A traceability method, apparatus, device, medium, and product

Abstract

Embodiments of the present application provide a kind of tracing method, device, equipment, medium and product, related to network security technical field.The method comprises: obtaining tracing task and multiple tracing data;The correlation of receiving end address and each tracing data is calculated, and the tracing data with correlation greater than preset first threshold is taken as security data;According to multiple security data, first path is constructed;According to task type, target data is determined from multiple tracing data, and target model is determined from multiple preset analysis models;Target data is input into target model, and multiple target addresses are obtained;According to multiple target addresses, second path is constructed;According to first path and second path, target path is generated.The tracing method of the present application introduces multiple analysis models and multi-path fusion, effectively deals with the interference of noise data and encrypted traffic, can accurately identify the path between signal sending end and receiving end, improves the tracing accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a tracing method and device, equipment, medium and product. BACKGROUND

[0002] With the rapid development of the Internet, the network environment has become increasingly complex. In order to effectively maintain the stability and security of the network, a tracing technology is needed to determine the source of abnormal data transmission events, so as to identify and locate the source and path of abnormal data transmission events in a timely manner and improve the protection capability of the network.

[0003] In the prior art, by collecting logs and traffic data in network devices, servers and security systems, rule matching and correlation analysis techniques are used to identify and track the source and path of abnormal data transmission. These methods usually combine machine learning techniques to detect and identify abnormal addresses in data transmission, and determine the starting position and propagation path of abnormal data transmission events according to the detected abnormal addresses.

[0004] However, the prior art has the problem of low tracing accuracy. The prior art mainly relies on rule matching and correlation analysis when tracing abnormal data transmission events. These methods are easily affected by noise data and encrypted traffic in the face of complex and variable network environments, resulting in low tracing accuracy and difficulty in accurately identifying and locating the starting position and path of abnormal data transmission. SUMMARY

[0005] The embodiments of the present application provide a tracing method, device, equipment, medium and product to solve the problem of low tracing accuracy in the prior art.

[0006] In a first aspect, the embodiments of the present application provide a tracing method, comprising:

[0007] obtaining a tracing task and a plurality of tracing data; wherein the tracing task includes a receiving end address and a task type, and the plurality of tracing data includes log data and alarm data;

[0008] calculating the correlation degree of the receiving end address and each of the tracing data, and taking the tracing data with a correlation degree greater than a preset first threshold as security data; wherein the security information refers to abnormal data in the plurality of tracing data;

[0009] constructing a first path according to the plurality of security data; wherein the first path refers to any one of a plurality of paths from a sending end address to the receiving end address;

[0010] determine target data from the plurality of trace data according to the task type, and determine a target model from a plurality of preset analysis models; wherein the target data refers to any one of the plurality of trace data, and the target model refers to any one of the plurality of analysis models;

[0011] input the target data into the target model to obtain a plurality of target addresses; wherein the plurality of target addresses refer to addresses on a plurality of paths from the sending end address to the receiving end address;

[0012] construct a second path according to the plurality of target addresses; wherein the second path refers to any one of a plurality of paths from the sending end address to the receiving end address except the first path;

[0013] generate a target path according to the first path and the second path; wherein the target path refers to any one of a plurality of paths from the sending end address to the receiving end address except the first path and the second path.

[0014] In a possible design, the constructing a first path according to the plurality of security data comprises:

[0015] calculate portrait data according to the plurality of security data; wherein the portrait data is used to represent a data transmission process between the sending end address and the receiving end address;

[0016] construct the first path according to the plurality of trace data and the portrait data.

[0017] In a possible design, the constructing a second path according to the plurality of target addresses comprises:

[0018] obtain communication records of the plurality of target addresses;

[0019] construct the second path according to the plurality of target addresses and the communication records.

[0020] In a possible design, after the generating a target path according to the first path and the second path, the method further comprises:

[0021] calculate a completeness of the target path according to a preset completeness calculation rule;

[0022] when the completeness is less than a preset second threshold, create an adjustment task according to the plurality of trace data, the trace task and the completeness;

[0023] execute the adjustment task to perfect the target path.

[0024] In a possible design, the obtaining the traceability task and the plurality of traceability data comprises:

[0025] obtaining data source data, shared data and the traceability task; wherein the data source data comprises traffic data and update data, and the shared data comprises communication data and configuration data;

[0026] preprocessing the data source data and the shared data to obtain the traceability data.

[0027] In a possible design, the calculating the relevance between the receiving end address and each of the traceability data, and taking the traceability data with a relevance greater than a preset first threshold as the security data comprises:

[0028] obtaining address information of each of the traceability data; wherein the address information is used to represent the source of the traceability data;

[0029] calculating the relevance between the address information of each of the traceability data and the receiving end address respectively, and taking the traceability data with a relevance greater than the first threshold as the security data.

[0030] In a second aspect, the present application provides a traceability device, the device comprises:

[0031] an obtaining module, configured to obtain a traceability task and a plurality of traceability data; wherein the traceability task comprises a receiving end address and a task type, and the plurality of traceability data comprises log data and alarm data;

[0032] a relevance calculating module, configured to calculate the relevance between the receiving end address and each of the traceability data, and take the traceability data with a relevance greater than a preset first threshold as security data; wherein the security information refers to abnormal data in the plurality of traceability data;

[0033] a first path constructing module, configured to construct a first path according to the plurality of security data; wherein the first path refers to any one of a plurality of paths from a sending end address to the receiving end address;

[0034] a determining module, configured to determine target data from the plurality of traceability data and determine a target model from a plurality of preset analysis models according to the task type; wherein the target data refers to any one of the plurality of traceability data, and the target model refers to any one of the plurality of analysis models;

[0035] a target address calculating module, configured to input the target data into the target model to obtain a plurality of target addresses; wherein the plurality of target addresses refer to addresses on a plurality of paths from the sending end address to the receiving end address.

[0036] a second path construction module, configured to construct a second path according to the plurality of target addresses, wherein the second path is any one of multiple paths from the sending end address to the receiving end address except the first path;

[0037] a target path generation module, configured to generate a target path according to the first path and the second path, wherein the target path is any one of multiple paths from the sending end address to the receiving end address except the first path and the second path.

