Abnormality detection method, system and device, program product and storage medium

Abstract

The invention discloses an anomaly detection method, system and device, a program product and a storage medium, and the method comprises the steps: obtaining a network topological graph which is used for representing a plurality of network nodes and a connection relation between the network nodes; determining access paths in the network topological graph and a weight corresponding to each access path based on traffic information and the network topological graph; determining an anomaly detection value based on the weight and bandwidth of the access path; and determining whether an abnormal event exists or not based on a size relationship between the abnormal detection value and a preset threshold value. And the abnormal detection value is determined by using the weight and the bandwidth, and the judgment accuracy is enhanced in a multi-factor fusion mode. And finally, judging an abnormal event according to the relationship between the abnormal detection value and the threshold value, effectively identifying abnormities which are difficult to perceive by the traditional technology, such as video camera mutual access, improving the comprehensiveness and accuracy of power grid network anomaly detection, and ensuring safe and stable operation.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an anomaly detection method, system, device, program product and storage medium. Background Art

[0002] In modern smart grid systems, video surveillance cameras are widely used for security monitoring and equipment status monitoring. With the development of information technology, video cameras in power grids can not only store and transmit video data locally, but also realize remote access functions, that is, the control center in one location can access the video streams captured by cameras in different geographical locations. However, if this mutual access capability is improperly used, it may lead to security risks, especially when unauthorized or counterfeit devices try to access the network and conduct mutual access.

[0003] The core architecture of traditional probabilistic connectivity-based assessment technology is built around general grid node connectivity reliability analysis and node prediction. Under this broad framework, no special abnormal judgment logic is set up for video cameras, which have unique functions and application scenarios. In the actual power grid environment, the purpose of deploying cameras is to achieve monitoring and data collection in a specific area. Its normal communication flow should follow strict planning, mainly to transmit data to specific storage or processing nodes. When mutual visits occur between two cameras, this behavior completely deviates from the normal communication mode. However, the existing technology mainly focuses on conventional indicators and general node analysis methods for power grid reliability assessment. Its core focus is on the connectivity of nodes and the stability of the overall system under large-scale power grid architecture, such as reliability analysis of key power facilities such as transmission line nodes and substation equipment nodes. The communication details of non-core power transmission equipment such as video cameras are not included in the key monitoring scope. Under this technical design orientation, the mutual visit behavior between video cameras is not given special attention weight, and it cannot be identified as abnormal in its conventional analysis process. Summary of the invention

[0004] Based on the above problems, the present application provides an anomaly detection method, system, device, program product and storage medium.

[0005] The embodiments of the present application disclose the following technical solutions:

[0006] A first aspect of an embodiment of the present application provides an anomaly detection method, including:

[0007] Obtaining a network topology map, wherein the network topology map is used to represent a plurality of network nodes and a connection relationship between each network node;

[0008] Based on the traffic information and the network topology map, determine the access paths in the network topology map and the weight corresponding to each access path;

[0009] Determining an anomaly detection value based on the weight and bandwidth of the access path;

[0010] Based on the magnitude relationship between the abnormal detection value and a preset threshold, it is determined whether an abnormal event occurs.

[0011] In a possible implementation, the method for determining the weight corresponding to each access path includes:

[0012] For each access path, the number of network nodes included in the access path is obtained, and the number of network nodes included in the access path is used as the weight corresponding to the access path.

[0013] In a possible implementation, determining the abnormality detection value based on the weight and bandwidth of the access path includes:

[0014] The weight of each access path in the network topology graph is summed up as the sum of probabilistic connectivity;

[0015] For each access path, the ratio of the weight corresponding to the access path to the sum of the probability connectivity is used as the probability value of the access path;

[0016] For each access path, an anomaly detection value is calculated based on the probability value and bandwidth of the access path.

[0017] In a possible implementation, the calculation method of the abnormal detection value includes:

[0018] r=1 / (W*W*bandwidth), where r is the anomaly detection value, W is the probability value of the access path, and bandwidth is the bandwidth.

[0019] In a possible implementation, determining whether an abnormal event occurs based on a magnitude relationship between the abnormal detection value and a preset threshold value includes:

[0020] When the abnormal detection value is not less than a preset threshold, the corresponding access path is added to the abnormal event list;

[0021] An exception reason is generated based on the network nodes included in the access path.

