Traffic fingerprint detection method and device, storage medium and electronic equipment

Abstract

The invention relates to the technical field of network security, and particularly provides a traffic fingerprint detection method and device, a storage medium and electronic equipment, the method is applied to network equipment using a Bypass mode in an abnormal state, and the method comprises the following steps: receiving a service traffic fingerprint; detecting the service flow fingerprint by using a flow fingerprint detection tool to obtain a detection result; wherein the detection result represents whether the business flow fingerprint is abnormal or not; and under the condition that the detection result represents that the service flow fingerprint is normal, sending the service flow fingerprint to target equipment. According to some embodiments of the invention, security protection can be performed on the network in the Bypass mode, and the risk that the network is attacked is avoided.

Description

Technical Field

[0001] This application relates to the field of network security technology. Specifically, it relates to a method, device, storage medium, and electronic device for traffic fingerprint detection. Background Art

[0002] The Bypass mode, also known as the bypass mode, is a mechanism that bypasses the normal processing flow and directly conducts or continues to run in case of network or system failures. Its core purpose is to ensure the connectivity and normal operation of the network or system when the device or system fails (such as power failure, restart, crash, or hardware failure), and to avoid interruptions caused by failures. As an important fault-tolerant mechanism, the Bypass mode is widely used in network security devices, servers, and system processes. However, when the Bypass function is enabled, the security protection function of the network device will be temporarily offline and ineffective. At this time, the network is exposed to the risk of potential attacks, with very weak security, posing a great threat to network security.

[0003] Therefore, how to provide a technical solution for a method of traffic fingerprint detection in the Bypass mode with high security has become an urgent technical problem to be solved. Summary of the Invention

[0004] Some embodiments of this application aim to provide a method, device, storage medium, and electronic device for traffic fingerprint detection. Through the technical solutions of the embodiments of this application, continuous and secure detection of traffic fingerprints can be achieved in the Bypass mode, providing a reliable network security protection function.

[0005] In a first aspect, some embodiments of this application provide a method for traffic fingerprint detection. This method is applied to a network device that uses the Bypass mode when in an abnormal state, and includes: receiving a service traffic fingerprint; using a traffic fingerprint detection tool to detect the service traffic fingerprint and obtain a detection result, where the detection result indicates whether the service traffic fingerprint is abnormal; the traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model; the baseline traffic fingerprint library is generated by collecting network traffic characteristics when the network device is in an operating state; the traffic detection model is obtained by training an initial detection model with a historical traffic data set, and the historical traffic data set includes historical service traffic and attack patterns existing in the historical service traffic; when the detection result indicates that the service traffic fingerprint is normal, sending the service traffic fingerprint to a target device.

[0006] In some embodiments of the present application, after receiving the service traffic fingerprint in Bypass mode, a traffic fingerprint detection tool is used to detect the service traffic fingerprint to obtain a detection result; when the detection result indicates that the service traffic fingerprint is normal, the service traffic fingerprint is forwarded to the target device. The embodiments of the present application can implement the security detection of traffic fingerprints in Bypass mode, achieve the secure transmission of traffic fingerprints, and provide a reliable network security protection function.

[0007] In some embodiments, when the network device is in a normal operating state, before using the traffic fingerprint detection tool to detect the service traffic fingerprint and obtain a detection result, the method further includes: periodically extracting features from the collected network traffic to obtain the network traffic features; where the network traffic features include at least one of network protocol type, traffic packet size, session frequency, and IP information; expanding the network traffic features to generate traffic expansion features; and constructing the baseline traffic fingerprint library based on the network traffic features and the traffic expansion features.

[0008] In some embodiments of the present application, by extracting network traffic features and performing appropriate expansion in the normal operating state of the network device, a baseline traffic fingerprint library is constructed, providing a reliable and rich detection tool for subsequent detection of service traffic fingerprints.

[0009] In some embodiments, the initial detection model is a long short-term memory artificial neural network model or a random forest model.