[0038] In a possible design, the first path construction module includes:

[0039] a portrait data calculation unit, configured to calculate portrait data according to the plurality of security data, wherein the portrait data is used to represent a data transmission process between the sending end address and the receiving end address;

[0040] a first path construction unit, configured to construct the first path according to the plurality of traceability data and the portrait data.

[0041] In a possible design, the second path construction module includes:

[0042] a communication record acquisition unit, configured to acquire communication records of the plurality of target addresses;

[0043] a second path construction unit, configured to construct the second path according to the plurality of target addresses and the communication records.

[0044] In a possible design, the traceability apparatus further includes:

[0045] a completeness calculation module, configured to calculate a completeness of the target path according to a preset completeness calculation rule;

[0046] a task creation module, configured to create an adjustment task according to the plurality of traceability data, the traceability task and the completeness when the completeness is less than a preset second threshold;

[0047] a task execution module, configured to execute the adjustment task to perfect the target path.

[0048] In a possible design, the acquisition module includes:

[0049] a data acquisition unit, configured to acquire data source data, shared data and the traceability task, wherein the data source data includes traffic data and update data, and the shared data includes communication data and configuration data;

[0050] A data preprocessing unit is configured to preprocess the source data and the shared data to obtain the traceable data.

[0051] In a possible design, the correlation degree calculation module comprises:

[0052] An address information acquisition unit is configured to acquire address information of each of the traceable data, wherein the address information is used to represent a source of the traceable data.

[0053] A correlation degree calculation unit is configured to calculate a correlation degree between the address information of each of the traceable data and the address of the receiving end respectively, and take the traceable data with the correlation degree greater than the first threshold as the secure data.

[0054] In a third aspect, the present application provides an electronic device, comprising a processor and a memory connected with the processor in communication;

[0055] The memory stores computer-executed instructions.

[0056] The processor, when executing the computer-executed instructions stored in the memory, is configured to implement the traceable method according to any one of the first aspect.

[0057] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executed instructions, and the computer-executed instructions, when executed by a processor, are configured to implement the traceable method according to any one of the first aspect.

[0058] In a fifth aspect, the present application provides a computer program product, comprising a computer program, and the computer program, when executed by a processor, is configured to implement the traceable method according to any one of the first aspect.

[0059] This application provides a tracing method, apparatus, device, medium, and product. The method includes: acquiring a tracing task and multiple tracing data; calculating the correlation between the receiving end address and each piece of tracing data, and selecting tracing data with a correlation greater than a preset first threshold as secure data; constructing a first path based on the multiple secure data; determining target data from the multiple tracing data according to the task type, and determining a target model from multiple preset analysis models; inputting the target data into the target model to obtain multiple target addresses; constructing a second path based on the multiple target addresses; and generating a target path based on the first path and the second path. The tracing method of this application solves the problem of low tracing accuracy in existing technologies by introducing multiple analysis models and multi-path fusion. This method determines data and models according to the task type, processes different data using different analysis models, and generates multiple possible paths. By fusing and optimizing these paths, it effectively addresses interference from noisy data and encrypted traffic, accurately identifies the path between the signal transmitter and receiver, and improves tracing accuracy. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 This is a schematic diagram of the system architecture of the tracing method provided in the embodiments of this application;

[0062] Figure 2 This is a schematic diagram illustrating an application scenario of the tracing method provided in the embodiments of this application;

[0063] Figure 3 Flowchart of the tracing method provided in the embodiments of this application Figure 1 ;

[0064] Figure 4 Flowchart of the tracing method provided in the embodiments of this application Figure 2 ;

[0065] Figure 5 This is a schematic diagram of the traceability device provided in the embodiments of this application;

[0066] Figure 6 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0067] The exemplary embodiments will be described in detail herein with reference to the attached drawings. In the following description, like reference numerals refer to like elements throughout the description. The following exemplary embodiments are described in enough detail to enable those skilled in the art to practice the application. Additionally, the description is not intended to limit the application to one or more particular embodiments. The exemplary embodiments can be employed in any number of applications and the description is not intended to limit the application to one or more particular applications.

[0068] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards, and provide corresponding operation portal for user to choose authorization or refusal.

[0069] In the embodiments of the present application, the same items or similar items with basically the same functions and effects are distinguished by using "first", "second", etc. Those skilled in the art can understand that "first", "second", etc. do not limit the quantity and execution order, and "first", "second", etc. do not necessarily mean different. It should be noted that the words "exemplary" or "for example" in the embodiments of the present application are used to indicate an example, illustration or description. Any embodiment or design scheme described as "exemplary" or "for example" in the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the words "exemplary" or "for example" are intended to present the relevant concept in a specific manner. In the embodiments of the present application, "at least one" means one or more, and "multiple" means two or more than two.

[0070] It should be noted that "at" in the embodiments of the present application can be at the moment when a certain condition occurs, or in a period of time after a certain condition occurs, which is not limited in the embodiments of the present application. In addition, the traceability method provided in the embodiments of the present application is only an example, and the traceability method can include more or less content.

[0071] In order to clearly describe the technical solutions of the embodiments of the present application, the following briefly introduces some terms and technologies involved in the embodiments of the present application:

[0072] Domain Name System (DNS) log: is a data file that records activities related to domain name resolution requests and responses. These logs can help identify abnormal activities, analyze traffic patterns, diagnose network problems, and track potential security threats. By analyzing DNS logs, the usage of the network can be determined.

[0073] Data flow logs: These are log files that record the movement of data within a network. They provide detailed information about the path, timestamp, destination address, port number, protocol type, and amount of data transmitted by each packet. These logs can be used to monitor and analyze network traffic, helping network administrators understand network performance, detect unusual activities, optimize resource allocation, and ensure security.

[0074] Network topology: This refers to the physical or logical connection structure between nodes in a network, such as computers, switches, routers, etc. It describes how network devices are connected and interact with each other through communication links. Common types of network topologies include bus, star, ring, mesh, and hybrid. Network topology not only affects network performance, reliability, and scalability but also determines the path and efficiency of data transmission, making it a crucial factor in network design and management.

[0075] The exemplary embodiments will be described in detail herein with reference to the attached drawings. In the following description, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present invention, as detailed in the appended claims.