[0022] In a possible implementation, the access path in the network topology diagram is determined by:

[0023] Based on the connection relationship between each network node represented by the network topology diagram, and the real-time traffic data and traffic flow direction information between each network node represented by the traffic information, the access path in the network topology diagram is determined.

[0024] A first aspect of an embodiment of the present application provides an anomaly detection system, including:

[0025] An acquisition unit, used to acquire a network topology map, wherein the network topology map is used to represent a plurality of network nodes and a connection relationship between each network node;

[0026] A first determining unit, configured to determine an access path in the network topology map and a weight corresponding to each access path based on traffic information and the network topology map;

[0027] A second determining unit, configured to determine an abnormality detection value based on the weight and bandwidth of the access path;

[0028] The third determination unit is used to determine whether an abnormal event exists based on the magnitude relationship between the abnormal detection value and a preset threshold.

[0029] A third aspect of an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the anomaly detection method as described in the first aspect above is implemented.

[0030] A fourth aspect of the embodiments of the present application provides a computer program product. When the computer program product runs on a computer, the computer executes the anomaly detection method as described in the first aspect above.

[0031] A fifth aspect of an embodiment of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes the anomaly detection method as described in the first aspect above.

[0032] Compared with the prior art, this application has the following beneficial effects:

[0033] By obtaining the network topology diagram and combining it with traffic information, the connection relationship and access path between various network nodes, including video cameras, can be sorted out. This comprehensive analysis method breaks the limitation of traditional technology that only focuses on key power facility nodes, and also includes non-core equipment such as video cameras in the detailed network architecture investigation. For example, in the process of drawing the network topology diagram, the connection between the camera and video gateways, routers and other devices is clarified, laying the foundation for the subsequent accurate judgment of whether its communication behavior is abnormal. Based on the access path and corresponding weight determined in this way, the importance and frequency of each path in the network can be quantified, so that even the special communication paths between video cameras can be reasonably analyzed and evaluated, and are no longer ignored like traditional technologies.

[0034] The weight and bandwidth of the access path are combined to determine the anomaly detection value, and the presence of an abnormal event is determined by comparing it with a preset threshold. In traditional technology, due to the lack of such a multi-factor fusion judgment method, abnormal situations such as mutual visits between video cameras cannot be effectively identified. However, this application can more accurately reflect the actual conditions of different paths by comprehensively considering weights and bandwidth. For mutual visits between video cameras, their weights may be low because they do not conform to the normal communication flow. At the same time, if their bandwidth also presents an abnormal small value, the calculated anomaly detection value is likely to exceed the preset threshold, thereby being accurately identified as an abnormal event. This precise anomaly detection mechanism makes up for the deficiencies in the judgment logic of traditional technology, effectively solves the problem that the existing technology cannot identify anomalies such as mutual visits between video cameras, and improves the comprehensiveness and accuracy of power grid network anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0036] Figure 1 A flowchart of an anomaly detection method provided in an embodiment of the present application;

[0037] Figure 2 The first topological structure diagram provided in the embodiment of the present application;

[0038] Figure 3 A second topological structure diagram provided in an embodiment of the present application;

[0039] Figure 4 A structural diagram of an anomaly detection system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] To facilitate understanding of the technical solutions provided by the embodiments of the present application, the background technology involved in the embodiments of the present application will be described below.

[0042] As mentioned above, in actual scenarios, video cameras are important sensing terminals in the power grid monitoring system, and the standardization and security of their data transmission are crucial. When two video cameras visit each other, traditional technologies lack a targeted abnormal identification mechanism and are only based on conventional connectivity and reliability assessment standards, which cannot provide insight into the risks that may be hidden behind such atypical connections. For example, there may be preliminary attempts to maliciously manipulate cameras for illegal information theft or network attacks, but existing technologies cannot detect and issue alarms in a timely manner.

[0043] During the installation phase, the presence of fake cameras poses a serious threat to power grid security. After these fake devices are connected to the network, they interact with other cameras, which may cause data leakage, system interference, or even tampering with key power grid information. However, when faced with such situations, existing technologies cannot effectively identify these abnormal interactions due to their own design defects, which puts the power grid in a dangerous situation of exposing security vulnerabilities during initial construction or equipment updates, greatly increasing the risk of attacks and failures on the power grid, and seriously affecting the stability and security of power grid operation.

