Abnormal traffic management and control method and device, electronic equipment and storage medium

Abstract

The invention provides an abnormal traffic management and control method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of traffic processing. The management and control method comprises the following steps: on the basis of traffic characteristic data of network traffic, identifying abnormal traffic, an abnormal type of the abnormal traffic and a service type of the network traffic, the network traffic comprising the abnormal traffic and normal traffic; predicting a self-adaptive bandwidth occupation demand of the abnormal traffic based on the traffic feature data of the network traffic, the service type of the network traffic and the abnormal type of the abnormal traffic; and adjusting the current bandwidth occupation of the abnormal traffic based on the self-adaptive bandwidth occupation demand of the abnormal traffic so as to control the abnormal traffic. The invention aims to at least solve the problems that in the prior art, high-volatility network requirements cannot be fully met, flexible bandwidth optimization capability is lacked, and the aspect of refining flow management is still insufficient. The method is suitable for abnormal traffic identification and control scenes.

Description

Technical Field

[0001] The present invention relates to the field of traffic processing technology, and in particular to a method, device, electronic device and computer-readable storage medium for controlling abnormal traffic. Background Art

[0002] Current network bandwidth optimization and abnormal traffic management technologies are relatively mature and are widely used in data centers, enterprise networks, and Internet service providers to improve network performance and stability and ensure stable transmission of critical business traffic under different network loads and abnormal conditions.

[0003] Existing technologies mainly achieve stable transmission of business traffic through the following methods:

[0004] 1. The traffic control solution based on fixed bandwidth limit mainly classifies different traffic based on QoS (Quality of Service) strategy and sets fixed bandwidth quota to ensure the transmission stability of key traffic. In the case of abnormal traffic in the network, QoS strategy can implement traffic limit for low priority traffic.

[0005] 2. Dynamic adjustment scheme based on traffic anomaly detection and early warning, mainly combining the abnormal traffic detection and real-time early warning mechanism of the intrusion detection system (IDS) and bandwidth management system, monitoring network traffic in real time to identify abnormal traffic, triggering alarms when traffic fluctuations are abnormal, and taking temporary measures to prevent the spread of abnormal traffic.

[0006] 3. The intelligent traffic routing solution based on SD-WAN (software-defined networking in a wide area network) technology mainly uses the software defined network (SDN) controller to monitor network traffic and network load in real time, and dynamically adjust the traffic transmission path according to the priority of different traffic and the current network status. In the case of abnormal traffic, SD-WAN gives priority to the transmission of key business traffic and avoids high-load paths to reduce the impact of network congestion on key traffic.

[0007] However, traffic control solutions based on fixed bandwidth limits lack flexibility and are difficult to dynamically adjust in real time according to network traffic fluctuations. In particular, they have obvious limitations when dealing with sudden abnormal traffic or network congestion. Dynamic adjustment solutions based on traffic anomaly detection and early warning are limited by the accuracy of the detection system and the adaptability of bandwidth management. When faced with different types of abnormal traffic, it is often difficult to provide targeted optimization; especially when multiple traffic anomalies occur at the same time, the lack of refined traffic adjustment strategies will cause critical traffic to be affected. Traffic intelligent routing solutions based on SD-WAN technology lack refined control mechanisms when dealing with different types of abnormal traffic, and are unable to provide differentiated optimization measures, especially when faced with complex traffic types and changes in fluctuation intensity.

[0008] In summary, existing technologies cannot fully adapt to highly volatile network demands, lack flexible bandwidth optimization capabilities, and are still insufficient in terms of detailed traffic management. When faced with complex traffic types and changes in fluctuation intensity, they are unable to provide differentiated real-time optimization measures. Summary of the invention

[0009] The technical problem to be solved by the present invention is to address the above-mentioned deficiencies in the prior art and to provide a method, device, electronic device and computer-readable storage medium for controlling abnormal traffic. The method can achieve accurate and effective prediction of the bandwidth occupancy demand of abnormal traffic, thereby improving the flexibility and adaptability of the abnormal traffic optimization mechanism, and achieving refined and differentiated control of different types of abnormal traffic.

[0010] In a first aspect, the present invention provides a method for controlling abnormal traffic, comprising: based on traffic characteristic data of network traffic, identifying abnormal traffic and its abnormal type and business type of network traffic, wherein network traffic includes abnormal traffic and normal traffic; based on the traffic characteristic data of network traffic, the business type of network traffic and the abnormal type of abnormal traffic, predicting the adaptive bandwidth occupancy demand of abnormal traffic; based on the adaptive bandwidth occupancy demand of abnormal traffic, adjusting the current bandwidth occupancy of abnormal traffic to control abnormal traffic.

[0011] Preferably, the traffic characteristic data based on network traffic identifies abnormal traffic and its abnormal type and the business type of network traffic, specifically including: identifying abnormal traffic based on traffic characteristic data of network traffic, autoencoder and clustering algorithm; performing abnormal classification on abnormal traffic to obtain abnormal type of abnormal traffic, wherein the abnormal type includes DDoS attack traffic, overload traffic, deviation from normal traffic, scanning traffic and protocol abuse traffic; performing business classification on network traffic to obtain business type of network traffic.

