Network traffic cleaning method, device, server and medium

Abstract

The embodiments of the present invention disclose a network traffic cleaning method, device, server, and medium. The method includes: real-time monitoring of network traffic and analyzing traffic behavior characteristics to identify abnormal traffic patterns; determining the abnormal source IP address corresponding to the abnormal traffic pattern, and cleaning the abnormal traffic according to a preset abnormal traffic processing strategy, wherein the preset abnormal traffic processing strategy includes: when a first abnormal traffic pattern is detected, blocking all requests from the abnormal source IP address; when a second abnormal traffic pattern is detected, filtering only access requests from the abnormal source IP address to specific resources, while retaining access requests to other resources other than the specific resources; when a third abnormal traffic pattern is detected, filtering abnormal protocol data packets. By adopting the above technical solution, the accuracy and efficiency of traffic cleaning are improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data communication technology, and in particular to a network traffic cleaning method, device, server and medium. Background Art

[0002] Traffic cleaning is a network security protection service mainly used to defend against distributed denial of service (DDoS) attacks.

[0003] Traditional traffic cleaning systems monitor and analyze network traffic, identify and block abnormal traffic, and distinguish normal traffic from attack traffic, thereby protecting network services from attacks.

[0004] However, traditional traffic cleaning technology mainly relies on filtering traffic size or source IP addresses (Internet Protocol Address). For example, when the traffic of a certain IP address exceeds a preset threshold, it is directly blocked, or the blacklisted IP address is prohibited from accessing data. The above-mentioned "one-size-fits-all" traffic cleaning method is usually unable to perform precise traffic cleaning operations on specific IP addresses or resources. Such a processing method may result in some unnecessary traffic cleaning or fail to clear all abnormal traffic, thereby reducing the efficiency of network resource utilization and possibly increasing the cost of purchasing export traffic. Summary of the Invention

[0005] Embodiments of the present invention provide a network traffic cleaning method, device, server, and medium to improve the accuracy and efficiency of traffic cleaning, thereby reducing egress traffic, increasing the proportion of intranet traffic, and reducing procurement costs.

[0006] In a first aspect, the present invention provides a method for cleaning network traffic, the method comprising:

[0007] Monitor network traffic in real time and analyze traffic behavior characteristics to identify abnormal traffic patterns, wherein the traffic behavior characteristics include: request frequency of the source IP address, distribution of accessed resources, and protocol type; the abnormal traffic pattern includes any one of a first abnormal traffic pattern, a second abnormal traffic pattern, and a third abnormal traffic pattern; wherein the first abnormal traffic pattern is that the request frequency of the source IP address within a set time period reaches a first preset frequency threshold; the second abnormal traffic pattern is that the access frequency of the source IP address to a specific resource reaches a second preset frequency threshold; the specific resource is: a specific port, a specific uniform resource locator URL path, or the access frequency of a specific application programming interface API; the third abnormal traffic pattern is that the protocol type is abnormal;

[0008] Determine the abnormal source IP address corresponding to the abnormal traffic pattern and clean the abnormal traffic according to the preset abnormal traffic processing strategy, where the preset abnormal traffic processing strategy includes:

[0009] When the first abnormal traffic pattern is detected, all requests from the abnormal source IP address are blocked;

[0010] When the second abnormal traffic pattern is detected, only access requests from the abnormal source IP address to the specific resource are filtered, and access requests to other resources other than the specific resource are retained;

[0011] When the third abnormal traffic pattern is detected, abnormal protocol data packets are filtered.

[0012] Optionally, the method provided by the embodiment of the present invention further includes:

[0013] After cleaning abnormal traffic, the cleaned normal traffic will be redirected to the backup server or cloud-based platform, and the normal traffic will be monitored in real time.

[0014] Optionally, analyze traffic behavior characteristics to identify abnormal traffic patterns, including:

[0015] Based on the abnormal traffic cleaning model, traffic behavior characteristics are analyzed to identify abnormal traffic patterns;

[0016] Accordingly, the abnormal source IP address corresponding to the abnormal traffic pattern is determined, and abnormal traffic is cleaned according to the preset abnormal traffic processing strategy, including:

[0017] Based on the abnormal traffic cleaning model, when an abnormal traffic pattern is identified, an abnormal traffic processing strategy corresponding to the abnormal traffic pattern is determined, wherein the abnormal traffic cleaning model establishes a correlation between traffic behavior characteristics and abnormal traffic processing strategies;

[0018] Abnormal traffic cleaning is performed according to the preset abnormal traffic processing strategy.

[0019] Optionally, the abnormal traffic cleaning model is trained as follows:

[0020] Obtaining network traffic, and obtaining new attack samples from an open threat intelligence platform, and obtaining abnormal traffic processing strategies corresponding to the new attack samples, wherein the network traffic includes normal traffic and attack traffic;

[0021] Annotating the network traffic, and using the annotated network traffic and the new attack sample as sample data;

[0022] The sample data is input into the abnormal traffic cleaning model for training. When the value of the loss function of the abnormal traffic cleaning model reaches convergence, the abnormal traffic cleaning model training is completed. The trained abnormal traffic cleaning model can establish a correlation between traffic behavior characteristics and abnormal traffic processing strategies, wherein the loss function is:

[0023] y=y1+y2+λ3y3+y4,

[0024] Where y1 = λ1y 11 +λ2y 12 ,

[0025]