[0076] The technical solutions of the present invention will be described in detail below with specific examples. The following specific examples can be combined with each other, and some concepts or processes that are the same or similar may not be described again in some examples. The embodiments of the present invention will be described below with reference to the accompanying drawings.

[0077] In order to clearly understand the technical solutions of the present application, the prior art solutions will be described in detail first. In the prior art, network security systems collect log and traffic data from network devices, servers, and security systems, and use rule matching and correlation analysis techniques to identify and trace the source and path of abnormal data transmission. These systems usually define a series of rules and patterns in advance to quickly identify abnormal behavior or abnormal addresses in data transmission. After identifying these abnormal addresses, the system will further analyze to determine the starting position and propagation path of the abnormal data transmission event.

[0078] However, the prior art traceability method has the problem of low traceability accuracy. The prior art mainly relies on rule matching and correlation analysis when tracing abnormal data transmission events. These methods are easily affected by noise data and encrypted traffic in complex and variable network environments, resulting in low traceability accuracy and difficulty in accurately identifying and locating the starting position and path of abnormal data transmission.

[0079] Therefore, to address the low accuracy of existing traceability methods, the research found that different models can be introduced for different task types, and a multi-path fusion method can be used: ① During the transmission of abnormal data, different analysis models are selected and applied according to the specific task properties and requirements. Different tasks may involve different network environments, data characteristics, or security threats, so by matching the appropriate model to handle specific tasks, the system can effectively capture the complex patterns of abnormal behavior and optimize the identification process of the traceability path. ② During the transmission of abnormal data, the information of multiple potential paths is considered simultaneously to reduce the errors and uncertainties that may be caused by single-path analysis. By fusing data and features from different paths, the system can comprehensively understand the starting location and propagation path of abnormal data transmission, thereby enhancing the overall accuracy of the traceability process. ③ Integrate information from multiple data sources. Different data sources can provide multi-dimensional information, such as network traffic logs, user behavior records, and system event logs, etc. These information complement each other and can more comprehensively reflect the overall picture of network activity. By comprehensively analyzing these diverse data, the system can more effectively identify abnormal patterns and potential threats, overcome the limitations and biases that may exist in single data sources, and enhance the ability to identify and locate the path of abnormal data transmission.

[0080] Specifically:

[0081] A system architecture can be constructed that can comprehensively integrate multi-dimensional information, dynamically adapt to different situational requirements, and provide multi-level analysis perspectives. In this way, the system can accurately capture and understand abnormal addresses in complex network environments, thereby improving the ability to identify and locate abnormal data transmission activities and improving traceability accuracy and reliability.

[0082] The traceability method of the embodiments of the present application solves the problem of low accuracy in the prior art by introducing multiple analysis models and a multi-path fusion method. The method determines data and models according to task types, uses different analysis models to process different data, and generates multiple possible paths. By fusing and optimizing these paths, the influence of noise data and encrypted traffic is effectively filtered out, and the path between the signal sending end and the receiving end can be accurately identified. This strategy effectively deals with the interference of noise data and encrypted traffic, and improves the accuracy of traceability.

[0083] Based on the above creative findings, the technical scheme of the present application is proposed.

[0084] Figure 1 The system architecture diagram of the traceability method provided by the embodiments of the present application is shown. It should be noted that, Figure 1The examples shown are merely examples of system architectures that can be applied to the embodiments of this application, in order to help those skilled in the art understand the technical content of this application, but do not mean that the embodiments of this application cannot be used in other devices, systems, environments or scenarios.

[0085] like Figure 1 As shown, the system architecture of this method includes a task generation module 101, a data acquisition module 102, a profile data module 103, a correlation analysis module 104, a model analysis module 105, an anomaly identification module 106, and a path fusion module 107. The task generation module 101 can generate a tracing task and send it to the data acquisition module 102 and the profile data module 103. After receiving the tracing task, the data acquisition module 102 can collect tracing data and send it to the correlation analysis module 104 and the model analysis module 105. After receiving the tracing task, the profile data module 103 can perform profile analysis based on the address in the tracing task, generate profile data, and send the profile data to the correlation analysis module 104. After receiving the profile data and the tracing data, the correlation analysis module 104 can detect abnormal addresses and send them to the anomaly identification module 106. After receiving the tracing data, the model analysis module 105 can also detect abnormal addresses and send them to the anomaly identification module 106. After receiving the two types of abnormal addresses, the anomaly identification module 106 can generate two paths and send them to the path fusion module 107. The path fusion module 107 can fuse the two paths to obtain the target path.

[0086] In this embodiment, the task generation module 101 can be a computer hardware controller. This module can automatically generate tracing tasks through preset algorithms and logic, and distribute these tasks to the data acquisition module 102 and the profile data module 103. The data acquisition module 102 can be an embedded device integrating sensor interfaces and data processing capabilities. This module can acquire tracing data in real time or periodically through connections to various data sources. The profile data module 103 can be a computer software module. This module is responsible for receiving the tracing tasks sent by the task generation module 101 and performing profile analysis based on the address information in the tasks. It uses data analysis algorithms and machine learning techniques to extract and integrate relevant information from multiple data sources to generate detailed profile data. The correlation analysis module 104 can be a software system based on data analysis and machine learning algorithms. This module can receive profile data and tracing data, and through correlation analysis algorithms, identify potential relationships and patterns between data, and detect abnormal addresses and behavioral patterns. The model analysis module 105 can be a software system integrating data modeling and predictive analysis capabilities. This module focuses on receiving and processing source data from the data acquisition module 102, and conducting in-depth analysis of the data by constructing and applying mathematical models to identify abnormal addresses and behavioral patterns. The anomaly identification module 106 can be a software system that receives abnormal address data from the correlation analysis module 104 and the model analysis module 105, and performs comprehensive analysis and verification on this data. By using anomaly detection algorithms, the anomaly identification module 106 can effectively identify and confirm abnormal addresses in the data. The path fusion module 107 can be a software system integrating data integration and path optimization algorithms. The main function of this module is to receive two types of abnormal paths from the anomaly identification module 106 and integrate these paths using a fusion algorithm to generate an optimized target path.