[0012] Preferably, the traffic characteristic data, autoencoder and clustering algorithm based on network traffic are used to identify abnormal traffic, specifically including: based on the autoencoder, evaluating the traffic characteristic data of the network traffic to obtain the degree of deviation of the network traffic; based on the clustering algorithm, clustering analysis is performed on the traffic characteristic data of the network traffic to identify the traffic pattern of the network traffic, wherein the traffic pattern includes normal traffic pattern, peak traffic pattern, abnormal traffic pattern, periodic traffic pattern, burst traffic model, long-term traffic pattern and session traffic pattern; based on the degree of deviation and traffic pattern of the network traffic, abnormal traffic is identified.

[0013] Preferably, the traffic characteristic data includes the current bandwidth occupancy, and the traffic characteristic data of the network traffic, the service type of the network traffic and the abnormal type of the abnormal traffic are used to predict the adaptive bandwidth occupancy demand of the abnormal traffic, specifically including: determining the weight factor of the abnormal traffic based on the abnormal type of the abnormal traffic; calculating the traffic intensity threshold of the abnormal traffic based on the weight factor of the abnormal traffic; dividing the network traffic into critical business traffic and non-critical business traffic based on the service type of the network traffic, and calculating the current bandwidth occupancy of all critical business traffic; determining whether the abnormal traffic is critical business traffic; in response to the abnormal traffic being critical business traffic, predicting the adaptive bandwidth occupancy demand of the abnormal traffic based on the traffic characteristic data of the network traffic, the current bandwidth occupancy of all critical business traffic, the weight factor of the abnormal traffic and the traffic intensity threshold.

[0014] Preferably, the traffic characteristic data also includes the current traffic throughput, the maximum transmission capacity of the physical link and the maximum bandwidth capacity. The traffic characteristic data based on the network traffic, the current bandwidth occupancy of all key business traffic, the weight factor of the abnormal traffic and the traffic intensity threshold, predicts the adaptive bandwidth occupancy demand of the abnormal traffic, specifically including: calculating the actual utilization of the network traffic based on the current traffic throughput of the network traffic and the maximum transmission capacity of the physical link; calculating the load factor of the network traffic based on the actual utilization of the network traffic and the maximum bandwidth capacity; calculating the adaptive adjustment coefficient of the abnormal traffic based on the load factor of the network traffic, the current bandwidth occupancy of all key business traffic and the weight factor of the abnormal traffic and the traffic intensity threshold; calculating the adaptive bandwidth occupancy demand of the abnormal traffic based on the current broadband occupancy and the adaptive adjustment coefficient of the abnormal traffic.

[0015] Preferably, the method of calculating the adaptive adjustment coefficient of abnormal traffic based on the load factor of network traffic, the current bandwidth occupancy of all key business traffic, and the weight factor and traffic intensity threshold of abnormal traffic specifically includes: calculating the adaptive adjustment coefficient of abnormal traffic according to formula (1):

[0016]

[0017] Where, ΔB critical Indicates the adaptive adjustment coefficient of abnormal traffic, CritcalTrafficBandwidth indicates the current bandwidth usage of all critical business traffic, a traffic Indicates the weight factor of abnormal traffic, Traffic Limit indicates the traffic intensity threshold of abnormal traffic, and Network Load Factor indicates the load factor of network traffic.

[0018] Preferably, after determining whether the abnormal traffic is critical business traffic, the method for controlling the abnormal traffic also includes: calculating the total bandwidth occupancy of the network traffic and the current bandwidth occupancy of all non-critical business traffic; in response to the abnormal traffic being non-critical business traffic, predicting the adaptive bandwidth occupancy demand of the abnormal traffic based on the total bandwidth occupancy of the network traffic, the current bandwidth occupancy of all critical business traffic and all non-critical business traffic, and the weight factor and traffic intensity threshold of the abnormal traffic.

[0019] In a second aspect, the present invention also provides an abnormal traffic control device, including an identification module, a prediction module and an adjustment module. The identification module is used to identify abnormal traffic and its abnormal type and the business type of network traffic based on traffic characteristic data of network traffic, wherein the network traffic includes abnormal traffic and normal traffic. The prediction module is connected to the identification module and is used to predict the adaptive bandwidth occupancy demand of the abnormal traffic based on the traffic characteristic data of the network traffic, the abnormal type of the abnormal traffic and the business type of the network traffic. The adjustment module is connected to the determination module and is used to adjust the current bandwidth occupancy of the abnormal traffic based on the adaptive bandwidth occupancy demand of the abnormal traffic to control the abnormal traffic.

[0020] In a third aspect, the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the abnormal traffic control method provided in the first aspect above.

[0021] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the abnormal traffic control method provided in the first aspect is implemented.

[0022] The present invention provides a method, device, electronic device and computer-readable storage medium for controlling abnormal traffic. The abnormal traffic and its abnormal type, the service type and load condition of the network traffic can be accurately identified through the traffic characteristic data of the network traffic, and the abnormal traffic and its abnormal type, the service type and load condition of the network traffic are used as the prediction basis for the adaptive bandwidth occupation demand of the abnormal traffic, so as to achieve accurate and effective bandwidth occupation demand prediction of abnormal traffic of different types (including abnormal type and service type) and different load conditions, and then based on the adaptive bandwidth occupation demand of the abnormal traffic, the abnormal traffic is controlled in a refined and differentiated manner. Therefore, the present invention can achieve accurate and effective prediction of the bandwidth occupation demand of abnormal traffic, thereby improving the flexibility and adaptability of the abnormal traffic optimization mechanism, and achieving refined and differentiated control of different types of abnormal traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a flow chart of a method for controlling abnormal traffic according to Embodiment 1 of the present invention;

[0024] Figure 2 This is a schematic diagram of the structure of an abnormal traffic control system in Example 1 of the present invention;

[0025] Figure 3 This is a schematic diagram of the structure of an abnormal traffic control device according to Example 2 of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0027] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0028] It can be understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other.