[0026] Among them, y1 represents the anomaly detection loss subfunction, y 11 represents the classification cross entropy loss, y 12 represents the autoencoder reconstruction loss, y i ∈{0,1} represents the true label of the i-th sample. When i=1, it indicates abnormal traffic, and when i=0, it indicates normal traffic. represents the predicted probability of the model for the i-th sample, λ1 represents the hyperparameter used to control the importance of the classification task, It represents the feature vector obtained after the i-th sample passes through the multimodal feature fusion module. Encoder() represents the encoder part of the autoencoder, which is used to combine the fusion features is compressed into a low-dimensional potential representation; Decoder() represents the decoder part of the autoencoder, which is used to reconstruct the original fusion features from the potential representation, ‖·‖2 represents the Euclidean distance (L2 norm), λ2 represents the hyperparameter that controls the importance of the reconstruction task, and π θ (a t |s t ) represents the current policy network with parameter θ in state s t Next select action a t probability; Denote the parameter θ old The old policy network is in state s t Next select action a t The probability of A t =Q(s t ,a t )-V(s t ) represents the advantage function, Q(s t ,a t ) represents the state-action value function, V(s t ) represents the state value function; ε represents the cutoff threshold; the clip function represents the policy update ratio in the interval [1-ε,1+ε]; E trepresents the expectation at time t, and N represents the total number of samples; represents the spatial feature vector of the i-th sample, represents the time feature vector of the i-th sample, the sim function represents the cosine similarity; τ represents the temperature coefficient, K represents the number of negative samples, θ i Represents the current i-th parameter of the model, θ old,i represents the i-th parameter of the historical model, F i represents the parameter θ i The diagonal elements of the Fisher information matrix; λ ewc represents the regularization strength coefficient.

[0027] Optionally, the method provided by the embodiment of the present invention further includes:

[0028] Determine the peak service period of the current network based on historical traffic data of the current network;

[0029] When the service peak period is reached, the first preset frequency threshold and the second preset frequency threshold are increased.

[0030] In a second aspect, an embodiment of the present invention further provides a network traffic cleaning device, the device comprising:

[0031] The traffic behavior feature analysis module is configured to monitor network traffic in real time and analyze traffic behavior features to identify abnormal traffic patterns, wherein the traffic behavior features include: request frequency of the source IP address, access resource distribution and protocol type, and the abnormal traffic pattern includes any one of a first abnormal traffic pattern, a second abnormal traffic pattern and a third abnormal traffic pattern, wherein the first abnormal traffic pattern is that the request frequency of the source IP address within a set time period reaches a first preset frequency threshold, the second abnormal traffic pattern is that the access frequency of the source IP address to a specific resource reaches a second preset frequency threshold, and the specific resource is: a specific port, a specific uniform resource locator URL path, or an access frequency of a specific application programming interface API; the third abnormal traffic pattern is an abnormal protocol type;

[0032] The abnormal traffic cleaning module is configured to determine the abnormal source IP address corresponding to the abnormal traffic pattern and clean the abnormal traffic according to a preset abnormal traffic processing strategy, wherein the preset abnormal traffic processing strategy includes:

[0033] When the first abnormal traffic pattern is detected, all requests from the abnormal source IP address are blocked;

[0034] When the second abnormal traffic pattern is detected, only access requests from the abnormal source IP address to the specific resource are filtered, and access requests to other resources other than the specific resource are retained;

[0035] When the third abnormal traffic pattern is detected, abnormal protocol data packets are filtered.

[0036] Optionally, the apparatus provided by the embodiment of the present invention further includes:

[0037] The normal traffic redirection module is configured to redirect the cleaned normal traffic to a backup server or cloud-based platform after cleaning the abnormal traffic, and to monitor the normal traffic in real time.

[0038] Optionally, the traffic behavior feature analysis module is specifically configured to:

[0039] Based on the abnormal traffic cleaning model, traffic behavior characteristics are analyzed to identify abnormal traffic patterns;

[0040] Accordingly, the abnormal traffic cleaning module is specifically configured as follows:

[0041] Based on the abnormal traffic cleaning model, when an abnormal traffic pattern is identified, determining an abnormal traffic processing strategy corresponding to the abnormal traffic pattern, wherein the abnormal traffic cleaning model establishes an association between traffic behavior characteristics and abnormal traffic processing strategies;

[0042] Abnormal traffic cleaning is performed according to the preset abnormal traffic processing strategy.

[0043] Optionally, the abnormal traffic cleaning model is trained as follows:

[0044] Obtaining network traffic, and obtaining new attack samples from an open threat intelligence platform, and obtaining abnormal traffic processing strategies corresponding to the new attack samples, wherein the network traffic includes normal traffic and attack traffic;

[0045] Annotating the network traffic, and using the annotated network traffic and the new attack sample as sample data;

[0046] The sample data is input into the abnormal traffic cleaning model for training. When the value of the loss function of the abnormal traffic cleaning model reaches convergence, the abnormal traffic cleaning model training is completed. The trained abnormal traffic cleaning model can establish a correlation between traffic behavior characteristics and abnormal traffic processing strategies, wherein the loss function is:

[0047] y=y1+y2+λ3y3+y4,

[0048] Where y1 = λ1y 11 +λ2y 12 ,

[0049]

[0050] Among them, y1 represents the anomaly detection loss subfunction, y 11 represents the classification cross entropy loss, y 12 represents the autoencoder reconstruction loss, y i ∈{0,1} represents the true label of the i-th sample. When i=1, it indicates abnormal traffic, and when i=0, it indicates normal traffic. represents the predicted probability of the model for the i-th sample, λ1 represents the hyperparameter used to control the importance of the classification task, It represents the feature vector obtained after the i-th sample passes through the multimodal feature fusion module. Encoder() represents the encoder part of the autoencoder, which is used to combine the fusion features is compressed into a low-dimensional potential representation; Decoder() represents the decoder part of the autoencoder, which is used to reconstruct the original fusion features from the potential representation, ‖·‖2 represents the Euclidean distance (L2 norm), λ2 represents the hyperparameter that controls the importance of the reconstruction task, and π θ (a t |s t ) represents the current policy network with parameter θ in state s t Next select action a t probability; Denote the parameter θ old The old policy network is in state s t Next select action a t The probability of A t =Q(s t ,a t )-V(s t ) represents the advantage function, Q(s t ,a t ) represents the state-action value function, V(s t ) represents the state value function; ε represents the cutoff threshold; the clip function represents the policy update ratio in the interval [1-ε,1+ε]; E t represents the expectation at time t, and N represents the total number of samples; represents the spatial feature vector of the i-th sample, represents the time feature vector of the i-th sample, the sim function represents the cosine similarity; τ represents the temperature coefficient, K represents the number of negative samples, θ i Represents the current i-th parameter of the model, θ old,i represents the i-th parameter of the historical model, F i represents the parameter θ i The diagonal elements of the Fisher information matrix; λ ewc represents the regularization strength coefficient.