[0087] The following describes the application scenarios of the tracing method provided in the embodiments of the present invention. Figure 2 This is a schematic diagram illustrating an application scenario of the tracing method provided in the embodiments of this application. For example... Figure 2 As shown, this application scenario includes a mobile terminal 201 and a server 202. The mobile terminal 201 sends a tracing command to the server 202, the server 202 performs tracing according to the tracing command, and sends the target path obtained from the tracing back to the mobile terminal 201.

[0088] The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0089] Figure 3 Flowchart of the tracing method provided in the embodiments of this application Figure 1 .like Figure 3As shown, in this embodiment, the execution subject of the embodiment of the application is a server. The traceability method provided in this embodiment includes the following steps:

[0090] S301, acquire a traceability task and a plurality of traceability data.

[0091] Specifically, the traceability task and the plurality of traceability data can be acquired through a network monitoring and data collection system, which can collect and store log data and alarm data in the network in real time, and classify and arrange according to the preset task type and receiver address. This design can provide the necessary data basis for the subsequent traceability analysis process, so as to calculate the relevance, identify security data, construct the path, and select the appropriate analysis model, so as to realize the tracking and analysis of the data flow path. The traceability task includes the receiver address and the task type, and the plurality of traceability data includes the log data and the alarm data.

[0092] S302, calculate the relevance of the receiver address and each traceability data, and take the traceability data with a relevance greater than a preset first threshold as security data.

[0093] Specifically, the relevance of the receiver address and each traceability data can be calculated through an algorithm based on machine learning. The algorithm can analyze the features in the traceability data, such as timestamp, packet size, communication frequency, etc., and compare them with the historical communication mode of the receiver address to calculate the relevance score. The traceability data with a relevance greater than the preset first threshold is marked as security data. This process can filter out abnormal data highly relevant to the receiver address, so as to focus on these data in the subsequent path construction and analysis, thereby improving the accuracy and efficiency of traceability analysis. The security information refers to the abnormal data in the plurality of traceability data.

[0094] S303, construct a first path according to the plurality of security data.

[0095] Specifically, the first path can be constructed by analyzing and arranging the network addresses and communication links involved in the security data. The source address, destination address and intermediate nodes therebetween in the security data can be connected to form a path from the sender to the receiver by using path optimization technology. Through this design, the transmission path of abnormal data can be effectively identified and tracked, thereby improving the accuracy and reliability of traceability.

[0096] For example, in a network intrusion incident, the security system collects a large amount of log and alert data, including abnormal access requests and unauthorized login attempts. By analyzing this security data, the system can identify multiple abnormal addresses and calculate the correlation between these addresses, thereby constructing a path from the attacker's initial address to the target address. This path can help the security team quickly locate the source of the attack, understand the attacker's movement route, and take effective measures to block the attack path, thus improving overall network security.

[0097] S304. Based on the task type, determine the target data from multiple source data and determine the target model from multiple preset analysis models.

[0098] Specifically, a smart decision-making system can be used to determine the target data and target model. This system first filters out task-related target data from the source data based on the task type definition. Then, the system matches the most suitable analysis model according to the task type; for example, using a machine learning model for anomaly detection or a rule engine for pattern matching. Through this design, the system can flexibly adapt to different types of source tracing tasks, ensuring that the selected target data and analysis model can effectively identify and track abnormal data transmission activities, thereby improving the accuracy and efficiency of source tracing. Here, target data refers to any one of multiple source data sets, and target model refers to any one of multiple analysis models.

[0099] For example, when handling a network intrusion tracing task, the system first filters relevant abnormal login attempts and suspicious traffic data from collected log and alarm data as target data based on the task type. Then, the system selects a suitable machine learning model for detecting abnormal behavior from several pre-set analysis models as the target model. By inputting the target data into the target model, the system can identify the attacker's initial address and construct the path from that address to the attacked target. This precise filtering of task-related target data and analysis models not only accelerates the response time to security incidents but also reduces false positives and false negatives, enabling security teams to take timely and targeted defensive measures, optimize resource utilization, and enhance network security.

[0100] S305. Input the target data into the target model to obtain multiple target addresses.

[0101] Specifically, the target data can be input into a model for pattern recognition, anomaly detection, or path prediction. After the model processes the input data, it outputs a plurality of network addresses related to the target data, which can represent potential communication nodes or path nodes. This design is used for network security and traffic analysis, aiming to accurately track the path and scope of abnormal data transmission activities by identifying key addresses related to specific security incidents or communication patterns through model analysis. Among them, the plurality of target addresses refers to the addresses on the multiple paths from the sending end address to the receiving end address.

[0102] For example, the target data can be log field features, and the target model can be an unsupervised machine learning model. The target model can use an empirical cumulative distribution-based outlier detection algorithm to detect the target data, obtaining a plurality of target addresses with abnormal behavior. The empirical cumulative distribution-based outlier detection algorithm identifies outliers by evaluating the relative position of data points in each feature distribution. This method assumes that each feature is independent of each other and uses the empirical cumulative distribution function of each feature to quantify its rarity. Finally, by multiplying the tail probabilities in different dimensions, a comprehensive anomaly score is obtained, and the higher the score, the more likely it is an outlier, which measures the degree of abnormality of the data point.

[0103] Suppose there are n samples, the feature dimension is d, and if denotes the jth feature of the ith sample, and the formula for calculating the left and right tail outliers of the empirical cumulative distribution function is as follows:

[0104]

[0105]

[0106] wherein, is an indicator function, is 1 when the parameter inside is true , otherwise is 0, and Z is a preset value.

[0107] Calculate the left and right tail probabilities and automatic anomaly scores for each log field feature, then perform maximum aggregation to obtain the outlier score of the sample, the calculation formula is as follows:

[0108]

[0109]

[0110]

[0111]

[0112] wherein, a sample skewness coefficient of the jth feature distribution, The abnormal score of the comprehensive abnormal score can be calculated, and when the abnormal score is greater than a preset value, the address corresponding to the target field feature is taken as the target address.

[0113] S306, according to the plurality of target addresses, constructing a second path.