[0044] In order to solve the above problems, the embodiment of the present application completes the network topology drawing of the centralized control station by combining active scanning (i.e., the system actively initiates a detection request) and passive sniffing (listening to data packets in the network without sending additional detection information) inside the centralized control station. This helps to accurately grasp the network structure and lays the foundation for subsequent probabilistic connectivity analysis. According to the results obtained from the traffic, all connectivity probabilities are formed into a path map and the total path weight is calculated. This method not only takes into account the direct connection between each node, but also takes into account the possible indirect paths and their probabilities, thereby more comprehensively reflecting the actual state of the network. The weights in the path map are associated with the actual observed traffic bandwidth to form a unique anomaly detection ratio r. This ratio takes into account the relationship between the path probability connectivity and the actual traffic size, so that potential abnormal behavior can be identified even in low traffic conditions. A threshold judgment is performed on the calculated anomaly detection ratio. When the anomaly detection ratio is large, it means that some unusual situations have occurred, such as small weights and small traffic. These situations are relatively rare in industrial control networks, so they are listed as abnormal events and reported.

[0045] In some possible application scenarios, such as the communication between two cameras on the same side or the first communication mode after a new device is connected, a special algorithm is proposed to evaluate whether it is an abnormal behavior. For those communications that should not normally occur but do occur, even if they occur during the installation phase, they can be effectively identified through probabilistic connectivity and traffic characteristics. Considering the specific needs of different application scenarios, users are allowed to manually adjust the anomaly detection parameters according to actual conditions to ensure the flexibility and adaptability of the system.

[0046] It should be noted that the anomaly detection method, system, device and medium provided in the present application can be applied to the field of computer technology. The above is only an example and does not limit the application field of the anomaly detection method, system, device and medium provided in the present application. In addition, the embodiments of the present application may not limit the execution subject of the anomaly detection. For example, the anomaly detection method of the embodiment of the present application can be applied to data processing devices such as terminal devices or servers. Among them, the terminal device can be an electronic device such as a computer, a personal digital assistant (PDA). The server can be a stand-alone server, a cloud server or a cluster server composed of multiple servers.

[0047] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0048] The following describes an abnormality detection method provided by the present application through an embodiment. Figure 1 ,Should Figure 1 A flowchart of an anomaly detection method provided in an embodiment of the present application, the method comprising:

[0049] S101. Obtain a network topology map.

[0050] Inside the centralized control station, the network topology of the centralized control station can be comprehensively and accurately mapped out through active scanning and passive sniffing, providing basic network architecture information for subsequent network analysis, anomaly detection and other tasks.

[0051] See also Figure 2 , Figure 2 The first topology diagram provided in the embodiment of the present application includes a variety of network devices and the connection relationships between them.

[0052] The equipment includes: camera (a), camera on the same side (g), video gateway (b), router (c), backup router (c'), management system (d), and application APP (e).

[0053] Connection relationship: Camera (a) is connected to video gateway (b), video gateway (b) is connected to router (c) and backup router (c'), router (c) and backup router (c') are connected to management system (d), and management system (d) is finally connected to application APP (e). In addition, camera (g) on ​​the same side is also connected to router (c) and backup router (c').

[0054] The figure clearly indicates that the prime on c is the backup router (c'). In the active-standby mode, if the primary router c fails, the network traffic will be transmitted through the backup router c' to ensure the connectivity and stability of the network. For example, under normal circumstances, the traffic path from camera a to application APPe may be abcde. When c fails, the traffic path will switch to ab-c'-de.

[0055] In this topology, from a to b, the path probabilistic connectivity is 1; from b to c is 1, from c to d is 1, and from d to e is also 1. This means that in each connection, the probability that data can be transmitted smoothly is 100%, that is, the probabilistic connectivity of each connection is the same, indicating that these connections are stable and reliable. This probabilistic connectivity setting provides a basic quantitative indicator for subsequent analysis of the reliability of network paths, calculation of path weights, and anomaly detection. For example, when calculating the total path weight later, the values ​​of these probabilistic connectivity will be included in the calculation, thereby affecting the evaluation of the entire network path.