[0051] Optionally, the apparatus provided by the embodiment of the present invention further includes:

[0052] A service peak period determination module is configured to determine the service peak period of the current network based on historical traffic data of the current network;

[0053] The threshold dynamic adjustment module is configured to increase the first preset frequency threshold and the second preset frequency threshold when the business peak period is reached.

[0054] In a third aspect, an embodiment of the present invention further provides a server, including:

[0055] a memory storing executable program code;

[0056] a processor coupled to the memory;

[0057] The processor calls the executable program code stored in the memory to execute the network traffic cleaning method provided by any embodiment of the present invention.

[0058] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network traffic cleaning method provided by any embodiment of the present invention.

[0059] The technical solutions provided by the embodiments of the present invention set corresponding traffic processing strategies for different abnormal traffic patterns. By analyzing traffic behavior characteristics and identifying abnormal traffic patterns, the corresponding abnormal traffic processing strategies can be adopted to achieve higher-precision abnormal traffic cleaning, avoiding the unnecessary traffic loss caused by traditional traffic cleaning systems that directly block all requests from the source IP address. The technology provided by the embodiments of the present invention can reduce egress traffic and improve the stability and security of network services.

[0060] The innovative features of the embodiments of the present invention include:

[0061] 1. When the access frequency of an IP address to a specific resource reaches a second preset frequency threshold, only the access request of the abnormal source IP address to the specific resource is shielded, rather than blocking the access request of the entire IP address, that is, retaining the access request to other resources other than the specific resource. While cleaning abnormal traffic, unnecessary traffic cleaning is avoided, reducing the loss of normal traffic, improving the accuracy and efficiency of traffic cleaning, thereby reducing export traffic, increasing the proportion of the intranet and reducing procurement costs. This is one of the innovations of the embodiment of the present invention.

[0062] 2. By training the abnormal traffic cleaning model, an association between traffic behavior characteristics and corresponding abnormal traffic processing strategies can be established, which provides an end-to-end approach to achieve abnormal traffic cleaning, effectively improving the detection, processing accuracy and efficiency of abnormal traffic, which is one of the innovations of the embodiments of the present invention.

[0063] 3. The abnormal traffic cleaning model adopts a structure that includes a multimodal feature extraction module, a multimodal feature fusion module, an abnormal traffic monitoring module and a strategy generation module. This structure can effectively improve the accuracy and cleaning efficiency of abnormal traffic cleaning by integrating spatiotemporal analysis, graph structure modeling and reinforcement learning, which is one of the innovations of the embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0065] Figure 1 A flowchart of a network traffic cleaning method provided in Example 1 of the present invention;

[0066] Figure 2a A flowchart of a network traffic cleaning method provided in Example 2 of the present invention;

[0067] Figure 2b A schematic diagram of the structure of an abnormal traffic situation model provided in the second embodiment of the present invention;

[0068] Figure 3 This is a structural block diagram of a network traffic cleaning device provided in Example 3 of the present invention;

[0069] Figure 4 A schematic diagram of the structure of a server provided in embodiment 4 of the present invention. DETAILED DESCRIPTION

[0070] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.

[0071] It should be noted that the terms "including," "having," and any variations thereof in the embodiments of the present invention and the accompanying drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to the process, method, product, or apparatus.

[0072] The embodiments of the present invention disclose a network traffic cleaning method, device, server, and medium, which are described in detail below.

[0073] Example 1

[0074] Figure 1 This is a flow chart of a network traffic cleaning method provided in the first embodiment of the present invention. This method can be applied to the application scenario of resisting DDoS attacks. The method provided in this embodiment can be executed by a network traffic cleaning device, which can be implemented in software and / or hardware. Figure 1 As shown, the method provided in this embodiment specifically includes:

[0075] S110. Monitor network traffic in real time and analyze traffic behavior characteristics to identify abnormal traffic patterns.

[0076] Network traffic refers to the data packets or data streams transmitted over a network. Specifically, it can include: request and response data generated by users accessing servers (such as web page access and file downloads); communication data between servers (such as data synchronization and API calls); and potentially abnormal or malicious data (such as DDoS attack traffic and high-frequency invalid requests). Network traffic typically exists in the form of data packets, containing information such as the source IP address, destination IP address, port number, protocol type, and data volume.

[0077] For real-time monitoring of network traffic, the specific monitoring method can be implemented using software and / or hardware. For example, a network monitoring tool can be used to capture and analyze data packets, such as Wireshark (a network protocol analyzer commonly used to capture and analyze network data packets) or tcpdump (a network data collection and analysis tool). Alternatively, when monitoring network traffic, a network tap (Test Access Point or Terminal Access Point, TAP) can be used to directly access the physical link and mirror the network traffic to the monitoring device. Alternatively, a Switched Port Analyzer (SPAN) can be used to copy the traffic of a designated port to the monitoring port through switch configuration. This embodiment does not specifically limit the method for monitoring network traffic.

[0078] Furthermore, the network traffic captured in real time can be preprocessed, for example, removing duplicate, invalid or noisy data (such as broadcast packets), or standardizing the data format (such as a unified timestamp format, IP address encoding), etc.

[0079] In this embodiment, the pre-processed network traffic is analyzed for traffic behavior characteristics to identify abnormal traffic patterns. The traffic behavior characteristics include: the request frequency of the source IP address, the distribution of accessed resources, and the protocol type; the abnormal traffic pattern includes any one or more of a first abnormal traffic pattern, a second abnormal traffic pattern, and a third abnormal traffic pattern. The first abnormal traffic pattern is when the request frequency of the source IP (Internet Protocol) address within a set time period reaches a first preset frequency threshold; the second abnormal traffic pattern is when the access frequency of the source IP address to a specific resource reaches a second preset frequency threshold, where the specific resource is: a specific port, a URL (Uniform Resource Locator) path, or the access frequency of a specific API (Application Programming Interface); and the third abnormal traffic pattern is when the protocol type is abnormal.