[0029] It can be understood that, for the convenience of description, the drawings of the present invention only show the parts related to the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

[0030] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0031] It can be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0032] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0033] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0034] Embodiment 1:

[0035] like Figure 1 As shown, this embodiment provides a method for controlling abnormal traffic.

[0036] In this embodiment, the abnormal traffic control method is applied to the abnormal traffic control system, such as Figure 2 As shown, the abnormal traffic control system includes a data collection and preprocessing module 1, a dual-level abnormal traffic detection module 2, an abnormal parameter calculation module 3, a traffic classification module 4 and a bandwidth optimization module 5.

[0037] Abnormal traffic control methods include:

[0038] S101, based on traffic characteristic data of network traffic, identifying abnormal traffic and its abnormal type and business type of network traffic, wherein the network traffic includes abnormal traffic and normal traffic.

[0039] In this embodiment, abnormal traffic detection is performed on the traffic characteristic data of the network traffic through a dual-level abnormal traffic detection module, as shown in Table 1, so that potential problems in the network traffic (such as network congestion, packet loss, and attack) can be discovered in a timely manner, and normal and abnormal traffic and their business types and abnormal types of abnormal traffic can be identified.

[0040] Table 1 Abnormal flow detection of network flow characteristic data

[0041]

[0042] It should be noted that before the abnormal traffic detection is performed on the traffic characteristic data of the network traffic through the dual-level abnormal traffic detection module, the present embodiment also collects the network traffic data through the data collection and preprocessing module, and performs data preprocessing and feature extraction on the network traffic data to obtain the traffic characteristic data of the network traffic, wherein the data collection and preprocessing module includes but is not limited to: NetFlow, a traffic monitoring tool deployed on key nodes of core routers, switches, and data centers, and Wireshark, a signal analysis tool. Network traffic data includes but is not limited to: bandwidth occupancy, transmission rate, packet loss, delay, IP address, port number, packet size, traffic direction, timestamp, RTT (Round Trip Time). Networks include but are not limited to: communication networks, mobile networks, and Wi-Fi. Data preprocessing includes but is not limited to denoising and normalization. As shown in Table 1, traffic characteristic data includes but is not limited to traffic volume, request frequency, bandwidth usage, latency and packet loss rate, traffic fluctuation mode, protocol, and port.

[0043] After preprocessing the network traffic data to obtain traffic characteristic data of the network traffic, this embodiment also uses the distributed data storage platform Apache Kafka to store the network traffic data and the traffic characteristic data of the network traffic in real time.

[0044] Specifically, S101: based on the traffic characteristic data of the network traffic, identifying abnormal traffic and its abnormal type and the service type of the network traffic, including steps S1011 to S1013:

[0045] S1011, identifies abnormal traffic based on traffic feature data of network traffic, autoencoder and clustering algorithm.

[0046] Specifically, S1011: based on the traffic characteristic data of the network traffic, the autoencoder and the clustering algorithm, identifying abnormal traffic, including: based on the autoencoder, evaluating the traffic characteristic data of the network traffic to obtain the degree of deviation of the network traffic; based on the clustering algorithm, performing cluster analysis on the traffic characteristic data of the network traffic to identify the traffic pattern of the network traffic, wherein the traffic pattern includes a normal traffic pattern, a peak traffic pattern, an abnormal traffic pattern, a periodic traffic pattern, a burst traffic model, a long-term traffic pattern and a session traffic pattern; based on the degree of deviation of the network traffic and the traffic pattern, identifying abnormal traffic.

[0047] In this embodiment, based on the autoencoder, the traffic characteristic data of the network traffic is evaluated to obtain the degree of deviation of the network traffic, specifically including: ① Based on the loss function formula of the Autoencoder All traffic feature data points are reconstructed using Autoencoder to obtain the reconstruction error of each traffic feature data point. Among them, x is each traffic characteristic data point, is the output of Autoencoder reconstruction for each traffic feature data point, x1, x2, ..., x n are the characteristics of each dimension of the traffic feature data point x, is the corresponding feature output reconstructed by Autoencoder. ② According to the formula And the reconstruction error of all training flow feature data points, calculate the mean value μ of the reconstruction error of all training flow feature data points reconstruction , and then according to the formula Reconstruction Error(x i )-μ reconstruction , calculate the deviation degree of each traffic feature data point, where N represents the number of all training traffic feature data points, Reconstruction Error(x i ) represents the i-th training flow characteristic data point x i The reconstruction error.

[0048] Clustering algorithms include but are not limited to k-means algorithms. Taking the k-means algorithm as an example, based on the clustering algorithm, the traffic characteristic data of the network traffic is clustered and analyzed to identify the traffic pattern of the network traffic, specifically including: ① k clusters of the k-means algorithm, each cluster represents a traffic pattern, and the cluster center (center of mass) represents the typical traffic characteristic data of the traffic pattern. ② According to the formula d(x j ,μ i )=||x j -μ i ||, calculate each traffic characteristic data point x j With cluster center μ i The distance d(x j ,μ i ). ③According to each flow characteristic data point x j With cluster center μ i The distance d(x j ,μ i ), assign each traffic feature data point to the cluster closest to it, and calculate the mean of all traffic feature data points in each cluster as the new cluster center. ④ Repeat steps ② and ③ until the cluster center no longer changes or the predetermined number of iterations is reached.