[0010] In some embodiments of the present application, different types of models are selected as the initial detection model to facilitate obtaining a traffic detection model that meets the requirements.

[0011] In some embodiments, the traffic fingerprint detection tool is stored in the protection engine in Bypass mode.

[0012] In some embodiments of the present application, by storing the traffic fingerprint detection tool in the protection engine in Bypass mode, it is possible to achieve a quick start without borrowing external devices for storage.

[0013] In some embodiments, the traffic fingerprint detection tool is the baseline traffic fingerprint library. Using the traffic fingerprint detection tool to detect the service traffic fingerprint and obtain a detection result includes: if the service traffic fingerprint exists in the baseline traffic fingerprint library, the detection result is that the service traffic fingerprint is normal; if the service traffic fingerprint does not exist in the baseline traffic fingerprint library, the detection result is that the service traffic fingerprint is abnormal.

[0014] In some embodiments of the present application, by comparing the service traffic fingerprint with the traffic in the baseline traffic fingerprint library to determine whether it exists therein, a detection result can be obtained, thereby realizing the security detection of the service traffic fingerprint.

[0015] In some embodiments, the traffic fingerprint detection tool is the traffic detection model. Using the traffic fingerprint detection tool to detect the service traffic fingerprint and obtain a detection result includes: inputting the service traffic fingerprint into the traffic detection model to obtain an output result; if the output result shows that there is no attack in the service traffic fingerprint, the detection result is that the service traffic fingerprint is normal; if the output result shows the attack type existing in the service traffic fingerprint, the detection result is that the service traffic fingerprint is abnormal.

[0016] In some embodiments of the present application, by inputting the service traffic fingerprint into the traffic detection model to obtain a corresponding output result, and by determining whether the output result contains content of the attack type, a detection result is obtained, thereby realizing the security detection of whether there is an attack in the service traffic fingerprint.

[0017] In some embodiments, the method further includes: when the detection result indicates that the service traffic fingerprint is abnormal, generating an alarm message and generating a temporary protection rule, where the temporary protection rule includes: refusing to forward the service traffic fingerprint, blocking the device corresponding to the service traffic fingerprint, or reducing the forwarding rate of the service traffic fingerprint.

[0018] In some embodiments of the present application, by promptly alarming and generating a protection rule when the service traffic fingerprint is abnormal, immediate response and handling of the abnormality are realized, and network security is maintained.

[0019] In a second aspect, some embodiments of the present application provide a device for detecting traffic fingerprints. The device is applied to a network device that uses the Bypass mode when in an abnormal state, and includes: a receiving module, configured to receive a service traffic fingerprint; a detecting module, configured to use a traffic fingerprint detection tool to detect the service traffic fingerprint and obtain a detection result, where the detection result indicates whether there is an abnormality in the service traffic fingerprint; the traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model; the baseline traffic fingerprint library is generated by collecting network traffic characteristics when the network device is in an operating state; the traffic detection model is obtained by training an initial detection model with a historical traffic data set; the historical traffic data set includes historical service traffic and attack patterns existing in the historical service traffic; a sending module, configured to send the service traffic fingerprint to a target device when the detection result indicates that the service traffic fingerprint is normal.

[0020] In a third aspect, some embodiments of the present application provide a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the method described in any embodiment of the first aspect can be implemented.

[0021] In a fourth aspect, some embodiments of the present application provide an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. Wherein, when the processor executes the program, the method described in any embodiment of the first aspect can be implemented.

[0022] In a fifth aspect, some embodiments of the present application provide a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented. Description of the Drawings

[0023] To more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application, and thus should not be regarded as a limitation of the scope. For those of ordinary skill in the art, without creative efforts, other related drawings can also be obtained based on these drawings.