[0080] S120: Determine the abnormal source IP address corresponding to the abnormal traffic pattern, and clean the abnormal traffic according to the preset abnormal traffic processing strategy.

[0081] The preset abnormal traffic handling strategies include:

[0082] (1) When the first abnormal traffic pattern is detected, all requests from the abnormal source IP address are blocked.

[0083] For example, the traffic cleaning system of the present invention is deployed in the global data center of a certain e-commerce platform. Since the platform has a large amount of user and transaction data, it is easy to become a target of DDoS attacks. By adopting the traffic cleaning method provided by this embodiment, the platform can monitor the access traffic of each user IP in real time. Once an abnormal access volume of a specific IP address is detected, for example, an IP initiates 10,000 requests within 1 second, which far exceeds normal user behavior, the system will quickly screen and block all request traffic of the IP address, and at the same time re-inject normal user request traffic into the intranet, avoiding the waste of system resources caused by attack traffic. Through this method, the occupation of its export bandwidth by external traffic can be successfully reduced, reducing the procurement cost of external traffic bandwidth.

[0084] (2) When the second abnormal traffic pattern is detected, only the access requests of the abnormal source IP address to the specific resource are blocked, and the access requests to other resources other than the specific resource are retained.

[0085] In related technologies, when the second abnormal traffic pattern is detected, a "one-size-fits-all" traffic cleaning method is adopted, that is, all access requests corresponding to the abnormal IP address are blocked. In this embodiment, the purpose of setting the abnormal traffic processing strategy corresponding to the second abnormal traffic model is: when the access frequency of the IP address to a specific resource reaches the second preset frequency threshold, only the access request of the abnormal source IP address to the specific resource is blocked, rather than blocking the access request of the entire IP address, that is, retaining the access request to other resources other than the specific resource. While achieving the cleaning of abnormal traffic, unnecessary traffic cleaning is avoided, the loss of normal traffic is reduced, and the accuracy and efficiency of traffic cleaning are improved, thereby reducing egress traffic, increasing the proportion of the intranet, and reducing procurement costs.

[0086] For example, when a certain ISP (Internet service provider) implements large-scale DDoS defense, it uses the traffic cleaning and screening method of the present invention to carry out refined management of network traffic. By analyzing the traffic patterns of different IP addresses and access resources, it is found that some IP source traffic is large and there are abnormal access behaviors, such as initiating high-frequency call requests for a certain API interface (for example, 300 times per second). The system only filters access requests from abnormal source IP addresses to specific resources, and retains access requests to other resources other than specific resources. While blocking abnormal access requests to specific resources, it retains normal access to other resources. Through intelligent scheduling, the traffic cleaning system can inject the remaining clean traffic into the operator's intranet, which improves the utilization rate of the intranet and reduces the procurement cost of export traffic.

[0087] (3) When the third abnormal traffic pattern is detected, the abnormal protocol data packet is discarded.

[0088] For example, when a protocol type anomaly is detected, such as when a forged TCP (Transmission Control Protocol) / UDP (User Datagram Protocol, a protocol of the transport layer in the open systems interconnection model) packet is detected, or when a data packet format error is detected, the abnormal protocol data packet is filtered.

[0089] It should be noted that, in this embodiment, the first preset frequency threshold corresponding to the first abnormal traffic pattern and the second preset frequency threshold corresponding to the second abnormal traffic pattern can be set according to the requirements of the actual application scenario. For example, the first preset frequency threshold can be obtained by analyzing the historical traffic data of the current network and counting the overall access traffic of each IP. The second preset frequency threshold can be obtained by analyzing the historical traffic data of the current network and counting the access frequency of each IP to a specific port, a specific URL path, or the call frequency of the API interface.

[0090] Furthermore, the first preset frequency threshold and the second preset frequency threshold can also be set in a dynamic adjustment manner. Specifically, the overall access traffic of each IP in different time periods and the access traffic of each IP to specific resources in different time periods can be determined based on the historical traffic data of the current network, so that the first preset frequency threshold and the second preset frequency threshold can be dynamically adjusted according to the traffic conditions in different time periods. For example, the business peak period of the current network can be determined based on the historical traffic data of the current network (for example, the peak period is from 1 hour before to 3 hours after the end of an e-commerce promotion, or the opening / closing period of a trading day in the financial sector and the month-end settlement period; the morning and evening commuting time of social media (such as 7-9 am and 6-8 pm) is the peak period); when the business peak period is reached, the first preset frequency threshold and the second preset frequency threshold are increased. By dynamically increasing the threshold, the system can focus on abnormal traffic that exceeds the adjusted threshold, thereby reducing the misjudgment of legitimate high traffic and maintaining business continuity and user satisfaction.

[0091] In this embodiment, corresponding traffic processing strategies are set for different abnormal traffic patterns. By analyzing traffic behavior characteristics and identifying abnormal traffic patterns, the corresponding abnormal traffic processing strategy is adopted to achieve higher-precision abnormal traffic cleaning, avoiding the unnecessary traffic loss caused by traditional traffic cleaning systems that directly block all requests from the source IP address. The technology provided by this embodiment can reduce egress traffic and improve the stability and security of network services.

[0092] Furthermore, after cleaning the abnormal traffic, the cleaned normal traffic is redirected to a backup server or cloud-based platform, and the normal traffic is monitored in real time.

[0093] For example, a deep learning model can be used to analyze traffic characteristics (such as request type, user location, and server load) in real time to dynamically select the optimal backup node or cloud platform. This setup can adapt to network fluctuations and improve resource utilization.

[0094] For example, the distributed architecture of edge nodes can be used to deploy a lightweight traffic scheduler, and combined with the geographic location database (GeoIP), the cleaned traffic can be distributed preferentially to the edge computing node closest to the user (such as CDN edge server, 5G MEC (Multi-access Edge Computing, edge cloud), etc.). This setting can reduce latency and improve user experience.