[0049] Based on the deviation degree and traffic pattern of network traffic, abnormal traffic is identified, including: ① Based on the deviation degree and reconstruction error threshold E of each traffic feature data point threshold , to determine whether each traffic feature data point is abnormal. ② Since normal traffic tends to gather in clusters, abnormal traffic will appear at the edge of the cluster or far away from any cluster center. In other words, the clearer the traffic pattern of normal traffic, the more ambiguous the traffic pattern of abnormal traffic. Therefore, the traffic feature data point x j With cluster center μ i The farther the distance is, the more the traffic characteristic data point is an abnormal point. This embodiment sets a distance threshold, and determines whether the traffic characteristic data point is abnormal traffic based on the distance threshold and the distance between the traffic characteristic data point and the cluster center. ③ Combine the judgment results of steps ① and ② (abnormal label (yes / no)) to form the final abnormality identification result, specifically: if the traffic characteristic data point is marked as abnormal in both steps ① and ②, it can be determined that the traffic characteristic data point is abnormal traffic; if the traffic characteristic data point is marked as abnormal in steps ① or ②, the traffic characteristic data point will be listed as potential abnormal traffic for subsequent manual or further processing. This embodiment is based on Autoencoder and clustering algorithm to collaboratively identify abnormal traffic and improve the accuracy of abnormal traffic identification.

[0050] Based on the deviation degree of each flow characteristic data point and the reconstruction error threshold E threshold , determine whether each flow characteristic data point is abnormal, specifically including: determine whether the deviation degree of each flow characteristic data point is greater than the reconstruction error threshold E threshold ; If the deviation degree of each flow characteristic data point is greater than the reconstruction error threshold E threshold , that is, Reconstruction Error(x i )>E threshold , it is determined that the current traffic characteristic data point is abnormal traffic, and the current traffic characteristic data point will be marked as abnormal.

[0051] According to the distance threshold and the distance between the traffic feature data point and the cluster center, it is judged whether the traffic feature data point is abnormal traffic, specifically including: judging d(x j ,μ i ) is greater than μ distince +α·σ distince , where μ distince represents the average distance between all training traffic feature data points and the cluster center, σ distince represents the standard deviation of the distance between all training traffic feature data points and the cluster center, α represents the adjustment parameter, and α is 2; if d(x j ,μ i ) exceeds μdistince +α·σ distince , then we think x j It is abnormal traffic.

[0052] It should be noted that E threshold is the abnormal flow determination threshold set, which is used to determine whether a data point belongs to abnormal flow. threshold =μ reconstruction +β·σ reconstruction , calculate the reconstruction error threshold E threshold , where σ reconstruction represents the standard deviation of the reconstruction error of all training traffic feature data points, β represents the sensitivity adjustment coefficient, and the value of β is 2. β represents the looseness of the reconstruction error threshold. By adjusting β, the sensitivity of the reconstruction error threshold can be controlled. If β increases, the reconstruction error threshold will also increase, thereby reducing false positives (misjudging normal data as abnormal data). If β is small, the reconstruction error threshold is low, and more abnormal data will be captured.

[0053] S1012, classify the abnormal traffic to obtain abnormal types of the abnormal traffic, wherein the abnormal types include DDoS attack traffic, overload traffic, traffic deviating from normal traffic, scanning traffic, and protocol abuse traffic.

[0054] In this embodiment, after accurately determining the abnormal traffic, the traffic feature data of the abnormal traffic is clustered again through the k-means algorithm. After the clustering is completed, the cluster label of the traffic feature data of the abnormal traffic will be obtained. Similarly, the k clusters of the k-means algorithm represent k traffic patterns. The cluster label of the traffic feature data of the abnormal traffic can represent the abnormal type of the abnormal traffic. As shown in Table 2, different abnormal types (such as DDoS attacks, overloaded traffic, deviation from normal traffic, scanning traffic and protocol abuse traffic) have different characteristics.

[0055] Table 2 Characteristics of different anomaly types

[0056]

[0057]

[0058] It should be noted that after clustering is completed again, the abnormal type and severity of the abnormal traffic can also be determined by the distribution and size of the clusters. For example, DDoS attack traffic usually forms a very large cluster, while overload traffic is distributed in multiple clusters.

[0059] S1013, classify the network traffic to obtain the service type of the network traffic.

[0060] In this embodiment, the network traffic is classified by the traffic classification module to obtain the service type of the network traffic, where the service type includes but is not limited to real-time traffic (such as voice and video calls), file downloads, high-priority application traffic (such as financial transactions and telemedicine), network backup, applications with strict requirements on delay and bandwidth, and some delay-tolerant application traffic (such as bulk data transmission).

[0061] Specifically, the traffic characteristic data includes current bandwidth occupancy.

[0062] S102, predicting the adaptive bandwidth occupation demand of the abnormal traffic based on the traffic characteristic data of the network traffic, the service type of the network traffic and the abnormal type of the abnormal traffic.

[0063] Specifically, S102: predicting the adaptive bandwidth occupation demand of abnormal traffic based on traffic characteristic data of network traffic, service type of network traffic and abnormal type of abnormal traffic, including steps S1021-S1025:

[0064] S1021, determining a weight factor of the abnormal traffic based on the abnormal type of the abnormal traffic.