[0056] Network topology drawing is the basis of the entire network management and analysis. It clearly presents the layout and connection relationship of the network equipment inside the centralized control station, allowing network management personnel to intuitively understand the network structure and facilitate network planning, troubleshooting, performance optimization, etc. By clarifying the primary and backup router modes and the probabilistic connectivity of each path segment, it provides key parameters and basis for subsequent network reliability analysis and anomaly detection algorithms.

[0057] S102: Based on the traffic information and the network topology map, determine the access paths in the network topology map and the weight corresponding to each access path.

[0058] In one possible implementation, the method for determining the access path in the network topology diagram includes: determining the access path in the network topology diagram based on the connection relationship between each network node represented by the network topology diagram, and the real-time traffic data and traffic flow direction information between each network node represented by the traffic information.

[0059] First, it is emphasized that the connection relationship between each network node represented by the network topology diagram should be based on the network topology diagram. The network topology diagram clearly shows how the devices (i.e., network nodes) such as cameras, video gateways, routers, management systems, and application apps are interconnected, which is the basic framework for determining the access path. For example, there is a connection from camera a to video gateway b, and there is a connection from video gateway b to router c, etc. These connection relationships constitute the basic structure of possible access paths.

[0060] In addition to the network topology diagram, traffic information is also needed. The traffic information here includes real-time traffic data between each network node and traffic flow information. Real-time traffic data can reflect which paths have data being transmitted and the amount of data being transmitted; the traffic flow information clarifies which node the data flows from to which node. Through the comprehensive consideration of these two aspects of information, the actual access path can be determined more accurately. For example, although the network topology diagram shows that camera a can reach application APP e through video gateway b, router c, etc., if the real-time traffic data shows that there is no data flowing from a to e, or the traffic flow is from a to the camera g on the same side, then it can be determined that the actual access path is a to g, etc., rather than just based on the theoretical connection of the network topology diagram.

[0061] This method of determining access paths combines the physical connection structure of the network with the actual data flow, and can more accurately determine the access paths that actually exist in the network. It avoids the problem of inaccurate path determination that may be caused by ignoring the actual traffic situation based solely on the theoretical connection of the network topology diagram, and provides more reliable basic data for subsequent steps such as path map construction, weight calculation, and anomaly detection.

[0062] Based on the results of traffic acquisition, the connectivity probabilities between all devices in the network are organized into a path map, and the total path weight is calculated to quantify the characteristics of different access paths, providing an important basis for subsequent anomaly detection.

[0063] When the main router is c, the path of traffic from video camera a to application APPe is abcde. Because the probability connectivity of each connection is 1, the weight of the path is 4 (connected through 4 devices); when using the backup router c', the path of traffic from video camera a to application APPe is abc'de, and the weight is also 4. When communicating from one video camera a to another camera g, abc'g, the weight is 3.

[0064] See also Figure 3 , Figure 3 The second topology diagram provided in the embodiment of the present application shows that if a camera h and a router k are added, the path from camera a to h is abc'kh, and its weight is . This shows how to calculate the path weight according to the same rules when the network topology changes (adding a device).

[0065] Take the above figure as an example. If all the paths starting from point a are shown in the figure, there are 4 in total. Then the probability of the last path (a to h) is as follows: Wah = wah / sum(wac+wag+wae+wah) = 5 / (4+3+4+4) = 0.33, which is about 33% probability. This means that among all possible paths starting from point a, the probability of the path from a to h appearing is about 33%. In this way, the relative probability of each specific path in the entire network traffic path can be calculated, thus forming a comprehensive graph reflecting the probability distribution of different paths in the network.

[0066] S103: Determine an abnormality detection value based on the weight and bandwidth of the access path.

[0067] The bandwidth can be acquired by monitoring the bandwidth data of each path in real time through a network monitoring tool.

[0068] In a possible implementation, determining the anomaly detection value based on the weight and bandwidth of the access path includes: summing the weight of each access path in the network topology diagram as the sum of probabilistic connectivity; for each access path, taking the ratio of the weight corresponding to the access path to the sum of probabilistic connectivity as the probability value of the access path; for each access path, calculating the anomaly detection value based on the probability value and bandwidth of the access path.

