Traffic analysis method and device, storage medium and program product

Abstract

The invention provides a traffic analysis method and device, a storage medium and a program product, and relates to the field of network security, the method comprises the following steps: obtaining a network topology structure in a preset time period, the network topology structure being generated based on network traffic data in the preset time period; the network topology structure is used for reflecting the flow interaction condition among the network nodes in a preset time period; based on the network topology structure, determining a target network node with a traffic abnormal condition; and analyzing the traffic data of the target network node. The method can be used in the process of monitoring the network traffic, the topological structure can be extracted based on the traffic data, and the topological structure can visually reflect the traffic condition between the nodes, so that the traffic analysis can be performed in a targeted manner, and the consumption of software and hardware resources is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a traffic analysis method, device, storage medium and program product. Background Art

[0002] In the current network environment, the network structure and connection methods are complicated, and various types of network devices emerge in an endless stream, which leads to an increase in the amount of data. Therefore, the difficulty of traffic data analysis in existing technologies lies in the large amount of data and the difficulty in meeting the computing requirements, which requires strong storage capacity and high computing power software and hardware support. Summary of the invention

[0003] The present application provides a traffic analysis method, device, storage medium and program product, which can perform targeted traffic analysis and reduce the consumption of software and hardware resources.

[0004] In a first aspect, the present application provides a traffic analysis method, comprising: obtaining a network topology structure within a preset time period, the network topology structure being generated based on network traffic data within the preset time period; the network topology structure being used to reflect the traffic interaction between each network node within the preset time period; based on the network topology structure, determining a target network node with abnormal traffic; and analyzing the traffic data of the target network node.

[0005] In the traffic analysis method provided by the present application, the network topology structure generated based on the network traffic data within a preset time period can not only mark each network node in the network environment and the connection between the network nodes, but more importantly, it can intuitively reflect the traffic conditions between the network nodes. Therefore, the present application can accurately determine the target network nodes with abnormal traffic conditions based on the network topology structure, and perform targeted traffic analysis on the target network nodes, thereby reducing the amount of data analysis and having lower requirements on the storage capacity and computing power of software and hardware. Therefore, the traffic analysis process of the present application reduces the consumption of software and hardware resources compared to the prior art.

[0006] In a possible implementation method, the traffic interaction situation includes at least one of the following: the connection between network nodes, data flow direction, traffic probability, traffic risk expectation value, traffic protocol type, traffic transmitted based on each type of protocol, and alarm weight of each type of protocol; wherein the traffic risk expectation value is used to reflect the probability of alarm traffic appearing in the traffic between network nodes; the alarm weight of each type of protocol is used to reflect the probability of alarm traffic appearing in the traffic transmitted based on each type of protocol.

[0007] In another possible implementation, the network topology structure includes a first network node and a second network node that are connected, wherein traffic flows from the first network node to the second network node; then the expected value of the traffic risk between the first network node and the second network node is determined based on the following parameters: the sum of the traffic between other network nodes connected to the first network node and the first network node, the protocol type between the first network node and the second network node, the traffic transmitted between the first network node and the second network node based on each type of protocol, and the alarm weight of each type of protocol between the first network node and the second network node.

[0008] In another possible implementation, the expected value of traffic risk satisfies the following formula:

[0009]

[0010] Among them, P ij represents the expected value of the traffic risk from the first network node i to the second network node j; represents the total traffic between other network nodes k connected to the first network node i and the first network node i; w ik represents the traffic volume between other network nodes k connected to the first network node i; p s A represents the size of the traffic transmitted between the first network node i and the second network node j based on the s-type protocol; s represents the alarm weight of the s-type protocol between the first network node i and the second network node j; m represents the number of protocol types between the first network node i and the second network node j; and n represents the number of all network nodes connected to the first network node i.

[0011] In another possible implementation, the alarm weight of each type of protocol is determined based on at least one of the following: a traffic pattern of traffic transmitted by each type of protocol; wherein the traffic pattern includes normal traffic and attack traffic; and attack protection parameters configured in the security device node for traffic of each type of protocol.

[0012] In another possible implementation, the abnormal traffic situation includes at least one of the following: the traffic probability between network nodes is greater than a first threshold; the expected value of the traffic risk between network nodes is greater than a second threshold.

[0013] In another possible implementation, the target network node includes a first target network node and a second target network node that are connected; the traffic data of the target network node includes the traffic transmitted between the first target network node and the second target network node based on each type of protocol; the traffic data of the target network node is analyzed, including: performing anomaly detection on the traffic transmitted between the first target network node and the second target network node based on each type of protocol to obtain anomaly detection results.

[0014] In another possible implementation, the type of traffic protocol between the first target network node and the second target network node includes a target protocol type; the above method also includes: when the anomaly detection result indicates that there is abnormal traffic and / or attack behavior in the traffic based on the target protocol type between the first target network node and the second target network node, issuing an abnormal alarm information; the alarm information is used to indicate that there is an abnormality in the traffic based on the target protocol type between the first target network node and the second target network node.

[0015] In another possible implementation, the method further includes: sending a decision request message to a decision system based on the anomaly detection result, wherein the decision request message is used to instruct the decision system to determine a security protection strategy based on the anomaly detection result, and send the security protection strategy to the security device node, so that the security device node performs security protection based on the security protection strategy.

[0016] In another possible implementation, the type of traffic protocol between the first target network node and the second target network node includes a first protocol type and a second protocol type; when the anomaly detection result includes the anomaly detection result of the first protocol type and the anomaly detection result of the second protocol type, the security protection strategy includes the security protection strategy of the first protocol type and the security protection strategy of the second protocol type; wherein the execution priority of the security protection strategy of the first protocol type and the security protection strategy of the second protocol type is determined based on the alarm weights of the first protocol type and the second protocol type, and the alarm weight of each type of protocol is used to reflect the probability of alarm traffic appearing in the traffic transmitted based on each type of protocol; the anomaly detection result of the first protocol type is the anomaly detection result of the traffic transmitted between the first target network node and the second target network node based on the first protocol type; the anomaly detection result of the second protocol type is the anomaly detection result of the traffic transmitted between the first target network node and the second target network node based on the second protocol type.

[0017] In the second aspect, the present application provides a traffic analysis device for application in the field of network security, the device comprising: an acquisition module and a processing module; the acquisition module is used to acquire the network topology structure within a preset time period, the network topology structure is generated based on the network traffic data within the preset time period; the network topology structure is used to reflect the traffic interaction between each network node within the preset time period; the processing module is used to determine the target network node with abnormal traffic based on the network topology structure; and analyze the traffic data of the target network node.

[0018] In a possible implementation method, the traffic interaction situation includes at least one of the following: the connection between network nodes, data flow direction, traffic probability, traffic risk expectation value, traffic protocol type, traffic transmitted based on each type of protocol, and alarm weight of each type of protocol; wherein the traffic risk expectation value is used to reflect the probability of alarm traffic appearing in the traffic between network nodes; the alarm weight of each type of protocol is used to reflect the probability of alarm traffic appearing in the traffic transmitted based on each type of protocol.

