Traffic identification method and device, computing equipment and storage medium

Abstract

The invention provides a traffic identification method and device, computing equipment and a storage medium, and the method comprises the steps: analyzing a to-be-identified traffic into at least one piece of sub-traffic for any to-be-identified traffic; judging a traffic type corresponding to each piece of sub-traffic in the at least one piece of sub-traffic; if the traffic type corresponding to at least one piece of sub-traffic is an abnormal type, determining that the to-be-identified traffic is illegal traffic; if only one piece of sub-traffic exists and the traffic type of the sub-traffic is a normal type, determining that the traffic to be identified is legal traffic; and otherwise, determining that the to-be-identified traffic is suspected traffic. According to the scheme, the accuracy of traffic identification can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a flow identification method, apparatus, computing device and storage medium. Background Art

[0002] In the field of network security technology, it is often necessary to identify and filter the traffic to be identified that is collected manually or by scripts, and to perform business processing after obtaining the legitimate traffic.

[0003] Many to-be-identified traffic may include both legitimate traffic and illegitimate traffic. Existing technologies often have a low recognition rate for this type of to-be-identified traffic.

[0004] So, how to improve the accuracy of traffic identification remains to be solved. Summary of the invention

[0005] The present application provides a flow identification method, apparatus, computing device and storage medium, which can improve the accuracy of flow identification.

[0006] In a first aspect, an embodiment of the present application provides a traffic identification method, which can be executed by a traffic identification device, which can be a terminal device or a module for a terminal device, or a server or a module for a server. The present application does not limit the execution subject of the method. The method includes: for any traffic to be identified, parsing the traffic to be identified into at least one sub-flow; determining the traffic type corresponding to each sub-flow in the at least one sub-flow; if there is at least one sub-flow corresponding to an abnormal type of traffic type, determining that the traffic to be identified is illegal traffic; if there is only one sub-flow and the traffic type of the sub-flow is a normal type, determining that the traffic to be identified is legal traffic; otherwise, determining that the traffic to be identified is suspected traffic.

[0007] The above solution parses the traffic to be identified into at least one sub-flow, and can accurately and effectively determine the type of the traffic to be identified according to the traffic type of each sub-flow.

[0008] In one possible implementation method, for any one of the at least one sub-flows, based on normal traffic judgment rules and / or a whitelist list, it is determined whether the traffic type corresponding to the sub-flow is a normal type; based on abnormal traffic judgment rules and / or a blacklist list, it is determined whether the traffic type corresponding to the sub-flow is an abnormal type.

[0009] The above solution can accurately and effectively determine the traffic type corresponding to the sub-flow.

[0010] In a possible implementation method, the prompt word corresponding to the first largest language model is determined according to the normal traffic judgment rules, the abnormal traffic judgment rules and the black and white list; the at least one sub-flow is respectively input into the first largest language model, and the traffic type corresponding to each sub-flow is determined by the prompt word corresponding to the first largest language model.

[0011] The above solution, by utilizing the generalization ability and semantic understanding ability of the large language model, can accurately and effectively determine the traffic type corresponding to each sub-flow.

[0012] In a possible implementation method, according to normal traffic judgment rules and / or a whitelist, the prompt word corresponding to the second largest language model is determined; the at least one sub-flow is respectively input into the second largest language model, and the prompt word corresponding to the second largest language model is used to judge whether the traffic type corresponding to each sub-flow is a normal type; according to normal traffic judgment rules and / or a whitelist, the prompt word corresponding to the third largest language model is determined; the at least one sub-flow is respectively input into the third largest language model, and the prompt word corresponding to the third largest language model is used to judge whether the traffic type corresponding to each sub-flow is an abnormal type.

[0013] The above solution enhances the generalization ability of the large language model by combining multiple large language models, and a single large language model is responsible for the recognition of a single traffic type, with higher recognition accuracy; the second largest language model and the third largest language model can be executed in parallel, which improves recognition efficiency.

[0014] In a possible implementation method, the prompt word corresponding to the second largest language model includes: judging whether the traffic type corresponding to any sub-flow is a normal type according to the normal traffic judgment rule; if the traffic type corresponding to the sub-flow is not a normal type, judging whether the sub-flow after deduplication is in the white list; if the sub-flow after deduplication is in the white list, determining that the traffic type corresponding to the sub-flow is a normal type; otherwise, determining that the traffic type corresponding to the sub-flow is a suspected type; outputting the traffic type corresponding to each sub-flow;

[0015] The prompt words corresponding to the third largest language model include: judging whether the traffic type corresponding to any sub-flow is an abnormal type according to the abnormal traffic judgment rule; if the traffic type corresponding to the sub-flow is not an abnormal type, judging whether the deduplicated sub-flow is in the blacklist; if the deduplicated sub-flow is in the blacklist, determining that the traffic type corresponding to the sub-flow is an abnormal type; otherwise, determining that the traffic type corresponding to the sub-flow is a suspected type; and outputting the traffic type corresponding to each sub-flow.

[0016] The above scheme can improve the reasoning ability and accuracy of the model according to the prompt words, thereby accurately and effectively determining the traffic type corresponding to each sub-flow.