[0069] The weight map W in S102 is associated with the bandwidth of the actual observed traffic to form an anomaly detection ratio r, taking r = 1 / (W*W*bandwidth). The weight route is in principle independent of the bandwidth, but the weight has a greater impact on the anomaly detection ratio, so the square form is adopted to enhance the role of the weight in the judgment. This anomaly detection ratio is unique to the present invention and can be manually adjusted according to the actual situation of the anomaly judgment, which increases the flexibility and adaptability of the method and can better adapt to the anomaly detection needs in different network environments and actual application scenarios.

[0070] S104: Determine whether an abnormal event occurs based on a magnitude relationship between the abnormal detection value and a preset threshold.

[0071] The abnormal detection ratio r is judged by a threshold value. When r is large, it is listed as an abnormal event for reporting. The threshold setting can be dynamically adjusted according to the historical operation data of the power grid network and the actual operation environment.

[0072] When it is large, the following situations may occur: The weight itself is small, indicating that the importance of the path in the network or the probability of normal occurrence is low, deviating from the normal network traffic pattern. The traffic itself is small, which may indicate that the data transmission volume on the path is abnormally low and does not conform to normal network usage. The weight is also small, and the traffic is even smaller. This situation is relatively rare in industrial control networks and needs to be taken seriously and listed as an abnormal event for further analysis and processing.

[0073] In a possible implementation, when the abnormality detection value is not less than a preset threshold, the corresponding access path is added to the abnormal event list; and based on the network nodes included in the access path, the abnormality cause is generated.

[0074] It is clearly stipulated that when the anomaly detection value is not less than the preset threshold, the corresponding access path will be added to the abnormal event list. This step establishes a clear judgment standard, allowing the system to automatically filter out access paths that may have abnormalities. For example, if the preset threshold is 0.5, and the calculated anomaly detection value of an access path (such as the path from camera a to camera g on the same side) is 0.6, then this path will be added to the abnormal event list for further analysis and processing.

[0075] The abnormality cause is generated based on the network nodes included in the access path determined to be abnormal. This means that the system will analyze the status and behavior of the cameras, routers, gateways and other devices involved. Taking the communication between two cameras on the same side as an example, if this path is determined to be abnormal, the system may check whether the camera is configured correctly, whether it has been attacked or interfered by external forces, etc., thereby generating abnormal causes such as "the camera may be maliciously controlled to communicate abnormally" or "the camera configuration error causes abnormal connection with the device on the same side".

[0076] For example, if two cameras on the same side communicate, it means that one of the cameras has an abnormality, and its calculation formula also changes. For the access from a to g in the above figure, its w=3, W=3 / (4+3+4+4)=0.2, which is about a 20% probability, and its traffic bandwidth is detected, but the bandwidth is extremely small. According to the calculation in steps 3 and 4, it is found that its r value is very large, indicating that there is a high possibility of an abnormality, and it may be temporarily occupied for scanning or detection.

[0077] Through the automated threshold comparison and abnormal event list addition process, potential abnormal paths can be quickly and accurately identified, avoiding the tedious process of manual one-by-one investigation, greatly improving the efficiency of abnormal detection. At the same time, the method of generating abnormal causes based on network nodes provides targeted guidance for subsequent troubleshooting and problem solving, allowing maintenance personnel to quickly understand the possible root causes of the problem, further improving the efficiency of handling abnormal events.

[0078] This precise abnormality judgment and cause generation mechanism helps to timely discover and resolve security risks and faults in the network, ensuring the stable operation of the power grid network. For example, if abnormal communication of a camera can be discovered and handled in a timely manner, possible data leakage or network attacks can be prevented, thereby enhancing the security and reliability of the entire system.

[0079] In summary, the embodiments of the present application have the following beneficial effects:

[0080] By integrating the network topology and traffic information to determine the access path and its weight, and combining the bandwidth to calculate the anomaly detection value, and finally determining the abnormal event based on the comparison with the preset threshold, this multi-factor comprehensive method can more accurately identify abnormal situations in the power grid network. Compared with the traditional method based on a single factor or simple connectivity analysis, it can effectively avoid misjudgment and missed judgment. For example, it can accurately detect abnormal behaviors such as unusual mutual visits between two video cameras, which are often difficult to detect in existing technologies.

[0081] Timely and accurate detection of abnormal events can provide strong support for network security protection. In the power grid environment, timely detection of problems such as fake camera mutual access or abnormal device connection can effectively prevent potential network attacks, data leakage and other security risks, ensure the stable operation and information security of the power grid system, and reduce the risks of power outages or system failures caused by network security issues.