[0024] Figure 1 System diagram of traffic fingerprint detection provided for some embodiments of the present application; Figure 2 Method flowchart for obtaining a baseline traffic fingerprint library provided for some embodiments of the present application; Figure 3 One of the method flowcharts of traffic fingerprint detection provided for some embodiments of the present application; Figure 4 Another method flowchart of traffic fingerprint detection provided for some embodiments of the present application; Figure 5 Block diagram of the device composition of traffic fingerprint detection provided for some embodiments of the present application; Figure 6 Schematic diagram of an electronic device provided for some embodiments of the present application. Detailed Embodiments

[0025] Next, the technical solutions in some embodiments of the present application will be described in conjunction with the drawings in some embodiments of the present application.

[0026] It should be noted that similar reference numerals and letters denote similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of the present application, terms such as "first" and "second" are only used for distinguishing descriptions and cannot be construed as indicating or implying relative importance.

[0027] In the related art, during the restart process of network devices such as firewalls and routers, enabling the Bypass function can ensure that service traffic is not interrupted. However, at this time, the security protection functions of network devices (such as intrusion detection, traffic filtering, etc.) are temporarily invalidated, exposing the network to potential attack risks. From the above related art, there is currently a lack of a mechanism for dynamically protecting the network in Bypass mode.

[0028] In view of this, some embodiments of the present application provide a method for traffic fingerprint detection, which can be applied to network devices using the Bypass mode when in an abnormal state. After receiving the service traffic fingerprint, the network device using the Bypass mode uses a traffic fingerprint detection tool to detect the service traffic fingerprint and obtains a detection result; finally, it can be determined whether to continue forwarding the service traffic fingerprint to the next target device through the detection. Some embodiments of the present application provide a mechanism for dynamically protecting the network in Bypass mode, which can achieve comprehensive security protection of the network, ensure the secure forwarding of traffic data, and have a relatively high security level.

[0029] The following will Figure 1 exemplarily elaborate on the overall composition structure of the traffic fingerprint detection system provided by some embodiments of the present application.

[0030] As Figure 1 shown, some embodiments of the present application provide a system diagram of traffic fingerprint detection. The traffic fingerprint detection system may include: a terminal 100 and a network device 200. The terminal 100 can establish a communication connection with the network device 200. When the network device 200 is in an abnormal state such as a restart state or a fault state, the Bypass mode will be activated. At this time, the terminal 100 can continue to send service traffic fingerprints to the network device 200. The network device 200 can continuously receive service traffic fingerprints; then, the network device 200 can use a traffic fingerprint detection tool to perform a security detection on the service traffic fingerprint and obtain a detection result. It is determined whether to forward the service traffic fingerprint to the next target device based on the detection result. It can be seen that the present application can still achieve network security protection in Bypass mode, improve the security of traffic forwarding, and improve the security protection level.

[0031] In some embodiments of the present application, the terminal 100 can be a mobile terminal or a non-portable computer terminal; the network device 200 can beFigure 1 The server device shown may also be other types of devices such as a firewall or a router; the target device may be network hardware, etc. Specifically, it can be selected according to the actual scenario, and the embodiments of the present application do not make specific limitations here.

[0032] In order to implement secure detection of service traffic fingerprints in Bypass mode, it is first necessary to prepare a traffic fingerprint detection tool. Therefore, the process of obtaining the traffic fingerprint detection tool is described below by way of example.

[0033] The following combines the attached Figure 2 Exemplarily describe the implementation process of constructing a baseline traffic fingerprint library provided by some embodiments of the present application.

[0034] Please refer to the attached Figure 2 , Figure 2 FIG. is a flowchart of a method for constructing a baseline traffic fingerprint library provided by some embodiments of the present application. The baseline traffic fingerprint library is constructed when the network device 200 is in a normal operating state; the method for constructing the baseline traffic fingerprint library may include: S210, periodically extract features from the collected network traffic to obtain the network traffic features; wherein, the network traffic features include at least one of network protocol type, traffic packet size, session frequency, and IP information.

[0035] For example, in some embodiments of the present application, when the network device 200 is operating normally, the network traffic received by the network device 200 is continuously collected periodically, and features are extracted from the network traffic to obtain network traffic features. For example, the network traffic features may include: network protocol type, packet size (as a specific example of the traffic packet size), session time, session content, session frequency, IP reputation library, etc. It should be understood that the network traffic features can be flexibly extracted according to the actual situation, and the embodiments of the present application are not limited thereto.