[0019] In another possible implementation, the network topology structure includes a first network node and a second network node that are connected, wherein traffic flows from the first network node to the second network node; then the expected value of the traffic risk between the first network node and the second network node is determined based on the following parameters: the sum of the traffic between other network nodes connected to the first network node and the first network node, the protocol type between the first network node and the second network node, the traffic transmitted between the first network node and the second network node based on each type of protocol, and the alarm weight of each type of protocol between the first network node and the second network node.

[0020] In another possible implementation, the expected value of traffic risk satisfies the following formula:

[0021]

[0022] Among them, P ij represents the expected value of the traffic risk from the first network node i to the second network node j; represents the total traffic between other network nodes k connected to the first network node i and the first network node i; w ik represents the traffic volume between other network nodes k connected to the first network node i; p s A represents the size of the traffic transmitted between the first network node i and the second network node j based on the s-type protocol; s represents the alarm weight of the s-type protocol between the first network node i and the second network node j; m represents the number of protocol types between the first network node i and the second network node j; and n represents the number of all network nodes connected to the first network node i.

[0023] In another possible implementation, the alarm weight of each type of protocol is determined based on at least one of the following: a traffic pattern of traffic transmitted by each type of protocol; wherein the traffic pattern includes normal traffic and attack traffic; and attack protection parameters configured in the security device node for traffic of each type of protocol.

[0024] In another possible implementation, the abnormal traffic situation includes at least one of the following: the traffic probability between network nodes is greater than a first threshold; the expected value of the traffic risk between network nodes is greater than a second threshold.

[0025] In another possible implementation, the target network node includes a first target network node and a second target network node that are connected; the traffic data of the target network node includes the traffic transmitted between the first target network node and the second target network node based on each type of protocol; and the processing module is specifically used to analyze the traffic data of the target network node, including: performing anomaly detection on the traffic transmitted between the first target network node and the second target network node based on each type of protocol to obtain anomaly detection results.

[0026] In another possible implementation, the type of traffic protocol between the first target network node and the second target network node includes a target protocol type; the processing module is also used to: issue an abnormal alarm message when the anomaly detection result indicates abnormal traffic and / or attack behavior in the traffic based on the target protocol type between the first target network node and the second target network node; the alarm message is used to indicate the presence of an abnormality in the traffic based on the target protocol type between the first target network node and the second target network node.

[0027] In another possible implementation, the processing module is also used to: send a decision request message to the decision system based on the anomaly detection result, the decision request message is used to instruct the decision system to determine a security protection strategy based on the anomaly detection result, and send the security protection strategy to the security device node, so that the security device node performs security protection based on the security protection strategy.

[0028] In another possible implementation, the type of traffic protocol between the first target network node and the second target network node includes a first protocol type and a second protocol type; when the anomaly detection result includes the anomaly detection result of the first protocol type and the anomaly detection result of the second protocol type, the security protection strategy includes the security protection strategy of the first protocol type and the security protection strategy of the second protocol type; wherein the execution priority of the security protection strategy of the first protocol type and the security protection strategy of the second protocol type is determined based on the alarm weights of the first protocol type and the second protocol type, and the alarm weight of each type of protocol is used to reflect the probability of alarm traffic appearing in the traffic transmitted based on each type of protocol; the anomaly detection result of the first protocol type is the anomaly detection result of the traffic transmitted between the first target network node and the second target network node based on the first protocol type; the anomaly detection result of the second protocol type is the anomaly detection result of the traffic transmitted between the first target network node and the second target network node based on the second protocol type.

[0029] In a third aspect, the present application provides an electronic device, comprising: a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the electronic device implements the method of the first aspect above.

[0030] In a fourth aspect, the present application provides a chip system, which is applied to a flow analysis device; the chip system includes one or more interface circuits and one or more processors. The interface circuit and the processor are interconnected through a line; the interface circuit is used to receive a signal from a memory of the flow analysis device and send a signal to the processor, the signal including a computer instruction stored in the memory. When the processor executes the computer instruction, the electronic device executes the method of the first aspect above.

[0031] In a fifth aspect, the present application provides a readable storage medium, which includes: software instructions; when the software instructions are executed in an electronic device, the electronic device implements the method of the first aspect above.

[0032] In a sixth aspect, the present application provides a computer program product, which, when executed on an electronic device, enables the electronic device to execute the steps of the related method described in the first aspect to implement the method of the first aspect. The beneficial effects of the second to fifth aspects are described in the corresponding description of the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A schematic diagram of a system architecture provided for this application;

[0034] Figure 2 A flow chart of a flow analysis method provided in this application;

[0035] Figure 3 A schematic diagram of a network topology structure provided for this application;

[0036] Figure 4 A flow chart of another flow analysis method provided by this application;

[0037] Figure 5 A flow chart of another flow analysis method provided by the present application;

[0038] Figure 6 A schematic diagram of the composition of a flow analysis device provided in this application;

[0039] Figure 7 A schematic diagram of the composition of an electronic device provided in this application. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] It should be noted that, in the embodiments of the present application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a specific way.

[0042] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0043] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second", etc. are used to distinguish the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first", "second", etc. are not limiting the quantity and execution order.

[0044] In the current network environment, the network structure and connection methods are complex (a switch connects to an Internet Protocol Address (IP) network, and multiple IP networks are connected by routing, and devices are connected using cables or WIFI, etc.), and various types of network devices (such as switches, firewalls, gateways, business servers, and IoT devices, etc.) are emerging in an endless stream, and with it comes an increase in the amount of data.

[0045] The increase in data volume brings many difficulties to the analysis of traffic data. For example, how to use traffic data to accurately extract the topological structure has become a difficulty in traffic applications. For example, when the existing technology performs traffic analysis, the amount of data that needs to be calculated is large, and it requires strong storage capacity, high computing power, and hardware and software support, which has high requirements for software and hardware resources.

[0046] In response to the above-mentioned technical problems, an embodiment of the present application provides a traffic analysis method, in which a network topology structure generated based on network traffic data within a preset time period can not only mark each network node in the network environment and the connection between network nodes, but more importantly, can intuitively reflect the traffic conditions between network nodes. Therefore, the present application can accurately determine the target network nodes with abnormal traffic conditions based on the network topology structure, and perform targeted traffic analysis on the target network nodes, thereby reducing the amount of data analysis and having lower requirements on the storage capacity and computing power of software and hardware. Therefore, the traffic analysis process of the present application reduces the consumption of software and hardware resources compared to the prior art.

[0047] Below, the technical solution provided by the embodiments of the present application is described in conjunction with the drawings in the specification.

[0048] See also Figure 1 , is a schematic diagram of the system architecture involved in the traffic analysis method provided in the embodiment of the present application. Figure 1 As shown, the system architecture involved in the traffic analysis method provided in the embodiment of the present application includes: a user device 100, a security device node 200-1, a security device node 200-2, a traffic analysis node 300, a decision node 400, a monitoring center 500 and a management platform 600.

[0049] Among them, the user equipment 100 is connected to the security device node 200-1 and the security device node 200-2 respectively; the traffic analysis node 300 is connected to the security device node 200-1 and the security device node 200-2 respectively; the decision node 400 is connected to the security device node 200-1 and the security device node 200-2 respectively; the traffic analysis node 300 is connected to the decision node 400; the traffic analysis node 300 is connected to the monitoring center 500; the monitoring center 500 is connected to the management platform 600.