[0017] In a possible implementation method, the traffic type corresponding to each sub-flow is input into the fourth largest language model, and the proportion corresponding to each traffic type is determined according to the prompt word of the fourth largest language model; if the proportion of the sub-flow corresponding to the abnormal type is greater than 0, the traffic to be identified is determined to be illegal traffic; if the proportion of the sub-flow corresponding to the normal type is 1, the traffic to be identified is determined to be legal traffic; otherwise, the traffic to be identified is determined to be suspected traffic.

[0018] The above solution, using the semantic understanding and reasoning capabilities of a large language model, can accurately and effectively determine the type of traffic to be identified.

[0019] In a possible implementation method, the prompt words of the fourth language model include: determining the proportion of sub-flows corresponding to each traffic type according to a traffic type proportion calculation rule; and returning the proportion of sub-flows corresponding to each traffic type.

[0020] The above scheme can improve the reasoning ability and accuracy of the model according to the prompt words, thereby accurately and effectively determining the type of traffic to be identified.

[0021] In a possible implementation method, the proportion of sub-traffic corresponding to each traffic type is input into a fifth language model, and the fifth language model is used to determine a processing method for the traffic to be identified.

[0022] The above solution utilizes the semantic understanding and reasoning capabilities of a large language model to accurately and effectively determine the processing method for the traffic to be identified.

[0023] In one possible implementation method, if the traffic to be identified is legal traffic, business processing is performed on the traffic to be identified; if the traffic to be identified is illegal traffic, the traffic to be identified is intercepted; if the traffic to be identified is suspected traffic, business processing is performed on any normal type of sub-traffic in the traffic to be identified, any abnormal type of sub-traffic in the traffic to be identified is intercepted, and any suspected type of sub-traffic in the traffic to be identified is corrected.

[0024] The above scheme can process the sub-flows with normal traffic types, thus improving data utilization. That is, even if the type of traffic to be identified is suspected traffic, the normal sub-flows or suspected sub-flows contained in the traffic to be identified can be applied to actual business after processing, instead of blindly intercepting.

[0025] In a possible implementation method, based on the traffic to be identified and the identification result of the traffic to be identified, one or more of the following are iteratively updated: a large language model, a normal traffic judgment rule, an abnormal traffic judgment rule, or a black and white list.

[0026] The above solution implements automatic iterative updates based on historically identified illegal and legal traffic, greatly improving the generalization and automation rates of judgment rules. It also reduces manual maintenance costs on scripts and blacklists and whitelists, and avoids illegal and malicious traffic from being filtered out in a timely manner, greatly improving the real-time, convenience, and scalability of the cleaning rules.

[0027] In a second aspect, an embodiment of the present application provides a flow identification device, comprising: a parsing unit and a determination unit. The parsing unit is used to parse any flow to be identified into at least one sub-flow; the determination unit is used to determine the flow type corresponding to each sub-flow in the at least one sub-flow; if there is at least one sub-flow whose corresponding flow type is an abnormal type, the flow to be identified is determined to be illegal flow; if there is only one sub-flow and the flow type of the sub-flow is a normal type, the flow to be identified is determined to be legal flow; otherwise, the flow to be identified is determined to be suspected flow.

[0028] In a possible implementation method, the determination unit is specifically used to determine, for any one of the at least one sub-flows, whether the traffic type corresponding to the sub-flow is a normal type based on normal traffic judgment rules and / or a whitelist list; and to determine, based on abnormal traffic judgment rules and / or a blacklist list, whether the traffic type corresponding to the sub-flow is an abnormal type.

[0029] In a possible implementation method, the determination unit is specifically used to determine the prompt word corresponding to the first largest language model according to normal traffic judgment rules, abnormal traffic judgment rules and a black and white list; input the at least one sub-flow into the first largest language model respectively, and determine the traffic type corresponding to each sub-flow through the prompt word corresponding to the first largest language model.

[0030] In a possible implementation method, the determination unit is specifically used to determine the prompt word corresponding to the second largest language model according to the normal traffic judgment rule and / or the white list; input the at least one sub-flow into the second largest language model respectively, and judge whether the traffic type corresponding to each sub-flow is a normal type through the prompt word corresponding to the second largest language model; determine the prompt word corresponding to the third largest language model according to the normal traffic judgment rule and / or the white list; input the at least one sub-flow into the third largest language model respectively, and judge whether the traffic type corresponding to each sub-flow is a normal type through the prompt word corresponding to the third largest language model.

[0031] In a possible implementation method, the prompt word corresponding to the second largest language model includes: judging whether the traffic type corresponding to any sub-flow is a normal type according to the normal traffic judgment rule; if the traffic type corresponding to the sub-flow is not a normal type, judging whether the sub-flow after deduplication is in the white list; if the sub-flow after deduplication is in the white list, determining that the traffic type corresponding to the sub-flow is a normal type; otherwise, determining that the traffic type corresponding to the sub-flow is a suspected type; outputting the traffic type corresponding to each sub-flow;

[0032] The prompt words corresponding to the third largest language model include: judging whether the traffic type corresponding to any sub-flow is an abnormal type according to the abnormal traffic judgment rule; if the traffic type corresponding to the sub-flow is not an abnormal type, judging whether the deduplicated sub-flow is in the blacklist; if the deduplicated sub-flow is in the blacklist, determining that the traffic type corresponding to the sub-flow is an abnormal type; otherwise, determining that the traffic type corresponding to the sub-flow is a suspected type; and outputting the traffic type corresponding to each sub-flow.