[0065] In this embodiment, according to the different impacts of each abnormality type on bandwidth (including severity, network congestion level, and attack scale), it is necessary to pre-set a weight factor corresponding to the abnormality type, for example: α Scan They represent the weight factors corresponding to DDoS attacks, overload traffic, and traffic that deviates from normal traffic. Therefore, through the abnormal parameter calculation module, the weight factor of abnormal traffic can be matched according to the abnormal type of abnormal traffic.

[0066] S1022: Calculate a traffic intensity threshold of the abnormal traffic based on the weight factor of the abnormal traffic.

[0067] In this embodiment, the traffic intensity threshold Traffic Limit is usually used as a proportional factor for dynamically adjusting bandwidth occupancy. It is mainly calculated based on the traffic intensity of the abnormal traffic. Its purpose is to ensure that when abnormal traffic occurs, the impact of the abnormal traffic on network performance can be controlled through reasonable bandwidth adjustment. Traffic intensity refers to the proportion of current traffic to total traffic at a certain moment. The higher the traffic intensity of the abnormal traffic, the smaller the traffic intensity threshold Traffic Limit should be, so as to avoid a large amount of abnormal traffic affecting the overall performance of the network. Different types of abnormal traffic have different Traffic Limits. For example, DDoS attack traffic will cause a sharp drop in network bandwidth. Therefore, the Traffic Limit of DDoS attack traffic should be set to a very small value, while the Traffic Limit that deviates from normal traffic should be relatively large. Through the abnormal parameter calculation module, it can also be calculated according to the formula Calculate the traffic intensity threshold Traffic Limit of abnormal traffic, where: Indicates the traffic intensity of abnormal traffic.

[0068] S1023, based on the service type of the network traffic, the network traffic is divided into critical service traffic and non-critical service traffic, and the current bandwidth occupancy of all critical service traffic is calculated.

[0069] In this embodiment, in general, critical business traffic usually refers to traffic that is critical to the normal operation of the system, while non-critical business traffic is relatively less sensitive traffic. Therefore, critical business types and non-critical business types can be pre-defined according to the nature of the traffic and service quality requirements, as shown in Table 3. Then, according to the pre-defined critical business types and non-critical business types and the business types of network traffic, the network traffic is divided into critical business traffic and non-critical business traffic. Network traffic includes abnormal traffic and normal traffic, and both abnormal traffic and normal traffic can be divided into critical business traffic and non-critical business traffic, that is, abnormal critical business traffic, abnormal non-critical business traffic, normal critical business traffic and normal non-critical business traffic. The current bandwidth occupancy of all critical business traffic is the sum of the current bandwidth occupancy of abnormal critical business traffic and normal critical business traffic. For example, the network traffic includes four types of traffic, namely, business A, B, C, and D. Business A and business B belong to critical business types, and business C and D belong to non-critical business types. The current bandwidth occupancy of all critical business traffic is the sum of the current bandwidth occupancy of business A and business B.

[0070] Table 3 Key business types and non-key business types

[0071]

[0072] S1024, determine whether the abnormal traffic is critical business traffic.

[0073] In this embodiment, according to Table 3 and the service type of the abnormal traffic, it can be determined whether the abnormal traffic is critical service traffic. If the service A traffic is abnormal traffic, then the abnormal traffic is determined to be critical service traffic.

[0074] S1025, in response to the abnormal traffic being critical business traffic, predicting the adaptive bandwidth occupancy demand of the abnormal traffic based on the traffic characteristic data of the network traffic, the current bandwidth occupancy of all critical business traffic, the weight factor of the abnormal traffic and the traffic intensity threshold.

[0075] Optionally, the traffic characteristic data also includes current traffic throughput, maximum transmission capability of the physical link, and maximum bandwidth capacity.

[0076] Specifically, based on the traffic characteristic data of the network traffic, the current bandwidth occupancy of all key business traffic, the weight factor of the abnormal traffic and the traffic intensity threshold, the adaptive bandwidth occupancy demand of the abnormal traffic is predicted, including: calculating the actual utilization of the network traffic based on the current traffic throughput of the network traffic and the maximum transmission capacity of the physical link; calculating the load factor of the network traffic based on the actual utilization of the network traffic and the maximum bandwidth capacity; calculating the adaptive adjustment coefficient of the abnormal traffic based on the load factor of the network traffic, the current bandwidth occupancy of all key business traffic and the weight factor of the abnormal traffic and the traffic intensity threshold; calculating the adaptive bandwidth occupancy demand of the abnormal traffic based on the current broadband occupancy of the abnormal traffic and the adaptive adjustment coefficient.

[0077] In this embodiment, the load factor is used to characterize the impact of the current network status on the bandwidth demand and reflects the current network load. If the current network load is high, more bandwidth is required to ensure critical traffic, so the load factor is high; if the current network load is low, the bandwidth adjustment range is small and the load factor is low. The higher the load factor, the more fully loaded the network is. If abnormal traffic occurs, it will have a greater impact on normal business traffic. Therefore, a higher bandwidth adjustment is required to ensure the transmission of critical business traffic. Therefore, based on the traffic characteristic data of network traffic, the current bandwidth occupancy of all critical business traffic, the weight factor of abnormal traffic and the traffic intensity threshold, the adaptive bandwidth occupancy demand of abnormal traffic is predicted, specifically including: ① Calculate the actual utilization rate and load factor of network traffic through the abnormal parameter calculation module, which can usually be calculated through the formula Calculation, where NetworkLoad Factor represents the load factor of network traffic, Current Network Utilization represents the actual utilization of network traffic, and Maximum Network capacity represents the maximum bandwidth capacity of network traffic.