[0095] Example 2

[0096] Figure 2a This is a flow chart of a network traffic cleaning method provided by the second embodiment of the present invention. Based on the above embodiments, this embodiment optimizes the process of determining the abnormal traffic processing strategy. By training the abnormal traffic cleaning model, the corresponding abnormal traffic processing strategy can be determined according to the traffic behavior characteristics, which provides an end-to-end way to achieve abnormal traffic cleaning. Figure 2a As shown, the method provided in this embodiment includes:

[0097] S210. Monitor network traffic in real time.

[0098] S220: Analyze traffic behavior characteristics based on the abnormal traffic cleaning model, and when an abnormal traffic pattern is identified, determine a preset abnormal traffic processing strategy corresponding to the abnormal traffic pattern.

[0099] Among them, the abnormal traffic cleaning model is a deep learning model. Figure 2b This is a structural diagram of an abnormal traffic situation model provided by the second embodiment of the present invention, such as Figure 2b As shown, the abnormal traffic cleaning model includes: multimodal feature extraction module 1, multimodal feature fusion module 2, abnormal traffic monitoring module 3, and strategy generation module 4. The structure and function of each module are introduced in detail below.

[0100] Multimodal feature extraction module 1, used to extract preliminary features of traffic packet data, including 3D spatiotemporal features, temporal features, graph embedding features, and semantic features;

[0101] Multimodal feature fusion module 2, used to integrate multimodal features to form a global context representation;

[0102] Abnormal traffic detection module 3, used to determine whether the traffic is abnormal based on the fused features and identify the type of abnormality (such as DDoS, port scanning);

[0103] The policy generation module 4 is used to output an abnormal traffic processing policy based on the abnormality type and the current network status (such as bandwidth utilization and server load).

[0104] Below, the structure and function of each module are introduced in detail.

[0105] (1) Multimodal feature extraction module

[0106] The multimodal feature extraction module specifically includes the first convolutional layer, long short-term memory network, graph attention network (GAT) and embedding layer in parallel, where:

[0107] 3D convolutional layer, used to extract 3D spatiotemporal features of traffic packet data;

[0108] Long short-term memory networks are used to extract temporal features of traffic packet data, such as capturing long-term traffic trends (such as periodic access) and short-term abnormal fluctuations (such as DDoS bursts);

[0109] The graph attention network is used to process network topology information and generate embedded representations of nodes (IPs) and links (traffic paths), that is, to obtain node embedding vectors and link risk scores.

[0110] Embedding layer, which encodes IP and resources into vectors.

[0111] (2) Multimodal feature fusion module

[0112] The multimodal feature fusion module is used to receive the feature information of the four branches output by the multimodal feature extraction module, and map the features of each modality to a unified dimension through a fully connected layer. Then, a multi-head attention mechanism can be used to integrate multimodal features to form a global context representation, that is, the output of the multimodal feature fusion module is a fused global feature vector, which includes the spatiotemporal pattern of traffic, network topology associations, and resource access semantics. In this embodiment, the advantage of using a multi-head attention mechanism is that it can automatically adjust the importance of each modality according to the context, suppress the interference of low-quality modal features, and significantly improve the model's ability to detect complex abnormal traffic.

[0113] The multi-head attention mechanism integrates multimodal features through the following process: The multi-head attention mechanism involves multiple attention heads, each of which calculates its own query, key, and value matrix. Each head then calculates the attention weight, multiplies it by the value matrix, and finally concatenates the outputs of all heads and performs a linear transformation to obtain the final result, which can be expressed as follows:

[0114] Setting the number of attention heads H = 8 means splitting the input features into 8 independent attention heads for parallel computation, with each head dimension d k =d v =8, the query and key dimensions of each attention head are dk , the value dimension is d v , both of them are 8 here.

[0115] The query matrix of the h-th head (Q h ), key matrix (K h ), value matrix (V h ) is generated as follows:

[0116]

[0117] Where F′ represents the input feature matrix, represents a learnable parameter.

[0118] The attention weight of the h-th head is calculated as follows:

[0119]

[0120] Multi-head splicing and linear transformation:

[0121] MultiHead(F′)=Concat(Attention1,…,Attention H )W O ;

[0122] Among them, MultiHead(F′) represents the result of linear transformation, and Concat() represents concatenating the outputs of the eight heads in the feature dimension to obtain the concatenated matrix; Represents the output projection matrix, which is used to map the stitching result back to the original input dimension D to ensure the consistency of input and output dimensions.

[0123] (3) Abnormal traffic detection module

[0124] The abnormal traffic detection module receives the global context features output by the multimodal feature fusion module and uses an autoencoder to compress normal traffic into a low-dimensional representation. The decoder reconstructs the input, and the autoencoder performs error reconstruction. The larger the reconstruction error, the more likely the traffic is abnormal. The fully connected layer then outputs the anomaly type (such as DDoS or port scanning).

[0125] (4) Strategy Generation Module

[0126] The policy generation module uses a policy network based on reinforcement learning (RL) to output cleaning policies (such as blocking all access requests from an IP address, filtering IP access requests to specific resources, or filtering abnormal protocol data) based on the anomaly type and current network status (such as bandwidth utilization and server load).

[0127] The training process of the above abnormal traffic cleaning model is implemented through the following steps A to D:

[0128] A. Obtain network traffic, obtain new attack samples from an open threat intelligence platform, and obtain abnormal traffic processing strategies corresponding to the new attack samples.

[0129] Among them, network traffic includes normal traffic and attack traffic.

[0130] B. Label the network traffic and use the labeled network traffic and new attack samples as sample data.

[0131] C. Input the sample data into the abnormal traffic cleaning model for training. When the value of the loss function of the abnormal traffic cleaning model reaches convergence, the training of the abnormal traffic cleaning model is completed.