[0114] Specifically, the second path can be constructed by a path construction algorithm that uses the connection relationship between target addresses to form a path from the sender to the receiver. The specific steps can include analyzing the network topology between target addresses, identifying possible communication links, and constructing the second path according to a preset path selection strategy, such as the shortest path or the lowest delay, etc. This design is used for network tracing and security analysis, aiming to help identify and verify potential abnormal data transmission paths by providing a path different from the first path. Among them, the second path refers to any one of the multiple paths from the sender address to the receiver address, excluding the first path.

[0115] For example, by analyzing the network topology between multiple target addresses, a second path from the attacker to the attacked target can be identified. If the first path is constructed based on the shortest path strategy, the second path can be constructed according to different strategies. By providing a second path different from the first path, it helps to more comprehensively identify and verify the possible attack path of the attacker, thereby improving the defense and response capabilities to potential security threats.

[0116] S307, according to the first path and the second path, generating a target path.

[0117] Specifically, the fusion of the first path and the second path can be realized by a path optimization and data integration algorithm, which compares and merges the addresses and connection relationships of the two paths. The algorithm can automatically identify the key addresses in the two paths and remove duplicate addresses to ensure that the final target path is concise and complete. Through the target path, the action trajectory of the data from the sender to the receiver can be fully understood, so as to timely detect, respond and prevent threats. Among them, the target path refers to any one of the multiple paths from the sender address to the receiver address, excluding the first path and the second path.

[0118] For example, in a network attack tracing process, the system first constructs a first path and a second path that may be used by an attacker according to security data, which reveals known abnormal paths from the initial address of the attacker to the target of the attack. Subsequently, the system generates a target path by analyzing the two paths to identify other paths that may be used by the attacker but have not been discovered. This process helps the security team identify hidden paths in a complex attack chain, provides a more comprehensive attack view, and thus takes more effective defensive measures to improve overall network security.

[0119] The embodiment provides a tracing method, which comprises the following steps: obtaining a tracing task and a plurality of tracing data; calculating the relevance of a receiving end address and each tracing data, and taking the tracing data with a relevance greater than a preset first threshold as security data; constructing a first path according to the plurality of security data; determining target data from the plurality of tracing data according to a task type, and determining a target model from a plurality of preset analysis models; inputting the target data into the target model to obtain a plurality of target addresses; constructing a second path according to the plurality of target addresses; and generating a target path according to the first path and the second path. The tracing method achieves the following technical effects: by introducing a plurality of analysis models and multi-path fusion, the problem of low accuracy in the prior art is solved. The method determines data and models according to a task type, processes different data by using different analysis models, and generates a plurality of possible paths. By fusing and optimizing these paths, the influence of noise data and encrypted traffic is effectively filtered out, and the path between the signal sending end and the receiving end can be accurately identified. This method effectively deals with the interference of complex factors such as noise data and encrypted traffic, and improves the accuracy of tracing.

[0120] In a possible design, S303 constructs a first path according to a plurality of security data, comprising:

[0121] S3031, calculating portrait data according to a plurality of security data.

[0122] Specifically, the feature information in the security data can be analyzed and processed using data mining or machine learning to extract key features that describe the data transmission characteristics between the sender address and the receiver address from the security data. These features can include packet size, transmission time, transmission frequency, and abnormal behavior patterns. By comprehensively analyzing these features, an image data is generated, which can comprehensively describe and represent the characteristics of the data transmission process. This design is used to identify and understand normal and abnormal behavior patterns in the data transmission process for traceability analysis. The image data can help identify potential security threats and optimize network path selection to improve the security and efficiency of data transmission. By building accurate image data, the system can effectively monitor and manage network traffic to ensure the reliability and security of data transmission. The image data is used to describe the data transmission process between the sender address and the receiver address.

[0123] S3032, constructing a first path according to the plurality of traceability data and the image data.

[0124] Specifically, the first path can be constructed by analyzing the abnormal features in the traceability data and the transmission patterns described by the image data. The image data provides an overview of the transmission process from the sender to the receiver, revealing potential abnormal addresses and path characteristics. By matching this information with the abnormal patterns in the traceability data, the system can identify abnormal transmission paths. This design is used to accurately locate the transmission path of abnormal data in the network, thereby improving the accuracy and efficiency of traceability and helping to identify and respond to potential security threats.

[0125] The technical effect of this scheme in this embodiment is that by calculating a plurality of security data to obtain image data, and combining a plurality of traceability data and image data to construct a first path, the path of abnormal data transmission can be accurately identified and determined. The path is composed of a plurality of abnormal addresses. By this method, the accuracy of traceability can be effectively improved, and the existence of abnormalities in the data transmission process can be identified and tracked, and finally the more accurate traceability goal can be achieved.

[0126] In one possible design, S306 constructs a second path according to a plurality of target addresses, including:

[0127] S3061, obtaining communication records of the plurality of target addresses.

[0128] Specifically, the communication records of multiple target addresses can be obtained through network monitoring and log analysis tools. These tools can capture and record communication data between various addresses in real time, including source address, target address, transmission time, and packet size. By analyzing these communication records, abnormal communication behavior and paths can be identified, helping to build the second path. This design is used to identify and track the path of abnormal data transmission in the network, improving the accuracy of tracing.

[0129] S3062、According to the multiple target addresses and the communication records, a second path is constructed.

[0130] Specifically, network traffic logs and system logs related to multiple target addresses can be analyzed. These logs usually contain detailed communication information such as timestamps, target addresses, port numbers, and protocol types. By analyzing these communication records, the specific path of abnormal data transmission can be identified, thereby constructing the second path from the sender to the receiver. This design is used to identify and track the path of abnormal data transmission, ensuring that the communication link involving multiple abnormal addresses on the path from the sender to the receiver can be accurately determined. By constructing and analyzing these paths, the behavior patterns and transmission paths of the data sender can be better understood, improving the accuracy of tracing.

[0131] The technical effect of this scheme in this embodiment is: by obtaining the communication records of multiple target addresses and constructing the second path based on these records, the specific path of abnormal data transmission can be effectively identified and tracked. This process ensures that all abnormal addresses involved in the path from the sender to the receiver are accurately identified and recorded. In this way, the behavior path of the data sender sending data can be fully understood and reconstructed, improving the accuracy and completeness of tracing, and providing a more reliable basis for network security protection.