[0033] In a possible implementation method, the determination unit is also used to input the traffic type corresponding to each sub-flow into a fourth language model, and determine the proportion corresponding to each traffic type according to the prompt word of the fourth language model; if the proportion of the sub-flow corresponding to the abnormal type is greater than 0, the traffic to be identified is determined to be illegal traffic; if the proportion of the sub-flow corresponding to the normal type is 1, the traffic to be identified is determined to be legal traffic; otherwise, the traffic to be identified is determined to be suspected traffic.

[0034] In a possible implementation method, the prompt words of the fourth language model include: determining the proportion of sub-flows corresponding to each traffic type according to a traffic type proportion calculation rule; and returning the proportion of sub-flows corresponding to each traffic type.

[0035] In a possible implementation method, the determination unit is further used to input the proportion of sub-traffic corresponding to each traffic type into a fifth language model, and determine a processing method for the traffic to be identified through the fifth language model.

[0036] In a possible implementation method, the determination unit is specifically used to perform business processing on the traffic to be identified if the traffic to be identified is legal traffic; intercept the traffic to be identified if the traffic to be identified is illegal traffic; if the traffic to be identified is suspected traffic, perform business processing on any normal type of sub-traffic in the traffic to be identified, intercept any abnormal type of sub-traffic in the traffic to be identified, and correct any suspected type of sub-traffic in the traffic to be identified.

[0037] In a possible implementation method, the above-mentioned device also includes an updating unit, which is used to iteratively update one or more of the following according to the traffic to be identified and the identification result of the traffic to be identified: a large language model, normal traffic judgment rules, abnormal traffic judgment rules or a black and white list.

[0038] In a third aspect, an embodiment of the present application further provides a computing device, including:

[0039] A memory for storing program instructions;

[0040] The processor is used to call the program instructions stored in the memory, and execute any method of implementing the above-mentioned first aspect according to the obtained program instructions.

[0041] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, in which computer-readable instructions are stored. When a computer reads and executes the computer-readable instructions, any method of the above-mentioned first aspect is implemented.

[0042] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program executable by a computer device, wherein when the program is run on the computer device, the computer device executes any method for implementing the above-mentioned first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A flow chart of a flow identification method provided in an embodiment of the present application;

[0044] Figure 2 A flow chart of a flow identification method provided in an embodiment of the present application;

[0045] Figure 3 A flow chart of a flow identification method provided in an embodiment of the present application;

[0046] Figure 4 A flow chart of a flow identification method provided in an embodiment of the present application;

[0047] Figure 5 A flow chart of a flow identification method provided in an embodiment of the present application;

[0048] Figure 6 A schematic diagram of the structure of a flow identification device provided in an embodiment of the present application;

[0049] Figure 7 A schematic diagram of the structure of a flow identification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] Figure 1 A flow chart of a flow identification method provided in an embodiment of the present application, the method can be executed by a flow identification device, the flow identification device can be a terminal device or a module for a terminal device, or a server or a module for a server. The present application does not limit the execution subject of the method.

[0051] The method comprises the following steps:

[0052] Step 101: for any traffic to be identified, parse the traffic to be identified into at least one sub-traffic.

[0053] Optionally, the traffic to be identified refers to internal private application programming interface (Application Programming Interface, API) traffic intercepted by a WAF (Web Application Firewall) or a gateway.

[0054] In a possible implementation method, the traffic to be identified is parsed into at least one sub-traffic according to a regular expression method or a character matching method.

[0055] In another possible implementation method, the traffic to be identified is parsed into at least one sub-traffic according to the large language model. The characters constituting any sub-traffic do not necessarily exist continuously in the traffic to be identified. For example, the traffic to be identified is http: / / **** / index.php / ccm50539478'%20or%204591%3d4591--%20 / assets / localization / moment / js, and the traffic to be identified is parsed into "http: / / **** / index.php / assets / localization / moment / js and "http: / / **** / index.php". It can be seen that "http: / / **** / index.php" is a subset of the traffic to be identified, but "http: / / **** / index.php / assets / localization / moment / js" is the concatenation of "http: / / **** / index.php" and " / assets / localization / moment / js" in the traffic to be identified, and "http: / / **** / index.php" is not followed by " / ccm50539478'%20or%204591%3d4591--%20 / ". This application does not limit the parsing method.

[0056] Step 102: Determine the flow type corresponding to each sub-flow in the at least one sub-flow.

[0057] Step 103, if there is at least one sub-flow corresponding to an abnormal traffic type, the traffic to be identified is determined to be illegal traffic; if there is only one sub-flow and the traffic type of the sub-flow is a normal type, the traffic to be identified is determined to be legal traffic; otherwise, the traffic to be identified is determined to be suspected traffic.

[0058] In one possible implementation method, if the traffic to be identified is legal traffic, then business processing is performed on the traffic to be identified; if the traffic to be identified is illegal traffic, then the traffic to be identified is intercepted; if the traffic to be identified is suspected traffic, then business processing is performed on any normal type of sub-traffic in the traffic to be identified, any abnormal type of sub-traffic in the traffic to be identified is intercepted, and any suspected type of sub-traffic in the traffic to be identified is corrected. This solution can perform business processing on sub-traffic with normal traffic type, thereby improving data utilization. That is, even if the type of the traffic to be identified is suspected traffic, the normal type of sub-traffic or suspected type of sub-traffic contained in the traffic to be identified can be applied to actual business after processing, rather than simply intercepting it.