[0050] Exemplarily, the user device 100 may be a router, a switch, a mobile phone, a tablet computer, a wearable device, an in-vehicle device, an augmented reality (AR) / virtual reality (VR) device, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiment of the present application does not limit the specific device form of the user device 100.

[0051] The security device node 200 - 1 and the security device node 200 - 2 are used to implement security protection measures to ensure network security.

[0052] In some embodiments, the security device node 200 - 1 and the security device node 200 - 2 may detect traffic data of the user device 100 and send the data to the traffic analysis node 300 .

[0053] In some embodiments, a security device node may refer to a security protection architecture design organized at the network, host, and application layers, including firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), anti-virus software, security information and event management (SIEM) devices, etc. The embodiments of the present application do not limit the specific device form of the security device node.

[0054] The traffic analysis node 300 is used to receive the traffic data of the user device 100 sent by the security device node 200-1 and the security device node 200-2; identify and analyze the received data, calculate the traffic probability and traffic risk expectation between the user devices, and draw the network topology structure; and is also used to analyze traffic anomalies in a targeted manner, send the analysis results to the decision node 400, and generate a traffic report and send it to the monitoring center 500.

[0055] Exemplarily, the traffic analysis node 300 may be a server or electronic device in a network; or, the traffic analysis node 300 may be a software module or application in a server or electronic device, for example, a software module application with a data analysis function. The present application does not limit the form of the traffic analysis node 300.

[0056] The decision node 400 is used to receive the analysis results sent by the traffic analysis node 300; it is also used to determine the security protection strategy based on the analysis results, and send the security protection strategy to the security device node 200-1 and the security device node 200-2, so that the security device node 200-1 and the security device node 200-2 perform security protection based on the security protection strategy.

[0057] Exemplarily, the decision node 400 may be a server or electronic device in a network; or, the traffic analysis node 300 may be a software module or application in a server or electronic device, for example, a software module application with a decision-making function. The present application does not limit the form of the decision node 400.

[0058] The monitoring center 500 is used to receive the traffic report generated by the traffic analysis node 300 and issue abnormal alarm information based on abnormal analysis results in the report.

[0059] The management platform 600 is used to receive abnormal alarm information transmitted by the monitoring center 500 and is used by the administrator to uniformly manage the alarm information.

[0060] It should be noted that the system architecture described in the embodiments of the present application is for more clearly illustrating the technical solutions of the embodiments of the present application, and does not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can know that with the evolution of the system architecture, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0061] See also Figure 2 , is a flow chart of a flow analysis method provided in an embodiment of the present application. The flow analysis method provided in the present application can be applied to Figure 1 The traffic analysis node 300 is shown. Figure 2 As shown, the method specifically comprises the following steps:

[0062] S101. Acquire a network topology structure within a preset time period.

[0063] Among them, the network topology structure is generated based on the network traffic data within a preset time period; the network topology structure is used to reflect the traffic interaction between various network nodes within the preset time period.

[0064] In some embodiments, the above step S101 can be implemented as the following steps S1011-S1012.

[0065] S1011. Obtain network traffic data within a preset time period.

[0066] In some embodiments, network traffic data within a preset time period is acquired by combining active probing and passive probing.

[0067] For example, active detection can be implemented by encapsulating the Packet Capture Library (libpcap), which is a network packet capture library under the operating system platform. Libpcap is a user-layer traffic packet capture API interface independent of the system, providing a portable framework for underlying network monitoring. Libpcap allows users to send, scan, parse and forge networks. This capability allows the construction of tools that can detect, scan or attack networks.

[0068] For example, passive probing can obtain information covertly and can be monitored through the device mirror port without affecting the existing network. Passive probing can "quietly" monitor network activities for a long time.

[0069] S1012: Generate a network topology structure based on network traffic data within a preset time period.

[0070] In some embodiments, network traffic data within a preset time period is analyzed to obtain attribute information of network nodes and traffic interaction between network nodes; and then a network topology structure is generated based on the attribute information of network nodes and traffic interaction between network nodes.

[0071] Exemplarily, the above-mentioned network traffic data is uploaded to the data analysis software, and the data analysis software uses the traffic feature detection method (that is, clearly identifying the traffic features that need to be paid attention to, such as data source, data flow direction, traffic probability, traffic risk expectation value and other features, and then calculating or detecting the traffic features that need to be paid attention to) to perform analysis and obtain the attribute information of the network nodes and the traffic interaction status of the network nodes.

[0072] In some embodiments, the attribute information of the network node includes at least one of the following: operating system type, port number, subnet host media access control (MAC) address, IP address, subnet mask, gateway, service type and access control list (ACL), etc.

[0073] Exemplarily, based on the analyzed operating system type, port number, MAC address, IP address, subnet mask, gateway, service type, ACL and other attribute information, the basic network topology of the probed intranet, that is, the distribution of network devices in the probed intranet, is drawn. Based on the routing information in the routing device, the switch information connected to the router can be obtained, and the host information connected to the switch can be obtained through the virtual local area network (VLAN) configuration on the switch. The basic network topology across switches can be obtained through jump machine detection.

[0074] In some embodiments, the traffic interaction situation of network nodes includes at least one of the following: the connection between network nodes, data flow direction, traffic probability, traffic risk expectation value, traffic protocol type, traffic transmitted based on each type of protocol, and alarm weight of each type of protocol; wherein, the traffic risk expectation value is used to reflect the probability of alarm traffic appearing in the traffic between network nodes; the alarm weight of each type of protocol is used to reflect the probability of alarm traffic appearing in the traffic transmitted based on each type of protocol.

[0075] In some embodiments, the network topology structure includes a first network node and a second network node that are connected, wherein traffic flows from the first network node to the second network node; then the traffic probability between the first network node and the second network node is determined based on the following parameters: the traffic size between the first network node and the second network node, and the sum of the traffic between other network nodes connected to the first network node (the other network nodes here refer to all network nodes other than the first network node and connected to the first network node) and the first network node.

[0076] Exemplarily, the traffic probability between the first network node and the second network node is determined by a ratio of the traffic size between the first network node and the second network node to the total traffic between other network nodes connected to the first network node and the first network node.

[0077] In some embodiments, the protocol type of the traffic between network nodes includes at least one of the following: HyperText Transfer Protocol (HTTP)-like protocols, Domain Name System (DNS)-like protocols, and MySQL-like protocols. Among them, DNS-like protocols refer to protocols involved in the DNS query and response process, such as User Datagram Protocol (UDP) protocol and Transmission Control Protocol (TCP) protocol; MySQL-like protocols refer to protocols involved in the Structured Query Language (SQL) query process, such as TCP / IP protocol.

[0078] In some embodiments, the alarm weight of each type of protocol between network nodes is determined based on at least one of the following: a traffic pattern based on traffic transmitted by each type of protocol; and an attack protection parameter configured in a security device node for traffic of each type of protocol. The traffic pattern includes normal traffic and attack traffic.