[0132] In one possible design, S301 obtains the tracing task and multiple tracing data, including:

[0133] S3011, obtain data source data, shared data and tracing task.

[0134] Specifically, the traffic data and update data can be extracted from network devices, servers and security systems by integrating multiple data collection mechanisms, and the shared communication data and configuration data can be obtained from cloud service providers or other partners. The tracing task is defined and obtained through a security management system or a user interface. This design is used to ensure that the tracing system can comprehensively collect and integrate data from multiple sources to support accurate identification and analysis of abnormal data transmission paths, thereby improving the accuracy and effectiveness of tracing. In this way, the system can better understand and track abnormal paths from the sender to the receiver, identify potential security threats. Among them, the data source data includes traffic data and update data, and the shared data includes communication data and configuration data.

[0135] For example, the following shared data can be obtained from the server through a cloud sharing mechanism: data stream log, domain name system log, Internet log, user information, alarm log, full traffic data, host log and specific file. Among them, the data stream log can include source address, destination address, port number, network protocol type, stream start time, stream end time, incoming direction byte number and incoming direction packet number, etc., the domain name system log can include request domain name, request time, request domain name system record type, record resolution address, domain name, record resolution address and resolution server address, etc., the Internet log can include port number, uniform resource locator, connection type and area code, etc.

[0136] S3012, pre-process the data source data and shared data to obtain tracing data.

[0137] Specifically, pre-processing can be achieved through data cleaning, format conversion and standardization, etc. First, clean the collected data source data and shared data to remove noise and redundant information. Then, perform format conversion to unify data from different sources into compatible formats. Finally, perform standardization to ensure data consistency and comparability. This design is used to improve the quality and usability of data, so that tracing analysis can be performed on reliable and unified data, accurately identifying and tracking abnormal paths from the sender to the receiver, improving the accuracy and efficiency of tracing.

[0138] The technical effect of this scheme in this embodiment is that by obtaining and preprocessing data source data, shared data and tracing tasks, high-quality and consistent basic data can be provided for tracing analysis. This process ensures that data collected from multiple sources can be effectively used to identify and track abnormal data transmission paths after cleaning and standardization. In this way, the system can accurately determine the abnormal path from the sender to the receiver, improving the accuracy and efficiency of tracing.

[0139] In one possible design, S302 calculates the relevance of the receiving end address to each trace data, and takes the trace data with a relevance greater than a preset first threshold as the safe data, including:

[0140] S3021, obtain address information of each trace data.

[0141] Specifically, the address information of each trace data can be obtained by parsing and extracting system logs, alarm data, and target addresses and other information. These information is usually embedded in the packet header or log record, and can be effectively extracted through automated scripts or log analysis tools. This design is used to identify and record network entities related to the trace data, so as to calculate the relevance of these entities to the receiving end address. By accurately obtaining and analyzing the address information, the system can more effectively identify abnormal data transmission paths and improve the accuracy and efficiency of the trace. Wherein, the address information is used to express the source of the trace data.

[0142] S3022, calculate the relevance of the address information of each trace data to the receiving end address respectively, and take the trace data with a relevance greater than a first threshold as the safe data.

[0143] Specifically, the relevance between the address information of each trace data and the receiving end address can be calculated by using a similarity algorithm or a machine learning model. The specific method can include calculating the geographical location proximity, network topology similarity or historical communication frequency of the address and other indicators. By setting a preset relevance threshold, the system can filter out the trace data with high relevance to the receiving end address, and mark it as safe data. This design is used to identify and filter out data highly related to abnormal activities, so as to help build accurate abnormal data transmission paths and improve the accuracy and effectiveness of the trace.

[0144] The technical effect of this scheme in the embodiment is that by calculating the relevance of the address information of each trace data to the receiving end address, and filtering out the trace data with a relevance greater than a preset threshold as safe data, the data closely related to abnormal activities can be effectively identified. This process ensures that the basic data of the trace analysis has high relevance and accuracy, thereby improving the accuracy of the abnormal data transmission path identification. In this way, the system can accurately track the abnormal path from the sending end to the receiving end, and improve the accuracy and efficiency of the trace.

[0145] Figure 4 Flowchart of the trace method provided in the embodiment of the present application Figure 2 In the embodiment, in Figure 3 On the basis of the provided embodiment, the trace method is further explained. The trace method comprises:

[0146] S401, acquire a traceability task and a plurality of traceability data; wherein the traceability task comprises a receiving end address and a task type, and the plurality of traceability data comprises log data and alarm data.

[0147] S402, calculate the relevance of the receiving end address and each traceability data, and take the traceability data with a relevance greater than a preset first threshold value as security data; wherein the security information refers to abnormal data in the plurality of traceability data.

[0148] S403, construct a first path according to the plurality of security data; wherein the first path refers to any one of a plurality of paths from the sending end address to the receiving end address.

[0149] S404, determine target data from the plurality of traceability data according to the task type, and determine a target model from a plurality of preset analysis models; wherein the target data refers to any one of the plurality of traceability data, and the target model refers to any one of the plurality of analysis models.

[0150] S405, input the target data into the target model to obtain a plurality of target addresses; wherein the plurality of target addresses refers to addresses on a plurality of paths from the sending end address to the receiving end address.

[0151] S406, construct a second path according to the plurality of target addresses; wherein the second path refers to any one of a plurality of paths from the sending end address to the receiving end address, except the first path.

[0152] S407, generate a target path according to the first path and the second path; wherein the target path refers to any one of a plurality of paths from the sending end address to the receiving end address, except the first path and the second path.

[0153] S401-S407 are similar to S301-S307, and will not be described again in this embodiment.

[0154] S408, calculate the completeness of the target path according to a preset completeness calculation rule.

[0155] Specifically, a set of completeness calculation rules can be defined, which can include the number of path addresses, the network range covered by the path, the recognition rate of abnormal addresses in the path, and the deviation degree of the path from known normal paths, etc. By evaluating the target path, its score on these indicators is calculated to determine the completeness of the path. When the completeness is lower than a preset threshold, the system can trigger an adjustment task to perfect and optimize the path identification process, thereby improving the accuracy and reliability of traceability.