[0036] S220, expand the network traffic features to generate traffic expansion features.

[0037] For example, in some embodiments of the present application, some of the above-mentioned extracted network traffic features may also be expanded in the same type to obtain traffic expansion features. For example, for the network protocol type, after extracting a network protocol, related protocol types that are similar in principle to the network protocol and can be used to transmit the service traffic fingerprint can be expanded; for the packet size, the range adapted to the packet size corresponding to such traffic can be expanded, etc.

[0038] S230, construct the baseline traffic fingerprint library based on the network traffic features and the traffic expansion features.

[0039] For example, in some embodiments of the present application, the above-mentioned network traffic features and traffic expansion features can form a rich baseline traffic fingerprint library. In addition, the baseline traffic fingerprint library can be continuously updated. As long as the network device 200 resumes normal operation, it can collect new network traffic and update the baseline traffic fingerprint library. To ensure that there is no redundancy in the traffic features in the baseline traffic fingerprint library, it can be confirmed that the network traffic feature does not exist in the library before updating the baseline traffic fingerprint library. Alternatively, first store the network traffic features of the newly collected network traffic in the baseline traffic fingerprint library, and then the baseline traffic fingerprint library can be deduplicated regularly later to obtain a high-quality baseline traffic fingerprint library. It should be understood that the update method of the baseline traffic fingerprint library can be flexibly selected, and the embodiments of the present application are not limited thereto.

[0040] In some other embodiments of the present application, S220 may not be executed, and the baseline traffic fingerprint library may be constructed only based on the network traffic features. Specifically, it can be selected according to the actual application scenario, and the embodiments of the present application do not make specific limitations here.

[0041] The implementation process of obtaining the traffic detection model is described below by way of example.

[0042] The first step is to construct a machine learning model (as a specific example of the initial detection model).

[0043] For example, in some embodiments of the present application, the initial detection model is a long short-term memory artificial neural network model LSTM or a random forest model, etc., and the embodiments of the present application are not limited thereto.

[0044] The second step is to construct a historical traffic dataset.

[0045] In some embodiments of the present application, the historical traffic dataset includes: historical service traffic and attack patterns existing in the historical service traffic. For example, the attack patterns existing in the historical traffic data (i.e., historical service traffic) can be DDoS, port scanning, malicious Payload, etc.

[0046] The third step is to train the machine learning model with the historical traffic dataset to obtain a traffic detection model.

[0047] In actual applications, the historical traffic dataset can also be continuously updated, and the traffic detection model can be continuously updated by reinforcement learning, so that the traffic detection model can be applicable to more scenarios.

[0048] Through the above two methods, different traffic fingerprint detection tools can be obtained, namely the baseline traffic fingerprint library and the traffic detection model.

[0049] In some embodiments of the present application, the traffic fingerprint detection tool is stored in the protection engine in the Bypass mode.

[0050] For example, the above baseline traffic fingerprint library and traffic detection model are pre-stored in the lightweight protection engine in Bypass mode. Specifically, a memory-resident protection module is set in the lightweight protection engine. When the network device 200 restarts, the core protection functions (such as the baseline traffic fingerprint library and traffic detection model) are resident in the memory, without relying on the hard disk or external storage, ensuring fast startup and reducing the response time.

[0051] The following combines the attached Figure 3 Exemplarily illustrate the implementation process of traffic fingerprint detection performed by the network device 200 using the Bypass mode when in an abnormal state provided by some embodiments of the present application.

[0052] Please refer to the attached Figure 3 , Figure 3 FIG. is a flowchart of a traffic fingerprint detection method provided by some embodiments of the present application. The traffic fingerprint detection method may include: S310, receive the service traffic fingerprint.

[0053] For example, in some embodiments of the present application, the network device 200 receives in real time the service traffic data sent by the terminal 100 (as a specific example of the service traffic fingerprint).