[0132] The trained abnormal traffic cleaning model can establish the correlation between traffic behavior characteristics and abnormal traffic processing strategies. The loss function y is composed of four parts: anomaly detection loss sub-function y1, strategy generation loss sub-function y2, multimodal consistency loss sub-function y3 and continuous learning regularization loss sub-function y4, that is, y = y1 + y2 + λ3y3 + y4

[0133] Among them, the anomaly detection loss subfunction is used to minimize the anomaly classification error and reconstruction error and improve the detection accuracy. The anomaly detection loss subfunction y1 is composed of the classification cross entropy loss y 11 and the autoencoder reconstruction loss y 12 Composition, that is, y1=λ1y 11 +λ2y 12 ,in,

[0134]

[0135] Among them, y i ∈{0,1} represents the true label of the i-th sample. When i=1, it indicates abnormal traffic, and when i=0, it indicates normal traffic. It represents the model's predicted probability for the i-th sample, indicating the probability that the sample is judged to be abnormal, and its value range is [0, 1]. λ1 represents a hyperparameter used to control the importance of the classification task.

[0136]

[0137] in, It represents the feature vector obtained after the i-th sample passes through the multimodal feature fusion module, which is the fused global context information; Encoder() represents the encoder part of the autoencoder, which is used to convert the fused features into is compressed into a low-dimensional latent representation; Decoder() represents the decoder part of the autoencoder, which is used to reconstruct the original fused features from the latent representation; ||·||2 represents the Euclidean distance (L2 norm), which is used to measure the difference between the original features and the reconstructed features; λ2 represents the hyperparameter that controls the importance of the reconstruction task.

[0138] In this embodiment, the above-mentioned anomaly detection loss sub-function jointly optimizes classification accuracy and feature reconstruction capability, so that the model can not only distinguish abnormal traffic but also learn the potential distribution of normal traffic, thereby enhancing the detection capability of unknown attacks.

[0139] In addition, the strategy generation loss sub-function y2 can be expressed by the following formula:

[0140]

[0141] Among them, π θ (a t |s t ) represents the current policy network with parameter θ in state s t Next select action a t probability; Denote the parameter θ old The old policy network is in state s t Next select action a t The probability of A t =Q(s t ,a t )-V(s t ) represents the advantage function, which is used to measure the t Next select action a t Compared with the long-term value improvement of the average strategy, Q(s t ,a t ) represents the state-action value function, V(s t ) represents the state value function; ε represents the cutoff threshold, which is used to prevent the difference between the new and old strategies from being too large and to ensure the stability of training; the clip function represents the policy update ratio in the interval [1-ε, 1+ε]; E t represents the expectation at time step t.

[0142] In this embodiment, the above strategy generates a loss sub-function, and the new strategy π is updated by the magnitude of the current strategy. θ No deviation from old strategies Too far to ensure the stability of training.

[0143] In addition, for the multimodal consistency loss sub-function, the specific formula is:

[0144]

[0145] Where N represents the total number of samples; represents the spatial feature vector of the i-th sample, represents the time feature vector of the i-th sample; the sim function represents the cosine similarity; τ represents the temperature coefficient, which is usually a constant and is used to adjust the sharpness of the similarity distribution; K represents the number of negative samples.

[0146] In this embodiment, by setting a multimodal consistency damage sub-function, it is possible to ensure that different modal features can maintain semantic alignment after fusion, thereby improving feature complementarity.

[0147] In addition, for the continuous learning regularization loss sub-function, the specific formula is:

[0148]

[0149] Among them, θ i Represents the current i-th parameter of the model, θ old,i represents the i-th parameter of the historical model; F i represents the parameter θ i The diagonal elements of the Fisher Information Matrix (Fisher Information Matrix), λ ewc Represents the regularization strength coefficient, which is used to control the strictness of the historical parameter constraints.

[0150] In this embodiment, by setting a continuous learning regularization loss sub-function, the model's previous historical attack patterns can be prevented and dynamic updates of the model can be supported.

[0151] In this embodiment, by adopting the above-mentioned anomaly detection loss sub-function, strategy generation loss sub-function, multimodal consistency loss sub-function and continuous learning regularization loss sub-function to form the damage function of the abnormal traffic cleaning model, the detection accuracy of the model can be effectively improved.

[0152] S230: Clean abnormal traffic according to the preset abnormal traffic processing strategy.

[0153] In this embodiment, by training the abnormal traffic cleaning model, an association between traffic behavior characteristics and corresponding abnormal traffic processing strategies can be established, that is, an end-to-end approach is provided to achieve abnormal traffic cleaning, effectively improving the detection and processing accuracy and efficiency of abnormal traffic.

[0154] Example 3

[0155] Figure 3 This is a structural block diagram of a network traffic cleaning device provided by the third embodiment of the present invention, such as Figure 3As shown, the device includes: a traffic behavior feature analysis module 310 and an abnormal traffic cleaning module 320, wherein,

[0156] The traffic behavior feature analysis module 310 is configured to monitor network traffic in real time and analyze traffic behavior features to identify abnormal traffic patterns, wherein the traffic behavior features include: request frequency of the source IP address, access resource distribution and protocol type, and the abnormal traffic pattern includes any one of a first abnormal traffic pattern, a second abnormal traffic pattern and a third abnormal traffic pattern, wherein the first abnormal traffic pattern is that the request frequency of the source IP address within a set time period reaches a first preset frequency threshold, and the second abnormal traffic pattern is that the access frequency of the source IP address to a specific resource reaches a second preset frequency threshold, and the specific resource is: a specific port, a specific uniform resource locator URL path, or an access frequency of a specific application programming interface API; the third abnormal traffic pattern is an abnormal protocol type;

[0157] The abnormal traffic cleaning module 320 is configured to determine the abnormal source IP address corresponding to the abnormal traffic pattern and clean the abnormal traffic according to a preset abnormal traffic processing strategy, wherein the preset abnormal traffic processing strategy includes:

[0158] When the first abnormal traffic pattern is detected, all requests from the abnormal source IP address are blocked;

[0159] When the second abnormal traffic pattern is detected, only access requests from the abnormal source IP address to the specific resource are filtered, and access requests to other resources other than the specific resource are retained;

[0160] When the third abnormal traffic pattern is detected, abnormal protocol data packets are filtered.

[0161] Optionally, the apparatus provided by the embodiment of the present invention further includes:

[0162] The normal traffic redirection module is configured to redirect the cleaned normal traffic to a backup server or cloud-based platform after cleaning the abnormal traffic, and to monitor the normal traffic in real time.