[0078] Specifically, based on the load factor of the network traffic, the current bandwidth occupancy of all key business traffic, and the weight factor and traffic intensity threshold of the abnormal traffic, the adaptive adjustment coefficient of the abnormal traffic is calculated, including: according to formula (1), the adaptive adjustment coefficient of the abnormal traffic is calculated:

[0079]

[0080] Where, ΔB critical Indicates the adaptive adjustment coefficient of abnormal traffic, Critical Traffic Bandwidth indicates the current bandwidth occupancy of all critical business traffic, α traffic Indicates the weight factor of abnormal traffic, Traffic Limit indicates the traffic intensity threshold of abnormal traffic, and Network Load Factor indicates the load factor of network traffic.

[0081] In this embodiment, based on the traffic characteristic data of network traffic, the current bandwidth occupancy of all key business traffic, the weight factor of abnormal traffic and the traffic intensity threshold, the adaptive bandwidth occupancy demand of abnormal traffic is predicted, and the following is also included: ② According to formula (1), the adaptive adjustment coefficient ΔB of abnormal traffic is calculated critical ③ According to the formula Bandwidth ajuested =Current Traffic Bandwidth+ΔB critical , calculate the adaptive bandwidth occupation requirement Bandwidth of abnormal traffic ajuested , where Current Traffic Bandwidth indicates the current bandwidth occupied by abnormal traffic.

[0082] Optionally, after S1024: determining whether the abnormal traffic is critical service traffic, the abnormal traffic control method further includes:

[0083] S1026, calculating the total bandwidth occupancy of network traffic and the current bandwidth occupancy of all non-critical business traffic.

[0084] In this embodiment, similarly, the current bandwidth occupancy of all critical business traffic is the sum of the current bandwidth occupancy of abnormal critical business traffic and normal critical business traffic, and the current bandwidth occupancy of all non-critical business traffic is the sum of the current bandwidth occupancy of abnormal non-critical business traffic and normal non-critical business traffic.

[0085] S1027, in response to the abnormal traffic being non-critical business traffic, predicting the adaptive bandwidth occupancy demand of the abnormal traffic based on the total bandwidth occupancy of network traffic, the current bandwidth occupancy of all critical business traffic and all non-critical business traffic, and the traffic intensity threshold of the abnormal traffic.

[0086] In this embodiment, based on the total bandwidth occupancy of network traffic, the current bandwidth occupancy of all critical business traffic and all non-critical business traffic, and the traffic intensity threshold of abnormal traffic, the adaptive bandwidth occupancy demand of abnormal traffic is predicted, specifically including: according to the formula

[0087] Bandwidth adjusted =

[0088] min(Total Available Bandwidth, Critical Traffic Bandwidth + (Non-Critical Traffic Bandwidth × Traffic Limit)), calculates the adaptive bandwidth demand Bandwidth of abnormal traffic adjusted , where Total Available Bandwidth represents the total bandwidth occupancy of network traffic, Critical Traffic Bandwidth represents the current bandwidth occupancy of all critical business traffic, and Non-Critical Traffic Bandwidth represents the current bandwidth occupancy of all non-critical business traffic. This embodiment adopts different bandwidth calculation methods for abnormal traffic of critical business types and abnormal traffic of non-critical business types. For abnormal traffic of critical business types, the calculation of adaptive bandwidth occupancy demand is more refined and accurate, and for abnormal traffic of non-critical business types, the calculation efficiency is high, so as to achieve accurate and effective prediction of bandwidth occupancy demand of abnormal traffic, thereby improving the flexibility and adaptability of abnormal traffic optimization mechanism, and achieving refined and differentiated management and control of different types of abnormal traffic.

[0089] S103, based on the adaptive bandwidth occupation demand of the abnormal traffic, adjusting the current bandwidth occupation of the abnormal traffic to control the abnormal traffic.

[0090] In this embodiment, the bandwidth optimization module is used to adjust the current bandwidth occupation of the abnormal traffic to the adaptive bandwidth occupation requirement of the abnormal traffic, so as to control the abnormal traffic.

[0091] The present embodiment provides a method for controlling abnormal traffic, which can accurately identify abnormal traffic and its abnormal type, the service type and load condition of network traffic through traffic feature data of network traffic, and use abnormal traffic and its abnormal type, the service type and load condition of network traffic as the prediction basis for adaptive bandwidth occupation demand of abnormal traffic, so as to achieve accurate and effective bandwidth occupation demand prediction of abnormal traffic of different types (including abnormal type and service type) and different load conditions, and then control abnormal traffic in a refined and differentiated manner based on the adaptive bandwidth occupation demand of abnormal traffic. Therefore, the present invention can achieve accurate and effective prediction of bandwidth occupation demand of abnormal traffic, thereby improving the flexibility and adaptability of abnormal traffic optimization mechanism, and achieving refined and differentiated control of different types of abnormal traffic.

[0092] Embodiment 2:

[0093] like Figure 3 As shown, this embodiment provides an abnormal traffic control device, including an identification module 31, a prediction module 32 and an adjustment module 33. The identification module 31 is used to identify abnormal traffic and its abnormal type and the business type of the network traffic based on the traffic characteristic data of the network traffic, wherein the network traffic includes abnormal traffic and normal traffic. The prediction module 32 is connected to the identification module 31, and is used to predict the adaptive bandwidth occupancy demand of the abnormal traffic based on the traffic characteristic data of the network traffic, the abnormal type of the abnormal traffic and the business type of the network traffic. The adjustment module 33 is connected to the determination module 32, and is used to adjust the current bandwidth occupancy of the abnormal traffic based on the adaptive bandwidth occupancy demand of the abnormal traffic, so as to control the abnormal traffic.

