has a temporal sequence. The long short-term memory network layer is used to capture the time characteristics of abnormal traffic (data packets). The long short-term memory network layer can effectively capture the temporal dependency of abnormal traffic through the gating mechanism (input gate, forget gate and output gate), that is, the anomaly with obvious time evolution characteristics, and establish a temporal dependency. For example, DDos attack.

[0056] It is understandable that in the process of determining the time characteristics of abnormal traffic using the long short-term memory network layer, the determination can be performed by standardizing the timestamp of the network traffic data at the device layer.

[0057] S303: Concatenate attribute features and dependency relationships to form a first feature vector.

[0058] By concatenating attribute features and dependencies, the abnormal traffic is represented as a feature vector with more comprehensive feature attributes. At the same time, the temporal dependency of the abnormal traffic is used to determine the temporal dependency of the first feature vector.

[0059] In this embodiment, a channel concatenation method is used to fuse the attribute features output by the convolutional neural network layer and the time dependency of the long short-term memory network layer to obtain the fused features, i.e., the first feature vector.

[0060] S304: Classify the first feature vector using the fully connected output layer to determine the abnormal type of the first feature vector.

[0061] In this step, the fused features are compressed by two layers of fully connected networks, and finally the probability distribution of abnormal traffic is output through the Softmax function to obtain the final abnormal type classification result.

[0062] In order to identify the attack path behind the abnormal traffic and the behavior patterns that the attacker may adopt, the attack path diagram is further determined based on the type of attack technology used.

[0063] Specifically, refer to Figure 4 As shown in the figure, the attack path diagram is determined according to the attack technology type, including: S501, determining a mapping table between the anomaly type and at least one attack technique; S502, determining the technical dependency relationship between the attack technologies according to the mapping table; S503, determining the time sequence of abnormal traffic corresponding to the attack technology according to the mapping table; S504: Determine the attack path graph by taking the attack technology as a node and the technology dependency relationship and the time sequence as directed edges.

[0064] In this embodiment, the attack path map can be constructed in combination with the ATT&CK framework.

[0065] Specifically, by combining the ATT&CK framework, the knowledge and experience of security experts, and the existing database, a mapping table between anomaly types and attack techniques is manually constructed. For example, the anomaly type DoS corresponds to the Impact (affecting availability) technology, as well as the Network Traffic Flooding (network traffic overload) and Resource Exhaustion (resource consumption) technology. That is, there is a mapping relationship between an anomaly type DoS and the three attack techniques.

[0066] After that, the attack technology is defined as a node, which includes the information of the abnormal traffic itself, such as timestamp, abnormal type, traffic characteristics, etc. In addition, in order to facilitate the subsequent generation of security reports and responses, some other attributes can also be attached, such as the affected system. Then, according to the dependency between the attack technologies in the mapping table and the time sequence of the abnormal traffic corresponding to the attack technologies, the directed edges between the nodes are constructed to determine the attack path graph. The attack path graph obtained by the above method can clearly show the causal relationship and dependency between the attack technologies. The directed edges in the graph represent the order of the attack technologies, which can reflect the attacker's behavior trajectory and help analyze the attacker's intentions, attack path graphs, and subsequent possible attack targets.

[0067] After determining the attack path graph, it is necessary to perform correlation analysis through graph correlation algorithms to determine the attack targets and attack sources, reveal potential attack paths, and identify potential attack targets.

[0068] Specifically, refer to Figure 5 As shown in the figure, the attack path diagram is used to determine the attack chain, and the attack target and attack source are determined according to the attack path diagram and the attack chain, including: S601, traverse the attack path graph, determine the technical dependency relationship of each node in the attack path graph, and determine the attack behavior of the attack technology according to the technical dependency relationship.

[0069] In this step, the graph traversal algorithm can be used to perform a depth-first search for the technical dependencies between the nodes in the deep attack path graph to identify complex, recursive attack behaviors. For example, if you want to use attack technology B to attack between two attack technologies, node A and node B, you must use attack technology A to launch the attack. By identifying the technical dependencies between attack technology A and attack technology B, the recursive attack behavior from attack technology A to attack technology B is revealed.