[0059] In one possible implementation method, if the traffic to be identified is illegal traffic, business processing is performed on any normal type of sub-traffic in the traffic to be identified; any abnormal type of sub-traffic in the traffic to be identified is intercepted, and any suspected type of sub-traffic in the traffic to be identified is corrected.

[0060] The above solution parses the traffic to be identified into at least one sub-flow, and can accurately and effectively determine the type of the traffic to be identified according to the traffic type of each sub-flow.

[0061] In one embodiment, the above step 102 determines the flow type corresponding to each sub-flow in the at least one sub-flow. Figure 2 As shown, the following steps are included:

[0062] Step 201: for any sub-flow of the at least one sub-flow, determine whether the traffic type corresponding to the sub-flow is a normal type according to a normal traffic judgment rule and / or a whitelist.

[0063] In a possible implementation method, the normal traffic judgment rule is that only English letters (a-zA-Z), numbers (0-9) and -_.~4 special characters are allowed in the traffic. If any sub-flow only contains English letters (a-zA-Z) and / or numbers (0-9) and / or -_.~4 special characters, the traffic type corresponding to the sub-flow is determined to be a normal type.

[0064] In a possible implementation method, a plurality of legitimate traffic examples are recorded in a whitelist list. If any sub-traffic is in the whitelist list, or the similarity between any sub-traffic and a plurality of legitimate traffic examples recorded in the whitelist list is greater than a first threshold, then the traffic type corresponding to the sub-traffic is determined to be a normal type.

[0065] Step 202: determine whether the traffic type corresponding to the sub-flow is an abnormal type according to the abnormal traffic judgment rule and / or the blacklist.

[0066] In a possible implementation method, the abnormal traffic judgment rule is that the traffic contains spaces and double-byte characters (such as Chinese characters). If any sub-flow contains spaces and / or double-byte characters (such as Chinese characters), the traffic type corresponding to the sub-flow is determined to be an abnormal type.

[0067] In a possible implementation method, a plurality of illegal traffic examples are recorded in the blacklist. If any sub-traffic is in the blacklist, or the similarity between any sub-traffic and the plurality of illegal traffic examples recorded in the blacklist is greater than a second threshold, then the traffic type corresponding to the sub-traffic is determined to be an abnormal type.

[0068] In a possible implementation method, if the traffic type corresponding to any sub-flow is neither a normal type nor an abnormal type, it is determined that the traffic type corresponding to the sub-flow is a suspected type.

[0069] The above solution can accurately and effectively determine the traffic type corresponding to the sub-flow.

[0070] In another embodiment, the above step 102 determines the flow type corresponding to each sub-flow in the at least one sub-flow. Figure 3 As shown, the following steps are included:

[0071] Step 301, determining the prompt word corresponding to the first language model according to the normal traffic judgment rule, the abnormal traffic judgment rule or the black and white list.

[0072] In a possible implementation method, the prompt word corresponding to the first language model includes: judging whether the traffic type corresponding to any sub-flow is a normal type according to the normal traffic judgment rule; if the traffic type corresponding to the sub-flow is not a normal type, judging whether the sub-flow after deduplication is in the white list; if the sub-flow after deduplication is in the white list, determining that the traffic type corresponding to the sub-flow is a normal type; otherwise, judging whether the traffic type corresponding to the sub-flow is an abnormal type according to the abnormal traffic judgment rule; if the traffic type corresponding to the sub-flow is not an abnormal type, judging whether the sub-flow after deduplication is in the black list; if the sub-flow after deduplication is in the black list, determining that the traffic type corresponding to the sub-flow is an abnormal type; otherwise, determining that the traffic type corresponding to the sub-flow is a suspected type; outputting the traffic type corresponding to each sub-flow. Of course, it is also possible to first judge whether the traffic type corresponding to the sub-flow is an abnormal type, and then judge whether the traffic type corresponding to the sub-flow is a normal type. This application does not limit this, and this application does not limit the specific content of the prompt word corresponding to the first language model.

[0073] Step 302: input the at least one sub-flow into the first large language model respectively, and determine the flow type corresponding to each sub-flow through the prompt word corresponding to the first large language model.

[0074] In a possible implementation method, the first large language model can not only determine the traffic type corresponding to each sub-flow, but also complete the analysis of the traffic to be identified. That is, step 302 can be to input the traffic to be identified into the first large language model, analyze the traffic to be identified into at least one sub-flow through the prompt word corresponding to the first large language model, and determine the traffic type corresponding to each sub-flow.

[0075] The above solution, by utilizing the generalization ability and semantic understanding ability of the large language model, can accurately and effectively determine the traffic type corresponding to each sub-flow.

[0076] In another embodiment, the above step 102 determines the flow type corresponding to each sub-flow in the at least one sub-flow. Figure 4 As shown, the following steps are included:

[0077] Step 401: Determine the prompt word corresponding to the second largest language model according to the normal traffic judgment rule and / or the white list.