[0163] Optionally, the traffic behavior feature analysis module is specifically configured to:

[0164] Based on the abnormal traffic cleaning model, traffic behavior characteristics are analyzed to identify abnormal traffic patterns;

[0165] Accordingly, the abnormal traffic cleaning module is specifically configured as follows:

[0166] Based on the abnormal traffic cleaning model, when an abnormal traffic pattern is identified, determining an abnormal traffic processing strategy corresponding to the abnormal traffic pattern, wherein the abnormal traffic cleaning model establishes an association between traffic behavior characteristics and abnormal traffic processing strategies;

[0167] Abnormal traffic cleaning is performed according to the preset abnormal traffic processing strategy.

[0168] Optionally, the abnormal traffic cleaning model is trained as follows:

[0169] Obtaining network traffic, and obtaining new attack samples from an open threat intelligence platform, and obtaining abnormal traffic processing strategies corresponding to the new attack samples, wherein the network traffic includes normal traffic and attack traffic;

[0170] Annotating the network traffic, and using the annotated network traffic and the new attack sample as sample data;

[0171] The sample data is input into the abnormal traffic cleaning model for training. When the value of the loss function of the abnormal traffic cleaning model reaches convergence, the abnormal traffic cleaning model training is completed. The trained abnormal traffic cleaning model can establish a correlation between traffic behavior characteristics and abnormal traffic processing strategies, wherein the loss function is:

[0172] y=y1+y2+λ3y3+y4,

[0173] Where y1 = λ1y 11 +λ2y 12 ,

[0174]

[0175] Among them, y1 represents the anomaly detection loss subfunction, y 11 represents the classification cross entropy loss, y 12 represents the autoencoder reconstruction loss, y i ∈{0,1} represents the true label of the i-th sample. When i=1, it indicates abnormal traffic, and when i=0, it indicates normal traffic. represents the predicted probability of the model for the i-th sample, λ1 represents the hyperparameter used to control the importance of the classification task, It represents the feature vector obtained after the i-th sample passes through the multimodal feature fusion module. Encoder() represents the encoder part of the autoencoder, which is used to combine the fusion features is compressed into a low-dimensional potential representation; Decoder() represents the decoder part of the autoencoder, which is used to reconstruct the original fusion features from the potential representation, ||·||2 represents the Euclidean distance (L2 norm), λ2 represents the hyperparameter that controls the importance of the reconstruction task, and πθ (a t |s t ) represents the current policy network with parameter θ in state s t Next select action a t probability; Denote the parameter θ old The old policy network is in state s t Next select action a t The probability of A t =Q(s t ,a t )-V(s t ) represents the advantage function, Q(s t ,a t ) represents the state-action value function, V(s t ) represents the state value function; ε represents the cutoff threshold; the clip function represents the policy update ratio in the interval [1-ε,1+ε]; E t represents the expectation at time t, and N represents the total number of samples; represents the spatial feature vector of the i-th sample, represents the time feature vector of the i-th sample, the sim function represents the cosine similarity; τ represents the temperature coefficient, K represents the number of negative samples, θ i Represents the current i-th parameter of the model, θ old,i represents the i-th parameter of the historical model, F i represents the parameter θ i The diagonal elements of the Fisher information matrix; λ ewc represents the regularization strength coefficient.

[0176] Optionally, the apparatus provided by the embodiment of the present invention further includes:

[0177] A service peak period determination module is configured to determine the service peak period of the current network based on historical traffic data of the current network;

[0178] The threshold dynamic adjustment module is configured to increase the first preset frequency threshold and the second preset frequency threshold when the business peak period is reached.

[0179] Example 4

[0180] See also Figure 4 , Figure 4 A schematic diagram of the structure of a server provided in embodiment 4 of the present invention.

[0181] like Figure 4 As shown, the server may include:

[0182] A memory 701 storing executable program code;

[0183] a processor 702 coupled to the memory 701;

[0184] The processor 702 calls the executable program code stored in the memory 701 to execute the network traffic cleaning method provided by any embodiment of the present invention.

[0185] An embodiment of the present invention discloses a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the network traffic cleaning method provided by any embodiment of the present invention.

[0186] In various embodiments of the present invention, it should be understood that the size of the serial numbers of the above-mentioned processes does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0187] In the embodiments provided herein, it should be understood that "B corresponding to A" means that B is associated with A and B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B based solely on A; B can also be determined based on A and / or other information.

[0188] In addition, the functional units in the embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0189] If the above-mentioned integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-accessible memory. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several requests for causing a computer device (which can be a personal computer, server, or network device, specifically a processor in the computer device) to execute some or all of the steps of the above-mentioned methods of various embodiments of the present invention.

[0190] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program. The program can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium capable of carrying or storing data.

[0191] Those skilled in the art will appreciate that the accompanying drawings are merely schematic diagrams of an embodiment, and the modules or processes in the accompanying drawings are not necessarily required to implement the present invention.

[0192] Those skilled in the art will appreciate that the modules in the apparatuses of the embodiments may be distributed in the apparatuses of the embodiments as described in the embodiments, or may be located in one or more apparatuses different from the embodiments with corresponding changes. The modules in the above embodiments may be combined into one module or further divided into multiple sub-modules.

[0193] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network traffic cleaning method, characterized in that: include: Monitor network traffic in real time and analyze traffic behavior characteristics to identify abnormal traffic patterns, wherein the traffic behavior characteristics include: request frequency of the source IP address, access resource distribution and protocol type, and the abnormal traffic pattern includes any one or more of a first abnormal traffic pattern, a second abnormal traffic pattern and a third abnormal traffic pattern, wherein the first abnormal traffic pattern is that the request frequency of the source IP address within a set time period reaches a first preset frequency threshold, the second abnormal traffic pattern is that the access frequency of the source IP address to a specific resource reaches a second preset frequency threshold, and the specific resource is: a specific port, a specific uniform resource locator URL path, or the access frequency of a specific application programming interface API; the third abnormal traffic pattern is an abnormal protocol type; Determine the abnormal source IP address corresponding to the abnormal traffic pattern, and perform abnormal traffic cleaning according to a preset abnormal traffic processing strategy, wherein the preset abnormal traffic processing strategy includes: When the first abnormal traffic pattern is detected, all requests from the abnormal source IP address are blocked; When the second abnormal traffic pattern is detected, only access requests from the abnormal source IP address to the specific resource are filtered, and access requests to other resources other than the specific resource are retained; When the third abnormal traffic pattern is detected, abnormal protocol data packets are filtered.