[0070] S602: Determine the shortest attack path of the attack technology type according to the directed edges.

[0071] In this step, breadth-first search is used to identify the shortest path that the attacker may choose, thereby revealing how the attacker can advance quickly. For example, the path between node A and node B with the fewest nodes is the shortest attack path.

[0072] S603: Use a community detection algorithm to identify each node in the attack path graph and determine the jump paths between different attack techniques.

[0073] In this step, the community detection algorithm is used to find closely connected node groups (i.e., communities) in the network, while the connection with other communities is relatively weak. In an embodiment of the present application, the community detection algorithm is used to analyze the attack path graph and identify the close connection between the attack techniques that the attacker may use. It helps to reveal the attacker's "attack group", that is, the close connection between multiple attack techniques, and at the same time can reveal the jump path of the attacker from one attack technique to another, so as to facilitate the subsequent determination of potential attack targets based on the jump path. For example, node A and node B each have a community as an attack technology, and there is no directed edge connecting node A and node B. By revealing the jump path between attack technology A and attack technology B between node A and node B, the jump path is used as a directed edge, and the connection between attack technology A and attack technology B is established through the directed edge, thereby determining the potential attack target of attack technology A pointing to attack technology B.

[0074] S604: Determine the attack target and attack source according to the attack behavior and the shortest attack path diagram.

[0075] In this step, the attack behavior is used to determine the different nodes in the attack path diagram, that is, the dependencies between different attack techniques. The shortest attack path is used to reveal the attacker's rapid advancement method, so as to determine the attack source and attack target.

[0076] S605: Determine potential attack targets and potential attack sources according to the jump path and the attack behavior.

[0077] The jump path is used to identify the attacker's jump path from one attack technology to another. Based on the jump path and the attack behavior, the attack path not explicitly shown in the attack path diagram is determined, thereby effectively revealing potential attack targets and potential attack sources.

[0078] In some embodiments, the road traffic network anomaly detection method provided by the embodiments of the present application further includes: In response to attack techniques that utilize the edge computing layer to determine abnormal traffic and utilize the cloud computing layer to determine abnormal traffic, early warning information is sent to the device layer, and the early warning information includes attack targets, attack sources, potential attack targets and potential attack sources, and node locations in the attack path graph.

[0079] Block the access connection of the attack source corresponding to the abnormal traffic in the device layer or disconnect the access connection of the attack technology corresponding to the abnormal traffic.

[0080] In this embodiment, after identifying abnormal traffic in network traffic data and determining the attack path diagram and attack link for the attack technology corresponding to the abnormal traffic, it is also necessary to have timely warning of anomalies caused by the abnormal traffic, respond to attacks, prevent attacks, and conduct subsequent analysis.

[0081] The warning mechanism is triggered based on the classification results of network traffic data and the output of the attack path map and attack chain. When the edge computing layer classifies and identifies the existence of abnormal traffic or uses the deep learning model in the cloud computing layer to identify the use of attack technology corresponding to abnormal traffic, a warning is triggered. The warning information includes the attack target, attack source, potential attack target, potential attack source, and the location of the current attack technology in the attack path map. The further actions of the attacker are blocked or blocked in time through the response attack mechanism, such as blocking the IP corresponding to the abnormal traffic and stopping the abnormal traffic from further transmitting data. Or for lateral movement behavior in the device layer (such as attackers trying to invade other nodes laterally), by locating the nodes in the attack path map, the access control of the device layer intranet is strengthened or the access connection of the node is forcibly disconnected.

[0082] After completing the corresponding warning, response and blocking of abnormal traffic, the cloud computing layer is used to generate a security report to analyze the abnormal traffic and its corresponding attack techniques, attack path maps and attack chains, which facilitates the subsequent updating of anomaly detection models and deep learning models.