[0156] S409, when the completeness is less than a preset second threshold, create an adjustment task according to the plurality of traceability data, the traceability task, and the completeness.

[0157] Specifically, a completeness threshold can be set, and when the completeness calculation result of the target path is lower than the threshold, the system automatically generates an adjustment task. The creation of the adjustment task is based on the reanalysis of multiple traceability data and traceability tasks, which may involve reevaluating data correlation, introducing more data sources, or adjusting the parameters of the analysis model, etc. The adjustment task aims to optimize the path identification and analysis process to fill in the information gaps in the path or correct the identification errors. This design is used to ensure the accuracy and completeness of the traceability path, and to improve the precision and reliability of the traceability system in identifying abnormal data transmission paths by dynamically adjusting and optimizing the analysis process.

[0158] S410, execute the adjustment task to perfect the target path.

[0159] Specifically, when executing the adjustment task, the system can introduce new data sources or update existing data to fill in the information gaps in the path or correct the identification errors. This design is used to dynamically optimize and perfect the traceability path, ensuring that the identified abnormal data transmission path is as complete and accurate as possible. By executing the adjustment task, the system can improve the accuracy and reliability of traceability analysis.

[0160] The technical effect of this scheme in this embodiment is that by calculating the completeness of the target path after it is generated and creating and executing an adjustment task when the completeness is lower than a preset threshold, the identification process of the abnormal data transmission path can be dynamically optimized and perfected. This mechanism ensures the comprehensiveness and accuracy of the traceability path, and even if the initial path identification is incomplete, it can be supplemented and corrected through the adjustment task. In this way, the system can more effectively identify and track abnormal activities, improving the accuracy and reliability of traceability analysis.

[0161] Figure 5 The structure diagram of the traceability device provided by the embodiment of the present application is shown in the figure. Figure 5 As shown in the figure, the traceability device comprises:

[0162] The acquisition module 501 is configured to acquire a traceability task and multiple traceability data; wherein the traceability task comprises a receiving end address and a task type, and the multiple traceability data comprises log data and alarm data.

[0163] The correlation calculation module 502 is configured to calculate the correlation between the receiving end address and each traceability data, and take the traceability data with a correlation greater than a preset first threshold as safe data; wherein the safe information refers to abnormal data in the multiple traceability data.

[0164] The first path construction module 503 is configured to construct a first path according to the multiple safe data; wherein the first path refers to any one of the multiple paths from the sending end address to the receiving end address.

[0165] The determining module 504 is configured to determine target data from the plurality of trace data according to a task type, and determine a target model from the plurality of preset analysis models; the target data refers to any one of the plurality of trace data, and the target model refers to any one of the plurality of analysis models.

[0166] The target address calculating module 505 is configured to input the target data into the target model to obtain a plurality of target addresses; the plurality of target addresses refer to addresses on a plurality of paths from the sending end address to the receiving end address.

[0167] The second path constructing module 506 is configured to construct a second path according to the plurality of target addresses; the second path refers to any one of a plurality of paths from the sending end address to the receiving end address except the first path.

[0168] The target path generating module 507 is configured to generate a target path according to the first path and the second path; the target path refers to any one of a plurality of paths from the sending end address to the receiving end address except the first path and the second path.

[0169] In a possible design, the first path constructing module 503 includes:

[0170] The portrait data calculating unit is configured to calculate portrait data according to the plurality of security data; the portrait data is used to describe a data transmission process between the sending end address and the receiving end address.

[0171] The first path constructing unit is configured to construct the first path according to the plurality of trace data and the portrait data.

[0172] In a possible design, the second path constructing module 506 includes:

[0173] The communication record obtaining unit is configured to obtain communication records of the plurality of target addresses.

[0174] The second path constructing unit is configured to construct the second path according to the plurality of target addresses and the communication records.

[0175] In a possible design, the trace device further includes:

[0176] The completeness calculating module is configured to calculate a completeness of the target path according to a preset completeness calculation rule.

[0177] The task creating module is configured to create an adjustment task according to the plurality of trace data, the trace task and the completeness when the completeness is less than a preset second threshold.

[0178] The task executing module is configured to execute the adjustment task to perfect the target path.

[0179] In a possible design, the obtaining module 501 includes:

[0180] The data obtaining unit is configured to obtain data source data, shared data, and a traceability task, wherein the data source data includes traffic data and update data, and the shared data includes communication data and configuration data.

[0181] The data preprocessing unit is configured to preprocess the data source data and the shared data to obtain traceability data.

[0182] In a possible design, the relevance calculation module 502 includes:

[0183] The address information obtaining unit is configured to obtain address information of each traceability data, wherein the address information is used to represent the source of the traceability data.

[0184] The relevance calculation unit is configured to respectively calculate the relevance between the address information of each traceability data and the address of the receiving end, and take the traceability data with a relevance greater than a first threshold as secure data.

[0185] The traceability apparatus provided in this embodiment can implement the technical solutions of the method embodiments shown in Figure 3 and Figure 4 , and has similar implementation principles and technical effects, which will not be repeated here. Figure 3 Figure 4

[0186] Figure 6 The hardware structure schematic diagram of the electronic device provided in this embodiment is shown in Figure 6 . The electronic device includes at least one processor 610 and a memory 620. The electronic device also includes a communication component 630. The processor 610, the memory 620, and the communication component 630 are connected through a bus 640.

[0187] In the specific implementation process, the at least one processor 610 executes the computer execution instructions stored in the memory 620, so that the at least one processor 610 is configured to implement the traceability method of the above-mentioned embodiments.

[0188] The specific implementation process of the processor 610 can refer to the method embodiments described above, which has similar implementation principles and technical effects, and will not be repeated here.

[0189] ​​In the above embodiments, it should be understood that the processor 610 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the application can be directly embodied as hardware processor execution, or executed by a combination of hardware and software modules in the processor.

[0190] The memory 620 can include a high-speed RAM memory, and can also include a non-volatile storage NVM, such as at least one disk memory.

[0191] The bus 640 can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus 640 can be divided into an address bus, a data bus, a control bus, etc. For the sake of representation, the bus 640 in the drawings of the present application does not limit to only one bus or one type of bus.