2. The method according to claim 1, characterized in that The method further comprises: After cleaning abnormal traffic, the cleaned normal traffic is redirected to a backup server or cloud-based platform, and the normal traffic is monitored in real time.

3. The method according to claim 1, characterized in that Analyzing traffic behavior characteristics to identify abnormal traffic patterns includes: Based on the abnormal traffic cleaning model, traffic behavior characteristics are analyzed to identify abnormal traffic patterns; Accordingly, the abnormal source IP address corresponding to the abnormal traffic pattern is determined, and abnormal traffic cleaning is performed according to a preset abnormal traffic processing strategy, including: Based on the abnormal traffic cleaning model, when an abnormal traffic pattern is identified, determining an abnormal traffic processing strategy corresponding to the abnormal traffic pattern, wherein the abnormal traffic cleaning model establishes an association between traffic behavior characteristics and abnormal traffic processing strategies; Abnormal traffic cleaning is performed according to the preset abnormal traffic processing strategy.

4. The method according to claim 3, characterized in that The abnormal traffic cleaning model is trained in the following way: Obtaining network traffic, and obtaining new attack samples from an open threat intelligence platform, and obtaining abnormal traffic processing strategies corresponding to the new attack samples, wherein the network traffic includes normal traffic and attack traffic; Annotating the network traffic, and using the annotated network traffic and the new attack sample as sample data; The sample data is input into the abnormal traffic cleaning model for training. When the value of the loss function of the abnormal traffic cleaning model reaches convergence, the abnormal traffic cleaning model training is completed. The trained abnormal traffic cleaning model can establish a correlation between traffic behavior characteristics and abnormal traffic processing strategies, wherein the loss function is: y=y1+y2+λ3y3+y4, Where y1 = λ1y 11 +λ2y 12 , Among them, y1 represents the anomaly detection loss subfunction, y 11 represents the classification cross entropy loss, y 12 represents the autoencoder reconstruction loss, y i ∈{0,1} represents the true label of the i-th sample. When i=1, it indicates abnormal traffic, and when i=0, it indicates normal traffic. represents the predicted probability of the model for the i-th sample, λ1 represents the hyperparameter used to control the importance of the classification task, It represents the feature vector obtained after the i-th sample passes through the multimodal feature fusion module. Encoder() represents the encoder part of the autoencoder, which is used to combine the fusion features is compressed into a low-dimensional potential representation; Decoder() represents the decoder part of the autoencoder, which is used to reconstruct the original fusion features from the potential representation, ||·||2 represents the Euclidean distance (L2 norm), λ2 represents the hyperparameter that controls the importance of the reconstruction task, and π θ (a t |s t ) represents the current policy network with parameter θ in state s t Next select action a t probability; Denote the parameter θ old The old policy network is in state s t Next select action a t The probability of A t =Q(s t ,a t )-V(s t ) represents the advantage function, Q(s t ,a t ) represents the state-action value function, V(s t ) represents the state value function; ε represents the cutoff threshold; the clip function represents the policy update ratio in the interval [1-ε,1+ε]; E t represents the expectation at time t, and N represents the total number of samples; represents the spatial feature vector of the i-th sample, represents the time feature vector of the i-th sample, the sim function represents the cosine similarity; τ represents the temperature coefficient, K represents the number of negative samples, θ i Represents the current i-th parameter of the model, θ old,i represents the i-th parameter of the historical model, F i represents the parameter θ i The diagonal elements of the Fisher information matrix; λ ewc represents the regularization strength coefficient.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Determine the peak service period of the current network based on historical traffic data of the current network; When the service peak period is reached, the first preset frequency threshold and the second preset frequency threshold are increased.

6. A network traffic cleaning device, characterized in that: include: The traffic behavior feature analysis module is configured to monitor network traffic in real time and analyze traffic behavior features to identify abnormal traffic patterns, wherein the traffic behavior features include: request frequency of the source IP address, access resource distribution and protocol type, and the abnormal traffic pattern includes any one or more of a first abnormal traffic pattern, a second abnormal traffic pattern and a third abnormal traffic pattern, wherein the first abnormal traffic pattern is that the request frequency of the source IP address within a set time period reaches a first preset frequency threshold, the second abnormal traffic pattern is that the access frequency of the source IP address to a specific resource reaches a second preset frequency threshold, and the specific resource is: a specific port, a specific uniform resource locator URL path, or an access frequency of a specific application programming interface API; the third abnormal traffic pattern is an abnormal protocol type; The abnormal traffic cleaning module is configured to determine the abnormal source IP address corresponding to the abnormal traffic pattern and clean the abnormal traffic according to a preset abnormal traffic processing strategy, wherein the preset abnormal traffic processing strategy includes: When the first abnormal traffic pattern is detected, all requests from the abnormal source IP address are blocked; When the second abnormal traffic pattern is detected, only access requests from the abnormal source IP address to the specific resource are filtered, and access requests to other resources other than the specific resource are retained; When the third abnormal traffic pattern is detected, abnormal protocol data packets are filtered.

7. The device according to claim 6, characterized in that The device further comprises: The normal traffic redirection module is configured to redirect the cleaned normal traffic to a backup server or cloud-based platform after cleaning the abnormal traffic, and to monitor the normal traffic in real time.

8. The device according to claim 6, characterized in that The device further comprises: A service peak period determination module is configured to determine the service peak period of the current network based on historical traffic data of the current network; The threshold dynamic adjustment module is configured to increase the first preset frequency threshold and the second preset frequency threshold when the business peak period is reached.

9. A server, characterized in that: The server includes: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the network traffic cleaning method as described in any one of claims 1-6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the network traffic cleaning method as described in any one of claims 1 to 6 is implemented.

Images