[0054] S320, use a traffic fingerprint detection tool to detect the service traffic fingerprint, and obtain a detection result; wherein, the detection result indicates whether the service traffic fingerprint is abnormal.

[0055] For example, in some embodiments of the present application, enable the traffic fingerprint detection tool to perform a security detection on the service traffic data to obtain a detection result.

[0056] In some embodiments of the present application, the traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model; the baseline traffic fingerprint library is generated by collecting network traffic characteristics when the network device is in an operating state; the traffic detection model is obtained by training an initial detection model with a historical traffic data set; the historical traffic data set includes historical service traffic and attack patterns existing in the historical service traffic.

[0057] In some embodiments of the present application, when the traffic fingerprint detection tool is the baseline traffic fingerprint library, S320 may include: if the service traffic fingerprint exists in the baseline traffic fingerprint library, the detection result is that the service traffic fingerprint is normal; if the service traffic fingerprint does not exist in the baseline traffic fingerprint library, the detection result is that the service traffic fingerprint is abnormal.

[0058] For example, in some embodiments of the present application, real-time service traffic data is compared with a baseline traffic fingerprint database to determine whether the characteristics of the service traffic data exist in the baseline traffic fingerprint database. If the characteristics of the service traffic data exist in the baseline traffic fingerprint database, the service traffic data is normal; otherwise, there is an anomaly.

[0059] In some embodiments of the present application, when the traffic fingerprint detection tool is the traffic detection model, S320 may include: inputting the service traffic fingerprint into the traffic detection model to obtain an output result; if the output result shows that the service traffic fingerprint does not have an attack, the detection result is that the service traffic fingerprint is normal; if the output result shows the attack type existing in the service traffic fingerprint, the detection result is that the service traffic fingerprint is abnormal.

[0060] For example, in some embodiments of the present application, real-time service traffic data is input into a traffic detection model to obtain an output result of the model. If the attack type existing in the service traffic data is detected in the output result, it is determined that the service traffic data is abnormal; otherwise, the service traffic data is normal.

[0061] S330, in the case where the detection result indicates that the service traffic fingerprint is normal, send the service traffic fingerprint to the target device.

[0062] For example, in some embodiments of the present application, in the case where it is determined that the service traffic data is normal, it can be directly sent to network hardware (as a specific example of the target device, such as a switching chip, FPGA) to perform relevant service operations.

[0063] In some embodiments of the present application, the method for traffic fingerprint detection further includes: in the case where the detection result indicates that the service traffic fingerprint is abnormal, generating an alarm message and generating a temporary protection rule, where the temporary protection rule includes: refusing to forward the service traffic fingerprint, blocking the device corresponding to the service traffic fingerprint, or reducing the forwarding rate of the service traffic fingerprint.

[0064] For example, in some embodiments of the present application, if there is an abnormality in the service traffic data, an alarm message can be generated, and temporary protection rules can be dynamically generated, such as blocking a specific IP (as a specific example of blocking the device corresponding to the service traffic fingerprint), limiting the traffic speed (as a specific example of reducing the forwarding rate of the service traffic fingerprint), etc. For example, the attack type existing in the traffic can also be confirmed through an anomaly detection model, and the corresponding protection method (that is, the temporary protection rule) can be found from the protection rule table; or, a defense strategy (that is, the temporary protection rule) can be autonomously generated based on the attack type in the detection result; or the traffic can be directly rejected from being issued (as a specific example of rejecting the forwarding of the service traffic fingerprint). And the generated alarm message is promptly informed to relevant technical personnel.

[0065] In other embodiments, after using the baseline traffic fingerprint library to determine that there is an abnormality in the service traffic data, a traffic detection model can also be used to detect the attack characteristics (as a specific example of the attack type) existing in the service traffic data, so as to generate corresponding temporary protection rules. That is to say, during traffic fingerprint detection, at least one of the baseline traffic fingerprint library and the traffic detection model can be relied on for security protection.