[0079] For example, when the traffic between network nodes is normal traffic, the strategy is mainly based on conventional traffic monitoring, and the alarm weight of each type of protocol is low; when the traffic between network nodes includes attack traffic, the alarm weight of the corresponding type of protocol will increase. For example, for HTTP traffic, common attacks such as SQL injection and cross-site scripting (XSS) will increase the alarm weight of the HTTP protocol; for DNS traffic, DNS amplification attacks may increase the alarm weight of the DNS protocol; for MySQL or database protocols, slow queries, brute force attacks, etc. will increase the alarm weight of the MySQL protocol.

[0080] In some embodiments, the network topology structure includes a first network node and a second network node that are connected, wherein traffic flows from the first network node to the second network node; then the expected value of the traffic risk between the first network node and the second network node is determined based on the following parameters: the sum of the traffic between other network nodes connected to the first network node and the first network node, the protocol type between the first network node and the second network node, the traffic transmitted between the first network node and the second network node based on each type of protocol, and the alarm weight of each type of protocol between the first network node and the second network node.

[0081] Exemplarily, the expected value of traffic risk satisfies the following formula (1):

[0082]

[0083] Among them, P ij represents the expected value of the traffic risk from the first network node i to the second network node j; represents the total traffic between other network nodes k connected to the first network node i and the first network node i; w ik represents the traffic volume between other network nodes k connected to the first network node i; p s A represents the size of the traffic transmitted between the first network node i and the second network node j based on the s-type protocol; s represents the alarm weight of the s-type protocol between the first network node i and the second network node j; m represents the number of protocol types between the first network node i and the second network node j; and n represents the number of all network nodes connected to the first network node i.

[0084] For example, network node a is connected to network node b, and network node a is connected to network node c. The total actual traffic of a and b is 8GB. Assume that there are two types of protocol traffic, HTTP and DNS, of which the HTTP protocol traffic size is 5GB and the DNS protocol traffic size is 3GB. The weight of HTTP protocol in the alarm is 0.9 and the weight of DNS protocol is 0.1. The total actual traffic of a and c is 9GB. Assume that there are two types of protocol traffic, HTTP and DNS, of which the HTTP protocol traffic size is 2GB and the DNS protocol traffic size is 7GB. The weight of HTTP protocol in the alarm is 0.9 and the weight of DNS protocol is 0.1. Then the expected risk of a and b traffic is: (5*0.9+3*0.1) / (8+9)=0.28235, and the expected risk of a and c traffic is: (2*0.9+7*0.1) / (8+9)=0.14706.

[0085] For example, the network topology structure generated in the preset time period may be as follows: Figure 3The form shown. Figure 3 It can be seen that network node 1 is connected to network node 2, and the data flow direction is from network node 1 to network node 2; network node 1 is connected to network node 3, and the data flow direction is from network node 1 to network node 3; network node 1 is connected to network node 4, and the data flow direction is from network node 4 to network node 1. In addition, the figure shows the interaction between each network node and other network nodes: total traffic, traffic probability, traffic risk expectation, traffic protocol type, traffic transmitted based on each type of protocol, and alarm weight of each type of protocol. For example, the total traffic from network node 1 to network node 3 is 5GB, the traffic probability is 30%, the traffic risk expectation is 0.28, the traffic protocol type is HTTP\MySQL, the traffic of HTTP protocols is 3GB, and the traffic of MySQL protocols is 2GB; the alarm weight of HTTP protocols is 0.2, and the alarm weight of MySQL protocols is 0.4.

[0086] S102: Based on the network topology, determine the target network node with abnormal traffic.

[0087] In some embodiments, the abnormal traffic situation includes at least one of the following: the traffic probability between network nodes is greater than a first threshold; the expected value of the traffic risk between network nodes is greater than a second threshold.

[0088] Exemplarily, the traffic probability between network nodes being greater than the first threshold includes a variety of situations, for example, the current period is a time period when users are active, resulting in an increase in the traffic probability between network nodes; or, encountering special events (such as live broadcasts, sports events, concerts, etc.), resulting in a large number of users accessing a website or application at the same time, thereby causing a sharp increase in the traffic probability between network nodes related to the website or application.

[0089] Exemplarily, the expected value of traffic risk between network nodes being greater than the second threshold includes a variety of situations, for example, network attacks such as hacker attacks and distributed denial of service (DDoS) attacks will cause an abnormal increase in alarm traffic between network nodes, thereby causing an abnormal increase in the expected value of traffic risk; or, technical problems such as improper server configuration, insufficient bandwidth, and cache failure will also cause a surge in alarm traffic between network nodes, thereby causing an abnormal increase in the expected value of traffic risk.

[0090] For example, the first threshold is 50% and the second threshold is 0.2. Figure 3In the network topology diagram shown, the traffic probability between network node 1 and network node 3 is 30%, and the traffic risk expectation between network node 1 and network node 3 is 0.28, so network node 1 and network node 3 are target network nodes with abnormal traffic.

[0091] S103: Analyze the traffic data of the target network node.

[0092] In some embodiments, the target network node includes: a first target network node and a second target network node that are connected; the traffic data of the target network node includes: the traffic transmitted between the first target network node and the second target network node based on each type of protocol; then the above step S103 can be implemented as: performing anomaly detection on the traffic transmitted between the first target network node and the second target network node based on each type of protocol to obtain anomaly detection results.

[0093] For example, for HTTP protocol types, the following information is obtained based on the detected traffic: request header, request body: including Uniform Resource Locator (URL), request method (GET, POST, etc.), status code, response time, response body size, etc.; client IP, server IP, request timestamp; User-Agent information, Cookie, request parameters. Request statistics are analyzed from the above information: request type (success, failure), request duration, response body size; exception analysis: abnormal requests (such as 4xx, 5xx error codes), frequently visited URLs, potential DDoS attacks; trend charts: time series changes in the number of requests, response time, and error rate.

[0094] In some embodiments, the type of the traffic protocol between the first target network node and the second target network node includes a target protocol type; Figure 4 As shown, after the above step S103, the method further includes the following step S104:

[0095] S104: Issue an abnormality warning message based on the abnormality detection result.

[0096] In some embodiments, when the abnormal detection result indicates abnormal traffic and / or attack behavior existing in the traffic based on the target protocol type between the first target network node and the second target network node, abnormal alarm information is issued.

[0097] The alarm information is used to indicate that an abnormality exists in the traffic based on the target protocol type between the first target network node and the second target network node.

[0098] In some embodiments, Figure 5As shown, after executing step S103, the method further includes the following step S105.

[0099] S105. Send a decision request message to the decision system based on the anomaly detection result.

[0100] The decision request message is used to instruct the decision system to determine a security protection strategy based on the anomaly detection result, and send the security protection strategy to the security device node, so that the security device node performs security protection based on the security protection strategy.

[0101] It can be understood that the decision request message may include the anomaly detection result. Therefore, after receiving the decision request message, the decision system can determine the security protection strategy based on the anomaly detection result and send the security protection strategy to the security device node; accordingly, after receiving the security protection policy sent by the decision system, the security device node can perform security protection based on the security protection strategy.