[0078] In a possible implementation method, the prompt word corresponding to the second largest language model includes: judging whether the traffic type corresponding to any sub-flow is a normal type according to the normal traffic judgment rule; if the traffic type corresponding to the sub-flow is not a normal type, judging whether the sub-flow after deduplication is in the white list; if the sub-flow after deduplication is in the white list, determining that the traffic type corresponding to the sub-flow is a normal type; otherwise, determining that the traffic type corresponding to the sub-flow is a suspected type; outputting the traffic type corresponding to each sub-flow. This application does not limit the specific content of the prompt word corresponding to the second largest language model.

[0079] Step 402: input the at least one sub-flow into the second largest language model respectively, and determine whether the flow type corresponding to each sub-flow is a normal type through the prompt word corresponding to the second largest language model.

[0080] Step 403: Determine the prompt word corresponding to the third largest language model according to the normal traffic judgment rule and / or the whitelist.

[0081] In a possible implementation method, the prompt word corresponding to the third largest language model includes: judging whether the traffic type corresponding to any sub-flow is an abnormal type according to the abnormal traffic judgment rule; if the traffic type corresponding to the sub-flow is not an abnormal type, judging whether the sub-flow after deduplication is in the blacklist; if the sub-flow after deduplication is in the blacklist, determining that the traffic type corresponding to the sub-flow is an abnormal type; otherwise, determining that the traffic type corresponding to the sub-flow is a suspected type; outputting the traffic type corresponding to each sub-flow. This application does not limit the specific content of the prompt word corresponding to the third largest language model.

[0082] Step 404: input the at least one sub-flow into the third largest language model respectively, and determine whether the flow type corresponding to each sub-flow is an abnormal type through the prompt word corresponding to the third largest language model.

[0083] In the above steps 401 to 404, the second largest language model and the third largest language model can determine the traffic type corresponding to each sub-flow in parallel. Of course, after step 402, it is also possible to determine that the traffic type corresponding to the sub-flow is not a normal type, and then determine whether the sub-flow is an abnormal type. Of course, it is also possible to first determine whether the traffic type corresponding to the sub-flow is an abnormal type, and if it is not an abnormal type, then determine whether the traffic type corresponding to the sub-flow is a normal type.

[0084] The above solution enhances the generalization ability of the large language model by combining multiple large language models, and a single large language model is responsible for the recognition of a single traffic type, with higher recognition accuracy; the second largest language model and the third largest language model can be executed in parallel, which improves recognition efficiency.

[0085] In one embodiment, after obtaining the traffic type corresponding to each sub-flow, the following step is also included. Figure 5 shown.

[0086] Step 501: input the traffic type corresponding to each sub-traffic into the fourth language model, and determine the proportion corresponding to each traffic type according to the prompt words of the fourth language model.

[0087] In a possible implementation method, the prompt words of the fourth language model include: determining the proportion of sub-flows corresponding to each traffic type according to a traffic type proportion calculation rule; and returning the proportion of sub-flows corresponding to each traffic type.

[0088] In a possible implementation method, the traffic type ratio calculation rule is as follows:

[0089] The calculation formula for the proportion of sub-flows corresponding to the normal type is: normal type flow number / (normal type flow number + abnormal type flow number + suspected type flow number);

[0090] The calculation formula for the proportion of sub-flows corresponding to abnormal types is: number of abnormal type flows / (number of normal type flows + number of abnormal type flows + number of suspected type flows);

[0091] The calculation formula for the proportion of sub-flows corresponding to the suspected type is: suspected type flow number / (normal type flow number + abnormal type flow number + suspected type flow number).

[0092] Step 502, if the proportion of sub-flows corresponding to abnormal types is greater than 0, the traffic to be identified is determined to be illegal traffic; if the proportion of sub-flows corresponding to normal types is 1, the traffic to be identified is determined to be legal traffic; otherwise, the traffic to be identified is determined to be suspected traffic.

[0093] In a possible implementation method, the proportion of sub-traffic corresponding to each traffic type is input into a fifth language model, and the fifth language model is used to determine a processing method for the traffic to be identified.

[0094] In a possible implementation method, the prompt words corresponding to the fifth language model include: As a traffic auxiliary analysis assistant, you have a set of analysis rules: first, analyze the probability that the traffic to be identified is legal traffic by the proportion of sub-traffic corresponding to each traffic type, and then analyze the result of matching the blacklist to see whether there are illegal characters, and finally obtain the final legal value. The rules are as follows: when the value is 1, it indicates that the traffic to be identified is legal traffic, and the traffic to be identified is released; when the value is 0, it indicates that the traffic to be identified is illegal traffic, and the traffic to be identified is intercepted; when the value is 2, it indicates that the traffic to be identified is suspected traffic, and an alarm is issued to the traffic to be identified and the abnormal reason for the analysis is given.

[0095] In a possible implementation method, based on the traffic to be identified and the identification result of the traffic to be identified, one or more of the following are iteratively updated: large language model, normal traffic judgment rules, abnormal traffic judgment rules, or black and white lists. This solution implements automatic iterative updates based on historically identified illegal and legal traffic, greatly improving the generalization rate and automation rate of judgment rules, while reducing the manual maintenance costs on scripts and black and white lists, avoiding illegal and malicious traffic from being filtered out in a timely manner, and greatly improving the real-time, convenience, and scalability of cleaning rules.