[0066] The following combines the attached Figure 4 Exemplarily elaborates the specific process of traffic fingerprint detection provided by some embodiments of the present application.

[0067] Please refer to the attached Figure 4 , Figure 4 which is a flowchart of a traffic fingerprint detection method provided by some embodiments of the present application.

[0068] The following exemplarily elaborates the above process.

[0069] S410, when the network device is in a normal operating state, periodically extract the features of the collected network traffic to obtain network traffic features.

[0070] S420, based on the network traffic features, construct a baseline traffic fingerprint library.

[0071] S430, in the case where the network device is in the Bypass mode, receive the service traffic fingerprint.

[0072] S440, determine whether the service traffic fingerprint exists in the baseline traffic fingerprint library. If so, execute S450; otherwise, execute S460.

[0073] S450, send the service traffic fingerprint to the target device.

[0074] S460, generate an alarm message and generate temporary protection rules.

[0075] It is understandable that the specific implementation process of S410~S460 can refer to the method embodiment provided above, and the detailed description is appropriately omitted here to avoid repetition. Although in this embodiment, only the baseline traffic fingerprint library is used as the basis for security detection of the service traffic fingerprint, in other embodiments, the traffic detection model can also be used for security detection, and the embodiment of the present application is not limited to this.

[0076] Through some of the above-mentioned embodiments of the present application, it can be seen that when the Bypass function is enabled when the device is in an abnormal state, the present application analyzes the traffic behavior characteristics in real time, dynamically generates security rules and implements interception, thereby ensuring that the network is protected from attacks during the period when the network device is abnormal, thereby improving security.

[0077] Please refer to Figure 5 , Figure 5 The block diagram of the composition of the device for flow fingerprint detection provided by some embodiments of the present application is shown. It should be understood that the device for flow fingerprint detection corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the device for flow fingerprint detection can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0078] Figure 5 The device for traffic fingerprint detection includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the device for traffic fingerprint detection. The device for traffic fingerprint detection is applied to a network device that uses the Bypass mode when it is in an abnormal state. The device includes: a receiving module 510, which is used to receive a business traffic fingerprint; a detection module 520, which is used to detect the business traffic fingerprint using a traffic fingerprint detection tool to obtain a detection result; wherein the detection result indicates whether the business traffic fingerprint has an abnormality; the traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model; the baseline traffic fingerprint library is generated by collecting network traffic features when the network device is in operation; the traffic detection model is obtained by training an initial detection model with a historical traffic data set; the historical traffic data set includes historical business traffic and attack patterns existing in the historical business traffic; a sending module 530, which is used to send the business traffic fingerprint to a target device when the detection result indicates that the business traffic fingerprint is normal.

[0079] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0080] Some embodiments of the present application also provide a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the operations corresponding to any of the methods provided in the above embodiments can be implemented.

[0081] Some embodiments of the present application also provide a computer program product, which includes a computer program. When the computer program is executed by a processor, the operations corresponding to any of the methods provided in the above embodiments can be implemented.

[0082] As Figure 6 shown, some embodiments of the present application provide an electronic device 600, which includes: a memory 610, a processor 620, and a computer program stored on the memory 610 and executable on the processor 620. When the processor 620 reads the program from the memory 610 through a bus 630 and executes the program, the method of any of the above embodiments can be implemented.

[0083] The processor 620 can process digital signals and can include various computing architectures. For example, a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements a combination of multiple instruction sets. In some examples, the processor 620 can be a microprocessor.

[0084] The memory 610 can be used to store instructions executed by the processor 620 or data related to the execution of the instructions. These instructions and / or data can include code for implementing some or all of the functions of one or more modules described in the embodiments of the present application. The processor 620 of the embodiments of the present disclosure can be used to execute the instructions in the memory 610 to implement the method shown above. The memory 610 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memories well known to those skilled in the art.

[0085] The above are only the embodiments of the present application and are not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters denote similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0086] As described above, it is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of changes or substitutions, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims described above.