[0082] It provides an effective management tool for network managers. Based on the method of this application, managers can clearly understand the status and weight of each path in the network, which helps to reasonably allocate network resources and optimize network configuration. For example, for normal paths with higher weights, their bandwidth and performance can be ensured, and abnormal paths can be quickly located and processed, thereby improving the management efficiency and performance of the entire power grid network.

[0083] The above are some specific implementations of the anomaly detection method provided in the embodiments of the present application. Based on this, the present application also provides a corresponding anomaly detection system. The system provided in the embodiments of the present application will be introduced below from the perspective of functional modularization. Figure 4 A structural diagram of an anomaly detection system provided in an embodiment of the present application.

[0084] The system comprises:

[0085] An acquisition unit 110 is used to acquire a network topology map, where the network topology map is used to represent a plurality of network nodes and a connection relationship between the network nodes;

[0086] A first determining unit 111, configured to determine an access path in the network topology map and a weight corresponding to each access path based on traffic information and the network topology map;

[0087] A second determining unit 112, configured to determine an abnormality detection value based on the weight and bandwidth of the access path;

[0088] The third determining unit 113 is used to determine whether an abnormal event exists based on the magnitude relationship between the abnormal detection value and a preset threshold.

[0089] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.

[0090] The device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the method described in any embodiment of the present application.

[0091] The computer storage medium stores codes, and when the codes are executed, a device executing the codes implements the method described in any embodiment of the present application.

[0092] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0093] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0094] It should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.

[0095] It should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0096] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0097] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0098] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An anomaly detection method, characterized in that: include: Obtaining a network topology map, wherein the network topology map is used to represent a plurality of network nodes and a connection relationship between each network node; Based on the traffic information and the network topology map, determine the access paths in the network topology map and the weight corresponding to each access path; Determining an anomaly detection value based on the weight and bandwidth of the access path; Based on the magnitude relationship between the abnormal detection value and a preset threshold, it is determined whether an abnormal event occurs.

2. The method according to claim 1, characterized in that The method for determining the weight corresponding to each access path includes: For each access path, the number of network nodes included in the access path is obtained, and the number of network nodes included in the access path is used as the weight corresponding to the access path.

3. The method according to claim 1, characterized in that The determining of the abnormality detection value based on the weight and bandwidth of the access path includes: The weight of each access path in the network topology graph is summed up as the sum of probabilistic connectivity; For each access path, the ratio of the weight corresponding to the access path to the sum of the probability connectivity is used as the probability value of the access path; For each access path, an anomaly detection value is calculated based on the probability value and bandwidth of the access path.

4. The method according to claim 3, characterized in that The calculation method of the abnormal detection value includes: r=1 / (W*W*bandwidth), where r is the anomaly detection value, W is the probability value of the access path, and bandwidth is the bandwidth.

5. The method according to claim 1, characterized in that: The determining whether there is an abnormal event based on the magnitude relationship between the abnormal detection value and the preset threshold value includes: When the abnormal detection value is not less than a preset threshold, the corresponding access path is added to the abnormal event list; An exception reason is generated based on the network nodes included in the access path.

6. The method according to claim 1, characterized in that The method for determining the access path in the network topology diagram includes: Based on the connection relationship between each network node represented by the network topology diagram, and the real-time traffic data and traffic flow direction information between each network node represented by the traffic information, the access path in the network topology diagram is determined.

7. An anomaly detection system, characterized in that: include: An acquisition unit, used to acquire a network topology map, wherein the network topology map is used to represent a plurality of network nodes and a connection relationship between each network node; A first determining unit, configured to determine an access path in the network topology map and a weight corresponding to each access path based on traffic information and the network topology map; A second determining unit, configured to determine an abnormality detection value based on the weight and bandwidth of the access path; The third determination unit is used to determine whether an abnormal event exists based on the magnitude relationship between the abnormal detection value and a preset threshold.

8. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the anomaly detection method according to any one of claims 1 to 6 is implemented.

9. A computer program product, characterized in that When the computer program product runs on a computer, the computer executes the anomaly detection method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device executes the anomaly detection method according to any one of claims 1 to 6.

Images