[0192] The functions realized by the electronic device and the master device described above are introduced for the scheme provided by the embodiments of the present application. It can be understood that the electronic device or the master device contains the hardware structure and / or software module corresponding to the execution of each function in order to realize the above functions. The units and algorithm steps of each example described in combination with the embodiments disclosed in the embodiments of the present application can be realized in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the technical solution of the embodiments of the present application.

[0193] The embodiments of the present application also provide a computer readable storage medium, and the computer readable storage medium stores computer execution instructions. When the computer execution instructions are executed by a processor, the computer execution instructions are used to realize the traceability method of the above embodiments. In the specific implementation of the traceability method, each module can be realized as a processor.

[0194] The above readable storage medium can be implemented by any type of volatile or nonvolatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0195] An exemplary readable storage medium is coupled to the processor, so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in an electronic device or a host device.

[0196] The embodiments of the present application also provide a computer program product, comprising a computer program, which is executed by a processor to implement the traceability method of the above embodiments.

[0197] The computer program is stored in a readable storage medium, and at least one processor can read the computer program from the readable storage medium, and execute the computer program to perform the scheme provided by any of the above embodiments.

[0198] Those skilled in the art can understand that all or part of the steps of the above method embodiments can be completed by program instruction related hardware. The foregoing program can be stored in a computer readable storage medium. The program is executed to perform the steps of the above method embodiments; and the foregoing storage medium includes: ROM, RAM, magnetic disk or optical disk and various storage medium capable of storing program codes.

[0199] So far, the technical scheme of the present application has been described in combination with the preferred embodiments shown in the drawings, but those skilled in the art can easily understand that the protection scope of the present application is obviously not limited to these specific embodiments, and the above embodiments are only used to illustrate the technical scheme of the present application, but not to limit it; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical scheme recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical scheme deviate from the scope of the technical scheme of the embodiments of the present application.

Claims

1. A source tracing method, characterized in that, The method includes: Acquire tracing tasks and multiple tracing data; wherein, the tracing task includes the receiving end address and task type, and the multiple tracing data includes log data and alarm data; Calculate the correlation between the receiving end address and each piece of traceable data, and take the traceable data with a correlation greater than a preset first threshold as safe data; wherein, the safe information refers to abnormal data among the multiple traceable data; Based on the multiple security data, a first path is constructed; wherein, the first path refers to any one of a variety of paths from the sending end address to the receiving end address; Based on the task type, target data is determined from the plurality of source data, and a target model is determined from a plurality of preset analysis models; wherein, the target data refers to any one of the plurality of source data, and the target model refers to any one of the plurality of analysis models; The target data is input into the target model to obtain multiple target addresses; wherein, the multiple target addresses refer to addresses on multiple paths from the sending end address to the receiving end address; A second path is constructed based on the plurality of target addresses; wherein, the second path refers to any one of the multiple paths from the sending end address to the receiving end address other than the first path; A target path is generated based on the first path and the second path; wherein, the target path refers to any one of the multiple paths from the sending end address to the receiving end address, other than the first path and the second path.

2. The tracing method according to claim 1, characterized in that, The step of constructing a first path based on the multiple security data includes: Based on the multiple security data, profile data is calculated; wherein, the profile data is used to describe the data transmission process between the sending end address and the receiving end address; The first path is constructed based on the multiple source tracing data and the profile data.

3. The tracing method according to claim 1, characterized in that, The step of constructing a second path based on the multiple target addresses includes: Obtain the communication records of the multiple target addresses; The second path is constructed based on the multiple target addresses and the communication records.

4. The tracing method according to claim 1, characterized in that, After generating the target path based on the first path and the second path, the process further includes: The completeness of the target path is calculated according to the preset completeness calculation rules; When the completeness is less than a preset second threshold, an adjustment task is created based on the multiple traceability data, the traceability task, and the completeness. Perform the adjustment task to refine the target path.

5. The tracing method according to claim 1, characterized in that, The acquisition of the source tracing task and multiple source tracing data includes: Acquire data from the data source, shared data, and the tracing task; wherein the data source includes traffic data and update data, and the shared data includes communication data and configuration data; The source data and the shared data are preprocessed to obtain the traceability data.

6. The tracing method according to claim 1, characterized in that, The step of calculating the correlation between the receiving end address and each piece of traceability data, and selecting traceability data with a correlation greater than a preset first threshold as secure data, includes: Obtain the address information for each piece of traceability data; wherein the address information is used to describe the source of the traceability data; The correlation between the address information of each traceability data and the address of the receiving end is calculated, and the traceability data with a correlation greater than the first threshold is taken as the secure data.

7. A traceability device, characterized in that, include: The acquisition module is used to acquire tracing tasks and multiple tracing data; wherein, the tracing task includes the receiving end address and task type, and the multiple tracing data includes log data and alarm data; The first calculation module is used to calculate the correlation between the receiving end address and each of the traceability data, and to take the traceability data with a correlation greater than a preset first threshold as safe data; wherein, the safe information refers to abnormal data among the multiple traceability data; The first path construction module is used to construct a first path based on the plurality of security data; wherein, the first path refers to any one of a plurality of paths from the sending end address to the receiving end address; The determination module is used to determine target data from the plurality of source data according to the task type, and to determine target model from a plurality of preset analysis models; wherein, the target data refers to any one of the plurality of source data, and the target model refers to any one of the plurality of analysis models; The second calculation module is used to input the target data into the target model to obtain multiple target addresses; wherein, the multiple target addresses refer to addresses on multiple paths from the sending end address to the receiving end address; The second path construction module is used to construct a second path based on the plurality of target addresses; wherein, the second path refers to any one of the multiple paths from the sending end address to the receiving end address other than the first path; The path generation module is used to generate a target path based on the first path and the second path; wherein the target path refers to any one of the multiple paths from the sending end address to the receiving end address other than the first path and the second path.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; When the processor executes the computer execution instructions stored in the memory, it is used to implement the tracing method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the tracing method as described in any one of claims 1 to 6.

10. A computer program product comprising a computer program, which, when executed by a processor, is used to implement the tracing method as described in any one of claims 1 to 6.

Images