[0096] In one possible implementation method, after the large language model is deployed, it is used through interfaces or web page access to automatically clean API traffic and perform iterative updates. The generalization and reasoning capabilities of the model are enhanced by training, updating, and iterating single models and multi-model channels. A single model refers to the use of a single large language model to complete the judgment of the type of traffic to be identified, and a multi-model channel refers to the use of a single large language model to complete the judgment of the type of traffic to be identified.

[0097] The following are several specific examples to illustrate how this application determines the type of traffic to be identified.

[0098] Example 1: Illegal traffic includes normal sub-traffic types and abnormal sub-traffic types.

[0099] Traffic to be identified:

[0100] http: / / **** / index.php / ccm50539478'%20or%204591%3d4591--%20 / assets / localization / moment / js.

[0101] After parsing, the types of sub-traffic are determined as follows:

[0102] {

[0103] "Normal sub-traffic type":[

[0104] "http: / / **** / index.php / assets / localization / moment / js",

[0105] "http: / / **** / index.php"

[0106] ],

[0107] "Abnormal sub-traffic type":[

[0108] http: / / **** / index.php / ccm50539478'%20or%204591%3d4591--%20 / assets / localization / moment / js

[0109] ],

[0110] "Suspected sub-traffic type":[]

[0111] }

[0112] It is further determined that the proportion of sub-flows corresponding to the normal type is 2 / 3; the proportion of sub-flows corresponding to the abnormal type is 1 / 3; and the proportion of sub-flows corresponding to the suspected type is 0.

[0113] Through the analysis of the fifth language model, it can be obtained that there are two normal flows in one flow, which does not conform to the one-to-one correspondence between flows. At the same time, it contains one illegal flow, which can be judged as illegal flow and needs to be intercepted, so the legal value returned is 0.

[0114] Example 2: Suspicious traffic.

[0115] Traffic to be identified:

[0116] https: / / :80 / http[f1-ab-cd.test.****.comhttpl:80 / .

[0117] After parsing, the types of sub-traffic are determined as follows:

[0118] {

[0119] "Normal sub-traffic type":[

[0120] "http: / / f1-ab-cd.test.****.com",

[0121] https: / / f1-ab-cd.test.****.com

[0122] ],

[0123] "Abnormal sub-traffic type":[],

[0124] "Suspected sub-traffic type": [https: / / :80 / http[f1-ab-cd.test.****.comhttpl:80 / ]

[0126] }

[0127] It is further determined that the proportion of sub-flows corresponding to the normal type is 2 / 3; the proportion of sub-flows corresponding to the abnormal type is 0; and the proportion of sub-flows corresponding to the suspected type is 1 / 3.

[0128] Through the analysis of the fifth language model, it can be obtained that there are two normal flows in one flow, which does not conform to the one-to-one correspondence between flows. At the same time, it contains a suspected abnormal flow, which can be judged as legal flow but has related wrong characters or symbols, and an alarm needs to be issued, so the legal value returned is 2.

[0129] Example 3: Abnormal sub-traffic exists in legitimate traffic.

[0130] Traffic to be identified:

[0131] https: / / f1-ab-cd.test.****.com:80? url=http: / / f1-ab-cd.test / ccm50539478'%20or%204591%3d4591--%20.com.

[0132] After parsing, the sub-flow types are determined as follows:

[0133] {

[0134] "Normal sub-traffic type":[

[0135] "https: / / f1-ab-cd.test.****.com:80",

[0136] ],

[0137] "Abnormal sub-traffic type":[

[0138] http: / / f1-ab-cd.test / ccm50539478'%20or%204591%3d4591--%20.com

[0139] ],

[0140] "Suspected sub-traffic type":[]

[0141] }

[0142] It is further determined that the proportion of sub-flows corresponding to the normal type is 1 / 2; the proportion of sub-flows corresponding to the abnormal type is 1 / 2; and the proportion of sub-flows corresponding to the suspected type is 0.

[0143] Through the analysis of the fifth language model, it can be obtained that the traffic conforms to the one-to-one correspondence, and there is an illegal traffic rate. It can be judged as illegal traffic and needs to be intercepted, so the legal value returned is 0.

[0144] Based on the same technical concept, Figure 6 A flow identification device 600 provided in an embodiment of the present application is exemplarily shown. Figure 6 As shown, it includes: a parsing unit 601 and a determining unit 602. The parsing unit 601 is used to parse any to-be-identified traffic into at least one sub-flow; the determining unit 602 is used to determine the traffic type corresponding to each sub-flow in the at least one sub-flow; if there is at least one sub-flow corresponding to an abnormal traffic type, the to-be-identified traffic is determined to be illegal traffic; if there is only one sub-flow and the traffic type of the sub-flow is a normal type, the to-be-identified traffic is determined to be legal traffic; otherwise, the to-be-identified traffic is determined to be suspected traffic.

[0145] In a possible implementation method, the determination unit 602 is specifically used to determine, for any one of the at least one sub-flows, whether the traffic type corresponding to the sub-flow is a normal type based on normal traffic judgment rules and / or a whitelist list; and to determine, based on abnormal traffic judgment rules and / or a blacklist list, whether the traffic type corresponding to the sub-flow is an abnormal type.