[0087] It should be noted that, in this text, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or device. Without more limitations, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article or device including the said element.

Claims

1. A method for detecting traffic fingerprints, characterized in that, The method is applied to a network device that uses the Bypass mode when in an abnormal state. The method includes: Receiving service traffic fingerprints; Detecting the service traffic fingerprints by using a traffic fingerprint detection tool to obtain a detection result. Wherein, the detection result indicates whether the service traffic fingerprints are abnormal. The traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model. The baseline traffic fingerprint library is generated by collecting network traffic characteristics when the network device is in an operating state. The traffic detection model is obtained by training an initial detection model with a historical traffic data set. The historical traffic data set includes historical service traffic and attack patterns existing in the historical service traffic; When the detection result indicates that the service traffic fingerprints are normal, sending the service traffic fingerprints to a target device.

2. The method according to claim 1, wherein When the network device is in a normal operating state, before detecting the service traffic fingerprints by using the traffic fingerprint detection tool to obtain a detection result, the method further includes: Regularly extracting features from the collected network traffic to obtain the network traffic characteristics. Wherein, the network traffic characteristics include at least one of network protocol type, traffic packet size, session frequency, and IP information; Expanding the network traffic characteristics to generate traffic expansion characteristics; Based on the network traffic characteristics and the traffic expansion characteristics, constructing the baseline traffic fingerprint library.

3. The method according to claim 1, characterized in that The initial detection model is a long short-term memory artificial neural network model or a random forest model.

4. The method according to any one of claims 1 to 3, characterized in that, The traffic fingerprint detection tool is stored in a protection engine in the Bypass mode.

5. The method according to claim 1 or 2, characterized in that, The traffic fingerprint detection tool is the baseline traffic fingerprint library. Detecting the service traffic fingerprints by using the traffic fingerprint detection tool to obtain a detection result includes: If the service traffic fingerprints exist in the baseline traffic fingerprint library, the detection result is that the service traffic fingerprints are normal; If the service traffic fingerprints do not exist in the baseline traffic fingerprint library, the detection result is that the service traffic fingerprints are abnormal.

6. The method according to claim 1 or 3, characterized in that The traffic fingerprint detection tool is the traffic detection model. Detecting the service traffic fingerprints by using the traffic fingerprint detection tool to obtain a detection result includes: Inputting the service traffic fingerprints into the traffic detection model to obtain an output result; If the output result shows that there is no attack in the service traffic fingerprints, the detection result is that the service traffic fingerprints are normal; If the output result shows the attack types existing in the service traffic fingerprints, the detection result is that the service traffic fingerprints are abnormal.

7. The method according to any one of claims 1 to 3, characterized in that The method further includes: when the detection result indicates that the service traffic fingerprints are abnormal, Generating an alarm message and generating a temporary protection rule. Wherein, the temporary protection rule includes: refusing to forward the service traffic fingerprints, blocking the device corresponding to the service traffic fingerprints, or reducing the forwarding rate of the service traffic fingerprints.

8. An apparatus for traffic fingerprint detection, characterized in that, The device is applied to a network device that uses the Bypass mode when in an abnormal state. The device includes: A receiving module, configured to receive business traffic fingerprints; A detection module, configured to detect the business traffic fingerprints by using a traffic fingerprint detection tool to obtain a detection result; wherein, the detection result indicates whether the business traffic fingerprints are abnormal; the traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model; the baseline traffic fingerprint library is generated by collecting network traffic characteristics when the network device is in an operating state; the traffic detection model is obtained by training an initial detection model with a historical traffic data set; the historical traffic data set includes historical business traffic and attack patterns existing in the historical business traffic; A sending module, configured to send the business traffic fingerprints to a target device when the detection result indicates that the business traffic fingerprints are normal.

9. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, wherein the computer program, when run by a processor, executes the method according to any one of claims 1-7.

10. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored on the memory and running on the processor, wherein the computer program, when run by the processor, executes the method according to any one of claims 1-7.

Images