[0094] Specifically, the identification module 31 includes: an identification unit 311, an abnormal classification unit 312 and a service classification unit 313. The identification unit 311 is used to identify abnormal traffic based on traffic feature data of the network traffic, an autoencoder and a clustering algorithm. The abnormal classification unit 312 is used to classify the abnormal traffic and obtain the abnormal type of the abnormal traffic, wherein the abnormal type includes DDoS attack traffic, overload traffic, deviation from normal traffic, scanning traffic and protocol abuse traffic. The service classification unit 313 is used to classify the network traffic and obtain the service type of the network traffic.

[0095] Specifically, the identification unit 311 includes: an evaluation subunit, a clustering subunit and an identification subunit. The evaluation subunit is used to evaluate the traffic characteristic data of the network traffic based on the autoencoder to obtain the degree of deviation of the network traffic. The clustering subunit is used to perform clustering analysis on the traffic characteristic data of the network traffic based on the clustering algorithm to identify the traffic pattern of the network traffic, wherein the traffic pattern includes a normal traffic pattern, a peak traffic pattern, an abnormal traffic pattern, a periodic traffic pattern, a burst traffic model, a long-term traffic pattern and a session traffic pattern. The identification subunit is used to identify abnormal traffic based on the degree of deviation and traffic pattern of the network traffic.

[0096] Specifically, the prediction module 32 includes: a determination unit 321, a first calculation unit 322, a division unit 323, a judgment unit 324 and a second calculation unit 325. The determination unit 321 is used to determine the weight factor of the abnormal traffic based on the abnormal type of the abnormal traffic. The first calculation unit 322 is used to calculate the traffic intensity threshold of the abnormal traffic based on the weight factor of the abnormal traffic. The division unit 323 is used to divide the network traffic into critical business traffic and non-critical business traffic based on the service type of the network traffic, and calculate the current bandwidth occupancy of all critical business traffic. The judgment unit 324 is used to judge whether the abnormal traffic is critical business traffic. The second calculation unit 324 is used to predict the adaptive bandwidth occupancy demand of the abnormal traffic based on the traffic characteristic data of the network traffic, the current bandwidth occupancy of all critical business traffic, the weight factor of the abnormal traffic and the traffic intensity threshold in response to the abnormal traffic being the critical business traffic.

[0097] Specifically, the second calculation unit 324 includes: a first calculation subunit, a second calculation subunit, a third calculation subunit and a fourth calculation subunit. The first calculation subunit is used to calculate the actual utilization of the network traffic based on the current traffic throughput of the network traffic and the maximum transmission capacity of the physical link. The second calculation subunit is used to calculate the load factor of the network traffic based on the actual utilization of the network traffic and the maximum bandwidth capacity. The third calculation subunit is used to calculate the adaptive adjustment coefficient of the abnormal traffic based on the load factor of the network traffic, the current bandwidth occupancy of all key business traffic, and the weight factor and traffic intensity threshold of the abnormal traffic. The fourth calculation subunit is used to calculate the adaptive bandwidth occupancy requirement of the abnormal traffic based on the current broadband occupancy of the abnormal traffic and the adaptive adjustment coefficient.

[0098] Specifically, the third calculation subunit includes: a first minimum calculation unit, which is used to calculate the adaptive adjustment coefficient of the abnormal flow according to formula (1):

[0099]

[0100] Where, ΔB criticalIndicates the adaptive adjustment coefficient of abnormal traffic, Critical Traffic Bandwidth indicates the current bandwidth occupancy of all critical business traffic, α traffic Indicates the weight factor of abnormal traffic, Traffic Limit indicates the traffic intensity threshold of abnormal traffic, and Network Load Factor indicates the load factor of network traffic.

[0101] Specifically, the prediction module 32 also includes: a third calculation unit 326 and a fourth calculation unit 327. The third calculation unit 326 is used to calculate the total bandwidth occupancy of the network traffic and the current bandwidth occupancy of all non-critical business traffic. The fourth calculation unit 327 is used to predict the adaptive bandwidth occupancy demand of the abnormal traffic based on the total bandwidth occupancy of the network traffic, the current bandwidth occupancy of all critical business traffic and all non-critical business traffic, and the weight factor and traffic intensity threshold of the abnormal traffic in response to the abnormal traffic being non-critical business traffic.

[0102] It can be understood that the abnormal traffic control device provided above executes the abnormal traffic control method corresponding to the embodiment 1 provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects of the scheme corresponding to the abnormal traffic control method of the embodiment 1 above, and will not be repeated here.

[0103] Embodiment 3:

[0104] This embodiment further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the abnormal traffic control method in the above-mentioned embodiment 1.

[0105] Embodiment 4:

[0106] This embodiment further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for controlling abnormal traffic in the above-mentioned embodiment 1 is implemented.

[0107] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for controlling abnormal traffic, characterized in that: include: Based on the traffic characteristic data of the network traffic, identifying abnormal traffic and its abnormal type and the business type of the network traffic, wherein the network traffic includes abnormal traffic and normal traffic; Based on the traffic characteristic data of network traffic, the service type of network traffic and the abnormal type of abnormal traffic, the adaptive bandwidth occupation demand of abnormal traffic is predicted; Based on the adaptive bandwidth occupation demand of abnormal traffic, adjust the current bandwidth occupation of abnormal traffic to control abnormal traffic.