[0083] In some embodiments, the edge computing layer sends normal traffic to the cloud computing layer at a predetermined frequency. Through normal traffic and abnormal traffic, the abnormal detection model and deep learning model preset in the cloud computing layer can be trained.

[0084] The embodiment of the present application provides a road traffic network anomaly detection method, which uses a cloud-edge collaborative architecture and a two-stage traffic anomaly detection to classify a large amount of network traffic data at the edge computing layer. At the cloud computing layer, the abnormal traffic obtained by classification is further identified to determine the attack technology type, attack path diagram and attack chain of the abnormal traffic, and the attack target, attack source and potential attack target are determined through the attack path diagram and attack chain. A more accurate defense strategy is provided for network security protection, attackers are identified in time and the propagation of attacks is effectively blocked. The network traffic data is further classified at the edge computing layer, and the attack technology type, attack path diagram and attack chain of the abnormal traffic are analyzed at the cloud computing layer. The layered processing mode improves the response speed to possible attack behaviors in the network traffic data, optimizes the use of bandwidth, and ensures efficient resource utilization.

[0085] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0086] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0087] Based on the same technical concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a road traffic network anomaly detection device, which is applied to a cloud-edge collaborative traffic network system, including: a device layer, an edge computing layer and a cloud computing layer.

[0088] refer to Figure 6 , the road traffic network anomaly detection device comprises: A collection module 701 is used to collect network traffic data using a device layer and send the network traffic data to the edge computing layer; The classification module 702 classifies the network traffic data using the anomaly detection model preset by the cloud computing layer downloaded by the edge computing layer, determines normal traffic and abnormal traffic, and sends the abnormal traffic to the cloud computing layer; Determination module 703, using the deep learning model preset in the cloud computing layer to identify the attack technology type of the abnormal traffic, and determine the attack path diagram according to the attack technology type; determine the attack chain using the attack path diagram, and determine the attack target and attack source according to the attack path diagram and the attack chain.

[0089] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0090] The device of the above embodiment is used to implement the corresponding road traffic network anomaly detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0091] Based on the same technical concept, corresponding to any of the above-mentioned embodiments, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the road traffic network anomaly detection method described in any of the above embodiments is implemented.

[0092] Figure 7A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0093] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0094] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0095] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0096] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0097] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0098] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0099] The electronic device of the above-mentioned embodiment is used to implement the corresponding road traffic network anomaly detection method in any of the above-mentioned embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0100] Based on the same technical concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the road traffic network anomaly detection method as described in any of the above embodiments.

[0101] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0102] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the road traffic network anomaly detection method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0103] Based on the same inventive concept, corresponding to the road traffic network anomaly detection method described in any of the above embodiments, the present disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer so that the computer and / or the processor execute the road traffic network anomaly detection method. Corresponding to the execution subject corresponding to each step in each embodiment of the road traffic network anomaly detection method, the processor that executes the corresponding step may belong to the corresponding execution subject.

[0104] The computer program product of the above embodiment is used to enable the computer and / or the processor to execute the road traffic network anomaly detection method as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0105] A person skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0106] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power / ground connections to the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device may be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present application are to be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or with changes in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0107] Although the present application has been described in conjunction with specific embodiments of the present application, many alternatives, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the discussed embodiments.

[0108] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A road traffic network anomaly detection method, characterized in that: Applied to a cloud-edge collaborative transportation network system, including: a device layer, an edge computing layer, and a cloud computing layer; the method includes: Using the device layer to collect network traffic data, and sending the network traffic data to the edge computing layer; The network traffic data is classified using the anomaly detection model downloaded by the edge computing layer to determine normal traffic and abnormal traffic, and the abnormal traffic is sent to the cloud computing layer; the anomaly detection model is preset in the cloud computing layer; The deep learning model preset in the cloud computing layer is used to identify the attack technology of the abnormal traffic, and an attack path diagram is determined according to the attack technology; the attack path diagram is used to determine the attack chain, and the attack target and attack source are determined according to the attack path diagram and the attack chain.