[0102] In some embodiments, the type of traffic protocol between the first target network node and the second target network node includes a first protocol type and a second protocol type; when the anomaly detection result includes the anomaly detection result of the first protocol type and the anomaly detection result of the second protocol type, the security protection strategy includes the security protection strategy of the first protocol type and the security protection strategy of the second protocol type; wherein the execution priority of the security protection strategy of the first protocol type and the security protection strategy of the second protocol type is determined based on the alarm weights of the first protocol type and the second protocol type, and the alarm weight of each type of protocol is used to reflect the probability of alarm traffic appearing in the traffic transmitted based on each type of protocol; the anomaly detection result of the first protocol type is the anomaly detection result of the traffic transmitted between the first target network node and the second target network node based on the first protocol type; the anomaly detection result of the second protocol type is the anomaly detection result of the traffic transmitted between the first target network node and the second target network node based on the second protocol type.

[0103] It is understandable that setting the execution priority of security protection policies for different protocol types can, on the one hand, ensure that key or important protocol types between nodes are given priority protection, thereby reducing the security risks of the overall network; on the other hand, the system can reduce excessive protection of low-priority protocol types, thereby freeing up network bandwidth and computing resources.

[0104] Among them, the security protection strategy includes at least one of the following: traffic analysis based on the real-time detected traffic of each protocol, and automatic adjustment of the protection priority of each protocol; automatically increasing the monitoring intensity and protection weight of related protocols based on malicious activities (such as SQL injection or DDoS attack); AI-based intelligent decision-making engine, automatically adjusting the weight of each protocol according to protocol type, attack mode and historical data; based on the increase of protocol weight, firewalls, intrusion detection systems (IDS) / intrusion prevention systems (IPS) and load balancers and other devices respond through automated mechanisms, such as blocking abnormal traffic and triggering deep packet inspection.

[0105] After the security device node adjusts the security policy based on the security protection policy sent by the decision-making system, it can improve the protection effect of the network, reduce the false alarm rate, improve network performance, and optimize bandwidth utilization. For example, as shown in Table 1 below, before adjustment: During peak traffic periods, the security device responds slowly, resulting in affected business traffic and excessive network latency, affecting user experience. After adjustment: By optimizing load balancing and traffic distribution strategies (such as accelerated caching, parallel processing, etc.), the throughput and response speed of the security device are improved, ensuring efficient traffic processing and reducing latency.

[0106] Table 1 Comparison of corresponding indicators before and after adjustment

[0107]

[0108] Next, combine Figure 1 The system architecture shown is used to illustrate the traffic analysis method of the embodiment of the present application. The specific implementation process of the method includes the following steps.

[0109] Step a1: The security device node obtains the traffic data of the user device and sends it to the traffic analysis module.

[0110] Step a2: The traffic analysis module analyzes the input traffic data, obtains the analysis results and outputs them.

[0111] In some embodiments, for different types of protocols, the input traffic data is different, and the output analysis results are also different. Exemplarily, the following uses HTTP protocol, DNS protocol, and MySQL protocol as examples for illustration.

[0112] (1) Input flow data

[0113] HTTP protocol: 1) Request header, request body: including URL, request method (GET, POST, etc.), status code, response time, response body size, etc.; 2) Client IP, server IP, request timestamp; 3) User-Agent information, Cookies, request parameters, etc.

[0114] DNS protocol: 1) DNS query request: query type (A record, CNAME, MX record, etc.), query domain name, request timestamp; 2) DNS response data: response type (A, AAAA, etc.), response time, TTL (time to live), queried IP address; 3) DNS request source IP, query times, cache status.

[0115] MySQL protocol: 1) SQL query content: query statement, parameters, execution time, number of rows returned by the query, error log; 2) user IP, database user information, query duration, connection status, resource consumption (CPU, memory, etc.).

[0116] (2) Output analysis results

[0117] HTTP protocol: 1) Request statistics: request type (success, failure), request duration, response body size; 2) Abnormal analysis: abnormal requests (such as 4xx, 5xx error codes), frequently visited URLs, potential DDoS attacks; 3) Trend chart: time series changes in the number of requests, response time, and error rate.

[0118] DNS protocol: 1) DNS query distribution: the number of queries counted by query type and response status (success, failure); 2) Suspected attack identification: such as DNS amplification attacks, a large number of identical query requests, etc.; 3) Query latency analysis: the trend of query response time, and the source IP of requests with higher latency.

[0119] MySQL protocol: 1) Query performance: SQL execution time distribution, slow query analysis; 2) Abnormal queries: detected incorrect queries, abnormally long queries, frequently accessed tables; 3) Resource consumption: number of database connections, CPU usage, memory usage, etc.

[0120] In some embodiments, the data analysis module analyzes the input traffic data in the following processes: 1) Data preprocessing: Parse and clean the received data to remove noise data (such as invalid requests, repeated requests, etc.). 2) Traffic feature extraction: Extract feature data of each protocol, such as HTTP status code, DNS query type, MySQL SQL query, etc. 3) Anomaly detection: Identify abnormal traffic or attack behavior through statistical models, rule engines or machine learning models, and send anomaly detection results. 4) Data visualization: Generate visual reports to display traffic trends, anomalies, attack types, etc.

[0121] In some embodiments, a network topology structure is generated based on analysis of network traffic data within a preset time period; and a target network node with abnormal traffic is determined based on the network topology structure.

[0122] In some embodiments, the traffic analysis module is further used to analyze traffic data of the target network node.

[0123] Exemplarily, the target network nodes include: a first target network node and a second target network node that are connected; the traffic data of the target network nodes include: the traffic transmitted between the first target network node and the second target network node based on each type of protocol; then the traffic analysis module performs anomaly detection on the traffic transmitted between the first target network node and the second target network node based on each type of protocol to obtain anomaly detection results.

[0124] In some embodiments, the traffic analysis module generates a traffic report based on the analysis result of analyzing the input traffic data. Exemplarily, the traffic report may include anomaly detection results.

[0125] Exemplarily, the flow report specifically includes at least one of the following:

[0126] 1) Traffic Overview: Total traffic statistics: Displays the total amount of network traffic within a certain time range, including inbound and outbound traffic, usually in bytes or bits; Traffic Trend: Displays the changing trend of traffic within a time period, which can help security personnel identify traffic fluctuations, peaks and valleys.

[0127] 2) Traffic protocol distribution: Protocol statistics: Analyze the types of protocols used in the traffic (such as HTTP, DNS, MySQL, etc.) and show the proportion of each protocol in the total traffic; Protocol usage frequency: Display the usage frequency of each protocol (such as number of requests, data transmission volume, etc.), which can help identify protocol abuse or abnormal traffic.

[0128] 3) Attack traffic analysis: Attack type: lists the detected attack types, such as DDoS, SQL injection, cross-site scripting (XSS), malicious scanning, port scanning, etc.; Attack source: displays the IP address, geographical location, and distribution of attack traffic of the attack source; Attack intensity and impact: evaluates the intensity of the attack (such as traffic, attack packet size, attack duration, etc.), and gives an impact assessment on the network and business.

[0129] 4) Traffic anomaly detection: Abnormal traffic patterns: Mark out anomalies in traffic, such as sudden traffic surges, frequent DNS queries, abnormal port usage, etc., and usually detect anomalies through traffic baseline comparison; Traffic deviation from the standard: Analyze and report deviations from normal business patterns to identify potential security risks.