2. The abnormal traffic control method according to claim 1, characterized in that: The traffic characteristic data based on the network traffic, identifying abnormal traffic and its abnormal type and the service type of the network traffic, specifically includes: Identify abnormal traffic based on network traffic feature data, autoencoders and clustering algorithms; Abnormal traffic is classified to obtain abnormal types of abnormal traffic, where the abnormal types include DDoS attack traffic, overload traffic, deviation from normal traffic, scanning traffic and protocol abuse traffic; The network traffic is classified into service types to obtain the service types of the network traffic.

3. The abnormal traffic control method according to claim 2, characterized in that: The traffic feature data, autoencoder and clustering algorithm based on network traffic are used to identify abnormal traffic, specifically including: Based on the autoencoder, the traffic characteristic data of the network traffic is evaluated to obtain the degree of deviation of the network traffic; Based on the clustering algorithm, the traffic characteristic data of the network traffic is clustered and analyzed to identify the traffic pattern of the network traffic, where the traffic pattern includes normal traffic pattern, peak traffic pattern, abnormal traffic pattern, periodic traffic pattern, burst traffic model, long-term traffic pattern and session traffic pattern; Identify abnormal traffic based on the degree of deviation and traffic pattern of network traffic.

4. The abnormal traffic control method according to claim 1, characterized in that: The traffic characteristic data includes current bandwidth occupancy, The predicting of the adaptive bandwidth occupation demand of abnormal traffic based on the traffic characteristic data of the network traffic, the service type of the network traffic and the abnormal type of the abnormal traffic specifically includes: Based on the abnormal type of the abnormal traffic, a weight factor of the abnormal traffic is determined; Based on the weight factor of the abnormal traffic, the traffic intensity threshold of the abnormal traffic is calculated; Based on the service type of network traffic, network traffic is divided into key service traffic and non-key service traffic, and the current bandwidth usage of all key service traffic is calculated; Determine whether abnormal traffic is critical business traffic; In response to the abnormal traffic being key business traffic, the adaptive bandwidth occupancy demand of the abnormal traffic is predicted based on traffic characteristic data of network traffic, current bandwidth occupancy of all key business traffic, weight factor of the abnormal traffic and traffic intensity threshold.

5. The abnormal traffic control method according to claim 4, characterized in that: The traffic characteristic data also includes the current traffic throughput, the maximum transmission capacity of the physical link and the maximum bandwidth capacity. The adaptive bandwidth occupancy requirement of abnormal traffic is predicted based on the traffic characteristic data of network traffic, the current bandwidth occupancy of all key business traffic, the weight factor of abnormal traffic and the traffic intensity threshold, specifically including: Calculate the actual utilization of network traffic based on the current traffic throughput of the network traffic and the maximum transmission capacity of the physical link; Calculate the load factor of network traffic based on the actual utilization of network traffic and the maximum bandwidth capacity; Calculate the adaptive adjustment coefficient of abnormal traffic based on the load factor of network traffic, the current bandwidth occupancy of all key business traffic, the weight factor of abnormal traffic, and the traffic intensity threshold; Based on the current bandwidth occupancy of the abnormal traffic and the adaptive adjustment coefficient, the adaptive bandwidth occupancy requirement of the abnormal traffic is calculated.

6. The abnormal traffic control method according to claim 5, characterized in that: The calculation of the adaptive adjustment coefficient of abnormal traffic based on the load factor of network traffic, the current bandwidth occupancy of all key business traffic, the weight factor of abnormal traffic and the traffic intensity threshold specifically includes: According to formula (1), the adaptive adjustment coefficient of abnormal flow is calculated: Among them, ΔB critical Indicates the adaptive adjustment coefficient of abnormal traffic, CriticalTrafficBandwidth indicates the current bandwidth occupancy of all critical business traffic, α traffic It indicates the weight factor of abnormal traffic, TrafficLimit indicates the traffic intensity threshold of abnormal traffic, and Network Load Factor indicates the load factor of network traffic.

7. The abnormal traffic control method according to claim 4, characterized in that: After determining whether the abnormal traffic is critical service traffic, the method further includes: Calculate the total bandwidth usage of network traffic and the current bandwidth usage of all non-critical business traffic; In response to the abnormal traffic being non-critical business traffic, the adaptive bandwidth occupancy demand of the abnormal traffic is predicted based on the total bandwidth occupancy of network traffic, the current bandwidth occupancy of all critical business traffic and all non-critical business traffic, and the weight factor and traffic intensity threshold of the abnormal traffic.

8. An abnormal flow control device, characterized in that: Including identification module, prediction module and adjustment module, The identification module is used to identify abnormal traffic and its abnormal type and the business type of network traffic based on the traffic characteristic data of the network traffic, wherein the network traffic includes abnormal traffic and normal traffic, The prediction module is connected to the identification module and is used to predict the adaptive bandwidth occupation demand of abnormal traffic based on the traffic characteristic data of the network traffic, the abnormal type of the abnormal traffic and the business type of the network traffic. The adjustment module is connected to the determination module and is used to adjust the current bandwidth occupation of the abnormal traffic based on the adaptive bandwidth occupation demand of the abnormal traffic to control the abnormal traffic.

9. An electronic device, characterized in that: It includes a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement a method for controlling abnormal traffic as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, an abnormal traffic control method as described in any one of claims 1 to 7 is implemented.

Images