[0146] In a possible implementation method, the determination unit 602 is specifically used to determine the prompt word corresponding to the first largest language model according to the normal traffic judgment rule, the abnormal traffic judgment rule and the black and white list; input the at least one sub-flow into the first largest language model respectively, and determine the traffic type corresponding to each sub-flow through the prompt word corresponding to the first largest language model.

[0147] In a possible implementation method, the determination unit 602 is specifically used to determine the prompt word corresponding to the second largest language model according to the normal traffic judgment rule and / or the white list; input the at least one sub-flow into the second largest language model respectively, and judge whether the traffic type corresponding to each sub-flow is a normal type through the prompt word corresponding to the second largest language model; determine the prompt word corresponding to the third largest language model according to the normal traffic judgment rule and / or the white list; input the at least one sub-flow into the third largest language model respectively, and judge whether the traffic type corresponding to each sub-flow is the above scheme through the prompt word corresponding to the third largest language model.

[0148] In a possible implementation method, the prompt word corresponding to the second largest language model includes: judging whether the traffic type corresponding to any sub-flow is a normal type according to the normal traffic judgment rule; if the traffic type corresponding to the sub-flow is not a normal type, judging whether the sub-flow after deduplication is in the white list; if the sub-flow after deduplication is in the white list, determining that the traffic type corresponding to the sub-flow is a normal type; otherwise, determining that the traffic type corresponding to the sub-flow is a suspected type; outputting the traffic type corresponding to each sub-flow;

[0149] The prompt words corresponding to the third largest language model include: judging whether the traffic type corresponding to any sub-flow is an abnormal type according to the abnormal traffic judgment rule; if the traffic type corresponding to the sub-flow is not an abnormal type, judging whether the deduplicated sub-flow is in the blacklist; if the deduplicated sub-flow is in the blacklist, determining that the traffic type corresponding to the sub-flow is an abnormal type; otherwise, determining that the traffic type corresponding to the sub-flow is a suspected type; and outputting the traffic type corresponding to each sub-flow.

[0150] In a possible implementation method, the determination unit 602 is also used to input the traffic type corresponding to each sub-flow into the fourth largest language model, and determine the proportion corresponding to each traffic type according to the prompt word of the fourth largest language model; if the proportion of the sub-flow corresponding to the abnormal type is greater than 0, the traffic to be identified is determined to be illegal traffic; if the proportion of the sub-flow corresponding to the normal type is 1, the traffic to be identified is determined to be legal traffic; otherwise, the traffic to be identified is determined to be suspected traffic.

[0151] In a possible implementation method, the prompt words of the fourth language model include: determining the proportion of sub-flows corresponding to each traffic type according to a traffic type proportion calculation rule; and returning the proportion of sub-flows corresponding to each traffic type.

[0152] In a possible implementation method, the determination unit 602 is further used to input the proportion of sub-traffic corresponding to each traffic type into the fifth largest language model, and determine the processing method of the traffic to be identified through the fifth largest language model.

[0153] In one possible implementation method, the determination unit 602 is specifically used to perform business processing on the traffic to be identified if it is legal traffic; intercept the traffic to be identified if it is illegal traffic; if the traffic to be identified is suspected traffic, perform business processing on any normal type of sub-traffic in the traffic to be identified, intercept any abnormal type of sub-traffic in the traffic to be identified, and correct any suspected type of sub-traffic in the traffic to be identified.

[0154] In a possible implementation method, the above-mentioned device also includes an updating unit 603, and the updating unit 603 is used to iteratively update one or more of the following according to the traffic to be identified and the identification result of the traffic to be identified: a large language model, normal traffic judgment rules, abnormal traffic judgment rules or a black and white list.

[0155] Based on the same technical concept, the embodiment of the present application provides a flow identification device 700, which can be a computing device, for example. Figure 7 As shown, a flow identification device 700 includes at least one processor 701 and a memory 702 connected to the at least one processor. The specific connection medium between the processor 701 and the memory 702 is not limited in the embodiment of the present application. Figure 7 For example, the processor 701 and the memory 702 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0156] In the embodiment of the present application, the memory 702 stores instructions that can be executed by at least one processor 701, and the at least one processor 701 can execute the above-mentioned traffic identification method by executing the instructions stored in the memory 702.

[0157] Among them, the processor 701 is a control center of the traffic identification device 700, which can use various interfaces and lines to connect various parts of the computer equipment, and perform resource settings by running or executing instructions stored in the memory 702 and calling data stored in the memory 702. Optionally, the processor 701 may include one or more determination units, and the processor 701 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 701. In some embodiments, the processor 701 and the memory 702 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0158] Processor 701 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0159] The memory 702 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 702 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 702 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 702 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0160] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer-executable program. The computer-executable program is used to enable a computer to execute a traffic identification method listed in any of the above methods.

[0161] An embodiment of the present application provides a computer program product, including a computer program executable by a computer device. When the program is run on the computer device, the computer device executes a traffic identification method listed in any of the above-mentioned ways.

[0162] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0163] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0164] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0165] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0166] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A flow identification method, characterized in that: include: For any flow to be identified, the flow to be identified is parsed into at least one sub-flow; Determine the flow type corresponding to each sub-flow in the at least one sub-flow; If the traffic type corresponding to at least one sub-flow is an abnormal type, the traffic to be identified is determined to be illegal traffic; If there is only one sub-flow and the flow type of the sub-flow is a normal type, then the flow to be identified is determined to be a legitimate flow; Otherwise, it is determined that the traffic to be identified is suspected traffic.