2. The method according to claim 1, characterized in that The anomaly detection model includes a plurality of decision trees; The utilizing the anomaly detection model downloaded by the edge computing layer to classify the network traffic data and determine normal traffic and abnormal traffic includes: Input the network traffic data one by one into each decision tree in sequence, each decision tree continuously splits the characteristic value of the network traffic data until the leaf node of the decision tree represents a classification result, and outputs the classification result of each decision tree; wherein different decision trees select different characteristic values ​​of the network traffic data; The classification results of the multiple decision trees are voted, and the network traffic data is divided into normal traffic and abnormal traffic according to the voting results.

3. The method according to claim 1, characterized in that The preset deep learning model includes: a convolutional neural network layer, a long short-term memory network layer and a fully connected output layer; Using the deep learning model preset in the cloud computing layer to identify the attack technology of the abnormal traffic includes: Determining attribute characteristics of the abnormal traffic using the convolutional neural network layer; Determine the time characteristics of the abnormal traffic by using the long short-term memory network layer, and establish the time dependency of the abnormal traffic; Concatenating the attribute features and the dependency relationship to form a first feature vector; The first feature vector is classified using the multiple fully connected output layers to determine the abnormal type of the first feature vector.

4. The method according to claim 1, characterized in that: Determining the attack path diagram according to the attack technology type includes: Determining a mapping table between the anomaly type and at least one attack technique; Determine the technical dependency relationship between the attack technologies according to the mapping table; Determine the time sequence of abnormal traffic corresponding to the attack technique according to the mapping table; The attack path graph is determined by taking the attack technology as a node and the technology dependency and the time sequence as directed edges.

5. The method according to claim 1, characterized in that Determining an attack chain using an attack path diagram, and determining an attack target and an attack source according to the attack path diagram and the attack chain, including: Traversing the attack path graph, determining the technical dependency relationship of each node in the attack path graph, and determining the attack behavior of the attack technology according to the technical dependency relationship; Determine the shortest attack path of the attack technology according to the directed edges; Using a community detection algorithm to identify each of the nodes in the attack path graph, and determine the jump paths between different attack techniques; Determine an attack target and an attack source according to the attack behavior and the shortest attack path; According to the jump path and the attack behavior, potential attack targets and potential attack sources are determined.

6. The method according to claim 1, characterized in that After the network traffic data is collected by using the device layer, it includes: Converting the network traffic data into a preset standardized format; Using Z-Score to standardize continuous numerical data in the network traffic data; One-hot encoding is used for discrete categorical variables in the network traffic data.

7. The method according to claim 5, characterized in that Also includes: In response to determining the abnormal traffic using the edge computing layer and determining the attack technique of the abnormal traffic using the cloud computing layer, sending warning information to the device layer, the warning information including the attack target, attack source, potential attack target and potential attack source, and the location of nodes in the attack path graph; Block the access connection of the attack source corresponding to the abnormal traffic in the device layer or disconnect the access connection of the attack technology corresponding to the abnormal traffic.

8. A road traffic network anomaly detection device, characterized in that: Applied to cloud-edge collaborative transportation network system, including: device layer, edge computing layer and cloud computing layer; The device comprises: A collection module, used to collect network traffic data using the device layer and send the network traffic data to the edge computing layer; A classification module, which classifies the network traffic data using the anomaly detection model preset by the cloud computing layer downloaded by the edge computing layer, determines normal traffic and abnormal traffic, and sends the abnormal traffic to the cloud computing layer; A determination module uses the deep learning model preset in the cloud computing layer to identify the attack technology type of the abnormal traffic, and determines the attack path diagram according to the attack technology type; determines the attack chain using the attack path diagram, and determines the attack target and attack source according to the attack path diagram and the attack chain.

9. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the computer program. 10 . A non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute the method according to claim 1 .

Images