[0130] 5) User behavior analysis: User request analysis: Displays the number of requests initiated by a specific user or IP address, the target accessed, the protocol used, etc.; Malicious user / activity identification: Identifies and marks users with abnormal behavior, such as users who initiate frequent illegal access, brute force cracking and other attacks.

[0131] 6) Security device status and alarms: Device status: provides the current status, load, performance data, etc. of each security device (such as firewall, IDS / IPS, load balancer, etc.); Alarm information: lists traffic-related alarm information, including abnormal behavior or threats detected by security devices.

[0132] Step a3: The traffic analysis module sends the traffic report to the monitoring center.

[0133] Step a4: The monitoring center can issue an abnormal alarm based on the abnormal detection results carried in the traffic detection report.

[0134] Exemplarily, when the abnormal detection result indicates abnormal traffic and / or attack behavior existing in the traffic based on the target protocol type between the first target network node and the second target network node, the monitoring center sends abnormal alarm information to the management platform.

[0135] Step a5: The management platform receives abnormal alarm information sent by the monitoring center and performs unified management and analysis of the alarm information.

[0136] Exemplarily, the unified management and analysis of alarm information by the management platform includes at least one of the following:

[0137] 1) Traffic monitoring and trend analysis: Helps the network security team monitor traffic changes in real time and promptly detect traffic anomalies, potential bottlenecks, and attack behaviors; based on traffic trends, it can optimize network bandwidth, load balancing strategies, and perform resource scheduling.

[0138] 2) Security threat detection and response: By analyzing attack traffic, it can timely detect and respond to various network attacks, such as DDoS, SQL injection, XSS, etc.; provide detailed attack sources and attack methods to help the security team conduct source tracing analysis, understand the attacker's behavior, and formulate defense strategies.

[0139] 3) Optimize security policies: Based on traffic reports, the security team can optimize the rules of firewalls, IPS / IDS, load balancing and other devices to improve protection effectiveness; by analyzing the distribution of traffic protocols, the configuration of security devices can be adjusted to better prevent potential risks.

[0140] 4) Compliance and audit support: Traffic reports provide detailed records of network traffic, which is very important for compliance checks, audits, and legal compliance; for example, the report may record traffic about access to sensitive data, which is critical for compliance (such as the General Data Protection Regulation (GDPR) or the Payment Card Industry Data Security Standard (PCIDSS)).

[0141] 5) Performance optimization: Analyze performance bottlenecks in network traffic and identify factors that may affect system performance (such as excessive bandwidth consumption, excessive irrelevant traffic, etc.); provide real-time traffic analysis to help administrators optimize network resources and improve system response speed.

[0142] Step a6: The traffic analysis module sends a decision request message to the decision system based on the anomaly detection result.

[0143] The decision request message is used to instruct the decision system to determine a security protection strategy based on the anomaly detection result, and send the security protection strategy to the security device node, so that the security device node performs security protection based on the security protection strategy.

[0144] Step a7: In response to the decision request message, the decision system determines a security protection strategy based on the anomaly detection result.

[0145] In some embodiments, the decision support module obtains user-defined security policies (such as blocking specific IP addresses, speed limit policies, etc.). After receiving the decision request message sent by the traffic analysis module, the decision system determines the security protection policy (for example, adjusts the policy based on the security protection policy of the cause) based on the customized security policy and the abnormal detection results carried in the decision request message. For example, blocking attack traffic, adjusting server load, adding firewall rules, etc.

[0146] In some embodiments, the decision system further analyzes the impact of policy adjustments on system performance, such as latency, throughput, etc.

[0147] Exemplarily, the methods of adjusting the strategy include:

[0148] 1) Adjust policies based on traffic analysis: Excessive traffic: If the HTTP traffic exceeds the set threshold, automatically enable traffic speed limit or adjust the load balancing policy; DDoS attack: When a large number of requests from the same source IP are identified, automatically enable firewall rules to limit the source of requests; Abnormal SQL query: When a slow query or an erroneous query is identified for the MySQL protocol, automatically limit the execution of specific queries to prevent database overload.

[0149] 2) Adjust policies based on threat intelligence: If known malicious IPs or domain names are detected, the system can automatically update firewall rules to block communication with these IPs.

[0150] 3) Automated response and manual intervention: If the severity of a security incident reaches a preset level, the system automatically initiates emergency response procedures, such as closing vulnerable ports, suspending services, etc. For complex or ambiguous incidents, a decision support report is generated and submitted to the security team for review and further policy adjustments.

[0151] In some embodiments, the security protection strategy includes different aspects of security protection, such as network security protection, host security protection, data security protection, application security protection, user identity and access management, vulnerability management and patch management, security monitoring and log management, etc.

[0152] Exemplarily, network security protection includes: 1) Boundary protection: Protect network boundaries through firewalls, IPS and other devices to prevent unauthorized access. 2) VPN: Use virtual private networks (VPNs) to protect secure communications between remote workers and the company's internal network. 3) Intrusion detection and prevention: Deploy IDS and IPS to monitor network traffic and promptly detect and prevent malicious activities. 4) Network isolation: Isolate networks of different security levels through VLAN or subnet segmentation to reduce the attack surface. 5) Web application firewall: Protect web applications from SQL injection, XSS attacks, etc.

[0153] Exemplarily, host security protection includes: 1) Antivirus and anti-malware software: Install and regularly update antivirus and anti-malware software to protect the host from threats such as viruses, Trojans, and ransomware. 2) Host firewall: Access control of host ports is performed through the operating system firewall (such as Windows Firewall). 3) Security patch management: Ensure that all systems and software are regularly applied with the latest security patches to prevent the exploitation of known vulnerabilities. 4) Strong password and authentication mechanism: Enforce complex password policies and improve the security of identity authentication through multi-factor authentication (MFA).

[0154] Exemplarily, data security protection includes: 1) Data encryption: Use encryption technology to ensure the confidentiality of data during storage and transmission. Common encryption algorithms include symmetric encryption and asymmetric encryption. 2) Data backup and recovery: Regularly back up key data and ensure the security, integrity and recoverability of backup data. 3) Data Leakage Prevention (DLP): Use technical means to monitor the storage, transmission and access of sensitive data to prevent data leakage. 4) Access control: Implement role-based access control (RBAC) and the principle of least privilege to ensure that only authorized users can access sensitive data.

[0155] Exemplarily, application security protection includes: 1) Web application security: Implement common Web security measures, such as SQL injection protection, XSS protection, etc. 2) Vulnerability scanning and management: Regularly perform application vulnerability scanning and promptly repair discovered security vulnerabilities to prevent them from being exploited by hackers. 3) Code audit and secure development: During the application development process, perform security code audits to prevent the introduction of common security vulnerabilities (such as buffer overflows, privilege escalation, etc.). 4) Application Programming Interface (API) security: Perform access control, identity authentication, rate limiting and other measures on APIs to prevent abuse and attacks.

[0156] For example, user identity and access management (IAM) includes: 1) Authentication: Strengthen user authentication through multi-factor authentication (MFA), single sign-on (SSO) and other mechanisms. 2) Permission management: Ensure that users only have the minimum permissions required to perform their work through the principle of least privilege and role-based access control. 3) Account audit: Regularly review the activities of user accounts to ensure that there is no abuse or improper access.