2. The method according to claim 1, characterized in that The determining the flow type corresponding to each sub-flow in the at least one sub-flow includes: For any sub-flow of the at least one sub-flow, judging whether the traffic type corresponding to the sub-flow is a normal type according to a normal traffic judgment rule and / or a whitelist; According to the abnormal traffic judgment rule and / or the blacklist, it is judged whether the traffic type corresponding to the sub-traffic is an abnormal type.

3. The method according to claim 1, characterized in that The determining the flow type corresponding to each sub-flow in the at least one sub-flow includes: Determine the prompt word corresponding to the first language model according to the normal traffic judgment rules, abnormal traffic judgment rules and the blacklist and whitelist list; The at least one sub-flow is input into the first large language model respectively, and the flow type corresponding to each sub-flow is determined according to the prompt word corresponding to the first large language model.

4. The method according to claim 1, characterized in that The determining the flow type corresponding to each sub-flow in the at least one sub-flow includes: Determine the prompt word corresponding to the second largest language model according to normal traffic judgment rules and / or whitelist; Inputting the at least one sub-flow into the second largest language model respectively, and judging whether the flow type corresponding to each sub-flow is a normal type according to the prompt word corresponding to the second largest language model; Determine the prompt word corresponding to the third language model according to the abnormal traffic judgment rule and / or the blacklist; The at least one sub-flow is input into the third largest language model respectively, and it is determined whether the flow type corresponding to each sub-flow is an abnormal type according to the prompt word corresponding to the third largest language model.

5. The method according to claim 4, characterized in that The prompt words corresponding to the second largest language model include: Determine whether the traffic type corresponding to any sub-flow is a normal type according to the normal traffic judgment rule; If the traffic type corresponding to the sub-flow is not a normal type, determining whether the deduplicated sub-flow is in the whitelist; If the deduplicated sub-flow is in the whitelist, determining that the flow type corresponding to the sub-flow is a normal type; otherwise, determining that the flow type corresponding to the sub-flow is a suspected type; Output the traffic type corresponding to each sub-flow; The prompt words corresponding to the third language model include: Determine whether the traffic type corresponding to any sub-flow is an abnormal type according to the abnormal traffic judgment rule; If the traffic type corresponding to the sub-flow is not an abnormal type, determining whether the deduplicated sub-flow is in the blacklist; If the deduplicated sub-flow is in the blacklist, the flow type corresponding to the sub-flow is determined to be an abnormal type; otherwise, the flow type corresponding to the sub-flow is determined to be a suspected type; Output the traffic type corresponding to each sub-flow.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Inputting the traffic type corresponding to each sub-flow into the fourth language model, and determining the proportion corresponding to each traffic type according to the prompt word of the fourth language model; If the proportion of sub-flows corresponding to the abnormal type is greater than 0, the traffic to be identified is determined to be illegal traffic; if the proportion of sub-flows corresponding to the normal type is 1, the traffic to be identified is determined to be legal traffic; otherwise, the traffic to be identified is determined to be suspected traffic.

7. The method according to claim 6, characterized in that The prompt words of the fourth language model include: According to the traffic type proportion calculation rule, determine the proportion of sub-traffic corresponding to each traffic type; Returns the proportion of sub-traffic corresponding to each traffic type.

8. The method according to claim 6, characterized in that The method further comprises: The proportion of sub-flows corresponding to each traffic type is input into the fifth largest language model, and the processing method of the to-be-identified traffic is determined by the fifth largest language model.

9. The method according to claim 8, characterized in that The determining, by using the fifth language model, a method for processing the traffic to be identified includes: If the traffic to be identified is legitimate traffic, performing business processing on the traffic to be identified; If the traffic to be identified is illegal traffic, intercepting the traffic to be identified; If the traffic to be identified is suspected traffic, service processing is performed on any normal type of sub-traffic in the traffic to be identified, any abnormal type of sub-traffic in the traffic to be identified is intercepted, and any suspected type of sub-traffic in the traffic to be identified is corrected.

10. The method according to claim 6, characterized in that The method further comprises: According to the traffic to be identified and the identification result of the traffic to be identified, one or more of the following is iteratively updated: a large language model, a normal traffic judgment rule, an abnormal traffic judgment rule, or a black and white list.

11. A flow identification device, characterized in that: It includes a parsing unit and a determining unit; The parsing unit is used to parse any to-be-identified traffic into at least one sub-flow; The determination unit is used to determine the traffic type corresponding to each sub-flow in the at least one sub-flow; if the traffic type corresponding to at least one sub-flow is an abnormal type, then determine that the traffic to be identified is illegal traffic; If there is only one sub-flow and the flow type of the sub-flow is a normal type, then the flow to be identified is determined to be a legitimate flow; Otherwise, it is determined that the traffic to be identified is suspected traffic.

12. A computing device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 10 according to the obtained program instructions.

13. A computer-readable storage medium, characterized in that: The method comprises computer-readable instructions, and when a computer reads and executes the computer-readable instructions, the method according to any one of claims 1 to 10 is implemented.

14. A computer program product, characterized in that The invention comprises a computer program executable by a computer device, and when the program is run on the computer device, the computer device is caused to execute the steps of the method according to any one of claims 1 to 10.

Images