[0157] Exemplarily, vulnerability management and patch management include: 1) Vulnerability scanning: Regularly scan the system, network, and application for vulnerabilities to promptly discover and fix known vulnerabilities. 2) Patch management: Ensure that security patches for operating systems, applications, and services are applied in a timely manner to prevent vulnerabilities from being exploited by hackers.

[0158] Exemplarily, security monitoring and log management include: 1) SIEM: Centrally manage and analyze security logs, detect security incidents in real time, and ensure rapid response. 2) Log audit and analysis: Regularly audit important system and application logs to track possible security incidents and behavioral anomalies.

[0159] Step a8: The decision system sends the security protection strategy to the security device node; correspondingly, the security device node receives the security protection strategy.

[0160] Step a9: The security device node performs security protection based on the security protection strategy.

[0161] Optionally, the security device nodes include: a firewall, an intrusion detection system, an intrusion prevention system, and a load balancer.

[0162] Among them, the functions of the firewall are: controlling the flow of traffic in and out of the network, and judging whether to allow or deny data packets through a set of rules. Firewall protection measures: The firewall will monitor and intercept different flows according to the configured policies. For example, when the flow is high, the firewall will perform more flow control measures, such as rate limiting, blocking the communication of specific ports or protocols, etc.; when the flow is low, the firewall is in a lighter protection mode, focusing more on normal flow filtering and connection management.

[0163] Functions of intrusion detection systems: monitor potential security threats in network traffic and detect malicious activities by analyzing known attack features. Protection measures of intrusion detection systems: mainly detect abnormal behaviors in traffic, such as DDoS attacks, SQL injections, XSS and other attacks. For example, during periods of surging attack activity, IDS will detect anomalies at a high frequency through rule bases and behavioral analysis technologies; during periods of low traffic, IDS is in a lighter working state, focusing mainly on basic anomalies in traffic.

[0164] Function of intrusion prevention system: Similar to IDS, but takes further defensive measures and can actively intercept malicious traffic. Protection measures of IPS: IPS automatically blocks the further spread of malicious traffic according to the configured policies. Intrusion prevention system plays an important role in large-scale attacks (such as DDoS) and can quickly respond to and interrupt attacks.

[0165] Functions of load balancers: distribute traffic entering the network, ensure effective use of server resources and prevent overloading of a single server. Protection measures of load balancers: balance server loads during high-traffic periods through intelligent traffic distribution algorithms. In the event of a large-scale DDoS attack, load balancers can distribute attack traffic to multiple nodes to reduce the pressure on a single server.

[0166] Optionally, the protection status of the security device node includes the following parameters: time period, traffic situation, protection measures, attack situation, and security device load, as shown in Table 2, for example.

[0167] Table 2 Protection status of security device nodes

[0168]

[0169] Optionally, a distributed traffic analysis and response mechanism is configured on each security device node, and the adjusted protocol weights are promptly transmitted to each security device node, ensuring that each node can respond quickly and take corresponding protective measures.

[0170] The above mainly introduces the scheme of the embodiment of the present disclosure from the perspective of the method. It can be understood that in order to realize the above functions, the traffic analysis device includes at least one of the hardware structure and software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiment disclosed in this article, the embodiment of the present disclosure can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiment of the present disclosure.

[0171] The embodiments of the present disclosure may divide the functional modules of the traffic analysis device according to the above method embodiments. For example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one functional module. The above integrated modules may be implemented in the form of hardware or software. It should be noted that the division of modules in the embodiments of the present disclosure is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function.

[0172] Figure 6 The following is a schematic diagram of the composition of a flow analysis device provided in an embodiment of the present application, and the flow analysis device is used to execute the flow analysis method provided in the method embodiment. Figure 4 As shown, the traffic analysis device includes: an acquisition module 601 and a processing module 602.

[0173] The acquisition module 601 is used to acquire the network topology structure within a preset time period. The network topology structure is generated based on the network traffic data within the preset time period. The network topology structure is used to reflect the traffic interaction between each network node within the preset time period.

[0174] The processing module 602 is used to determine the target network node with abnormal traffic based on the network topology structure; and analyze the traffic data of the target network node.

[0175] In a possible implementation method, the traffic interaction situation includes at least one of the following: the connection between network nodes, data flow direction, traffic probability, traffic risk expectation value, traffic protocol type, traffic transmitted based on each type of protocol, and alarm weight of each type of protocol; wherein the traffic risk expectation value is used to reflect the probability of alarm traffic appearing in the traffic between network nodes; the alarm weight of each type of protocol is used to reflect the probability of alarm traffic appearing in the traffic transmitted based on each type of protocol.

[0176] In another possible implementation, the network topology structure includes a first network node and a second network node that are connected, wherein traffic flows from the first network node to the second network node; then the expected value of the traffic risk between the first network node and the second network node is determined based on the following parameters: the sum of the traffic between other network nodes connected to the first network node and the first network node, the protocol type between the first network node and the second network node, the traffic transmitted between the first network node and the second network node based on each type of protocol, and the alarm weight of each type of protocol between the first network node and the second network node.

[0177] In another possible implementation, the expected value of traffic risk satisfies the following formula:

[0178]

[0179] Among them, represents the expected value of the traffic risk from the first network node i to the second network node j; represents the sum of the traffic between other network nodes k connected to the first network node i and the first network node i; represents the size of the traffic between other network nodes k connected to the first network node i; represents the size of the traffic transmitted between the first network node i and the second network node j based on the S-type protocol; represents the alarm weight of the S-type protocol between the first network node i and the second network node j; m represents the number of protocol types between the first network node i and the second network node j; n represents the number of all network nodes connected to the first network node i.

[0180] In another possible implementation, the alarm weight of each type of protocol is determined based on at least one of the following: a traffic pattern of traffic transmitted by each type of protocol; wherein the traffic pattern includes normal traffic and attack traffic; and attack protection parameters configured in the security device node for traffic of each type of protocol.

[0181] In another possible implementation, the abnormal traffic situation includes at least one of the following: the traffic probability between network nodes is greater than a first threshold; the expected value of the traffic risk between network nodes is greater than a second threshold.

[0182] In another possible implementation, the target network node includes a first target network node and a second target network node that are connected; the traffic data of the target network node includes the traffic transmitted between the first target network node and the second target network node based on each type of protocol; the processing module 602 is specifically used to analyze the traffic data of the target network node, including: performing anomaly detection on the traffic transmitted between the first target network node and the second target network node based on each type of protocol to obtain anomaly detection results.

[0183] In another possible implementation, the type of traffic protocol between the first target network node and the second target network node includes a target protocol type; the processing module 602 is also used to: issue an abnormal alarm message when the anomaly detection result indicates abnormal traffic and / or attack behavior in the traffic based on the target protocol type between the first target network node and the second target network node; the alarm message is used to indicate the presence of an abnormality in the traffic based on the target protocol type between the first target network node and the second target network node.

[0184] In another possible implementation, the processing module 602 is also used to: send a decision request message to the decision system based on the anomaly detection result, and the decision request message is used to instruct the decision system to determine a security protection strategy based on the anomaly detection result, and send the security protection strategy to the security device node, so that the security device node performs security protection based on the security protection strategy.

[0185] In another possible implementation, the type of traffic protocol between the first target network node and the second target network node includes a first protocol type and a second protocol type; when the anomaly detection result includes the anomaly detection result of the first protocol type and the anomaly detection result of the second protocol type, the security protection strategy includes the security protection strategy of the first protocol type and the security protection strategy of the second protocol type; wherein the execution priority of the security protection strategy of the first protocol type and the security protection strategy of the second protocol type is determined based on the alarm weights of the first protocol type and the second protocol type, and the alarm weight of each type of protocol is used to reflect the probability of alarm traffic appearing in the traffic transmitted based on each type of protocol; the anomaly detection result of the first protocol type is the anomaly detection result of the traffic transmitted between the first target network node and the second target network node based on the first protocol type; the anomaly detection result of the second protocol type is the anomaly detection result of the traffic transmitted between the first target network node and the second target network node based on the second protocol type.

[0186] In an exemplary embodiment, the present application also provides an electronic device, Figure 7 The following is a schematic diagram of the composition of an electronic device provided in an embodiment of the present application. Figure 7As shown, the electronic device may include: a processor 701 and a memory 702; the memory 702 stores instructions executable by the processor 701; when the processor 701 is configured to execute the instructions, the electronic device or network device or manager implements the method described in the aforementioned method embodiment.

[0187] In actual implementation, the acquisition module 601 and the processing module 602 can be composed of Figure 7 The processor 701 shown is implemented by calling the instructions stored in the memory 702. The specific execution process can refer to the description of the above traffic analysis method part, which will not be repeated here.

[0188] In an exemplary embodiment, the present application also provides a readable storage medium on which program instructions are stored; when the program instructions are executed by a computer, the computer implements the method described in the aforementioned embodiment. The readable storage medium can be a non-temporary readable storage medium, for example, a non-temporary readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device.

[0189] In an exemplary embodiment, the embodiment of the present application further provides a computer program product. When the computer program product is run on a computer, the computer executes the above-mentioned related method steps to implement the traffic analysis method in the above-mentioned embodiment.

[0190] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A flow analysis method, characterized in that: The method comprises: Acquire a network topology structure within a preset time period, wherein the network topology structure is generated based on network traffic data within the preset time period; the network topology structure is used to reflect traffic interaction between various network nodes within the preset time period; Based on the network topology, determine a target network node where traffic anomalies exist; The traffic data of the target network node is analyzed.

2. The method according to claim 1, characterized in that The traffic interaction condition includes at least one of the following: The connection between network nodes, data flow direction, traffic probability, traffic risk expectation value, traffic protocol type, traffic transmitted based on each type of protocol, and alarm weight of each type of protocol; wherein the traffic risk expectation value is used to reflect the probability of alarm traffic appearing in the traffic between network nodes; the alarm weight of each type of protocol is used to reflect the probability of alarm traffic appearing in the traffic transmitted based on each type of protocol.

3. The method according to claim 2, characterized in that The network topology structure includes a first network node and a second network node that are connected, wherein traffic flows from the first network node to the second network node; then the expected value of the traffic risk between the first network node and the second network node is determined based on the following parameters: the sum of the traffic between other network nodes connected to the first network node and the first network node, the protocol type between the first network node and the second network node, the traffic transmitted between the first network node and the second network node based on each type of protocol, and the alarm weight of each type of protocol between the first network node and the second network node.

4. The method according to claim 3, characterized in that The expected value of traffic risk satisfies the following formula: Among them, the P ij represents the expected value of the traffic risk from the first network node i to the second network node j; represents the total traffic between other network nodes k connected to the first network node i and the first network node i; the w ik represents the traffic size between the other network nodes k connected to the first network node i; the p s represents the size of the traffic transmitted between the first network node i and the second network node j based on the s-type protocol; the A s represents the alarm weight of the class S protocol between the first network node i and the second network node j; m represents the number of protocol types between the first network node i and the second network node j; and n represents the number of all network nodes connected to the first network node i.

5. The method according to any one of claims 2 to 4, characterized in that: The alarm weight of each type of protocol is determined based on at least one of the following: A traffic pattern based on traffic transmitted by each type of protocol; wherein the traffic pattern includes normal traffic and attack traffic; Attack protection parameters configured in the security device node for traffic of each type of protocol.

6. The method according to claim 1, characterized in that The traffic abnormality is at least one of the following: The probability of traffic between network nodes is greater than a first threshold; The expected value of the traffic risk between the network nodes is greater than the second threshold.

7. The method according to claim 1, characterized in that The target network node includes a first target network node and a second target network node that are in a connection relationship; the traffic data of the target network node includes traffic transmitted between the first target network node and the second target network node based on each type of protocol; The analyzing the traffic data of the target network node includes: Anomaly detection is performed on traffic transmitted between the first target network node and the second target network node based on each type of protocol to obtain anomaly detection results.

8. The method according to claim 7, characterized in that The type of the traffic protocol between the first target network node and the second target network node includes a target protocol type; and the method further includes: When the anomaly detection result indicates abnormal traffic and / or attack behavior existing in the traffic based on the target protocol type between the first target network node and the second target network node, an abnormal alarm information is issued; the alarm information is used to indicate the existence of an abnormality in the traffic based on the target protocol type between the first target network node and the second target network node.

9. The method according to claim 7, characterized in that: The method further comprises: Based on the anomaly detection result, a decision request message is sent to the decision system, wherein the decision request message is used to instruct the decision system to determine a security protection strategy based on the anomaly detection result, and send the security protection strategy to the security device node, so that the security device node performs security protection based on the security protection strategy.

10. The method according to claim 9, characterized in that The type of the traffic protocol between the first target network node and the second target network node includes a first protocol type and a second protocol type; In the case where the anomaly detection result includes the anomaly detection result of the first protocol type and the anomaly detection result of the second protocol type, the security protection strategy includes the security protection strategy of the first protocol type and the security protection strategy of the second protocol type; wherein the execution priority of the security protection strategy of the first protocol type and the security protection strategy of the second protocol type is determined based on the alarm weights of the first protocol type and the second protocol type, and the alarm weight of each type of protocol is used to reflect the probability of alarm traffic appearing in the traffic transmitted based on each type of protocol; The anomaly detection result of the first protocol type is the anomaly detection result of the traffic transmitted between the first target network node and the second target network node based on the first protocol type; the anomaly detection result of the second protocol type is the anomaly detection result of the traffic transmitted between the first target network node and the second target network node based on the second protocol type.

11. An electronic device, characterized in that: The electronic device comprises: a processor and a memory; The memory stores instructions executable by the processor; When the processor is configured to execute the instructions, the electronic device implements the method according to any one of claims 1 to 10.

12. A readable storage medium, characterized in that: The readable storage medium includes: software instructions; When the software instructions are executed in an electronic device, the electronic device implements the method according to any one of claims 1 to 10.

13. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is run on an electronic device, the electronic device is enabled to perform the method according to any one of claims 1 to 10.

Images