Method, device, storage medium and electronic device for traffic fingerprint detection

Abstract

The present application relates to the field of network security technology, and specifically provides a method, apparatus, storage medium, and electronic device for traffic fingerprint detection. The method is applied to a network device using a Bypass mode when in an abnormal state, and includes: receiving a service traffic fingerprint; detecting the service traffic fingerprint using a traffic fingerprint detection tool to obtain a detection result; wherein the detection result indicates whether the service traffic fingerprint is abnormal; and if the detection result indicates that the service traffic fingerprint is normal, sending the service traffic fingerprint to a target device. Some embodiments of the present application can provide security protection for the network in Bypass mode to avoid the risk of network attack.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a method, device, storage medium, and electronic device for traffic fingerprint detection. Background Art

[0002] Bypass mode, also known as bypass mode, is a mechanism that bypasses normal processing and directly connects or continues operation in the event of a network or system failure. Its core purpose is to ensure network or system connectivity and normal operation in the event of a device or system failure (such as a power outage, reboot, freeze, or hardware failure), thereby avoiding interruptions caused by the failure. As an important fault-tolerance mechanism, Bypass mode is widely used in network security devices, servers, and system processes. However, when the Bypass function is enabled, the security protection functions of the network device are temporarily offline and ineffective, exposing the network to potential attacks and weakening its security, posing a significant threat to network security.

[0003] Therefore, how to provide a technical solution for a method of traffic fingerprint detection in Bypass mode with higher security has become a technical problem that needs to be solved urgently. Summary of the Invention

[0004] The purpose of some embodiments of the present application is to provide a method, device, storage medium and electronic device for traffic fingerprint detection. Through the technical solutions of the embodiments of the present application, continuous and secure detection of traffic fingerprints can be achieved in Bypass mode, providing reliable network security protection functions.

[0005] In a first aspect, some embodiments of the present application provide a method for traffic fingerprint detection, which is applied to a network device using a Bypass mode when in an abnormal state, including: receiving a business traffic fingerprint; using a traffic fingerprint detection tool to detect the business traffic fingerprint and obtain a detection result; wherein the detection result characterizes whether there is an abnormality in the business traffic fingerprint; the traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model; the baseline traffic fingerprint library is generated by collecting network traffic characteristics when the network device is in an operating state; the traffic detection model is obtained by training an initial detection model with a historical traffic data set; the historical traffic data set includes historical business traffic and attack patterns existing in the historical business traffic; when the detection result characterizes that the business traffic fingerprint is normal, the business traffic fingerprint is sent to the target device.

[0006] Some embodiments of the present application, after receiving a service traffic fingerprint in Bypass mode, use a traffic fingerprint detection tool to detect the service traffic fingerprint and obtain a detection result. If the detection result indicates that the service traffic fingerprint is normal, the service traffic fingerprint is forwarded to the target device. Embodiments of the present application can implement secure detection of traffic fingerprints in Bypass mode, achieve secure transmission of traffic fingerprints, and provide reliable network security protection.

[0007] In some embodiments, when the network device is in normal operating state, before using the traffic fingerprint detection tool to detect the business traffic fingerprint and obtain the detection result, the method also includes: regularly extracting features of the collected network traffic to obtain the network traffic features; wherein the network traffic features include: network protocol type, traffic packet size, session frequency and IP information. At least one of the following: expanding the network traffic features to generate traffic extension features; and constructing the baseline traffic fingerprint library based on the network traffic features and the traffic extension features.

[0008] Some embodiments of the present application extract network traffic features and perform appropriate expansion when network devices are operating normally, thereby constructing a baseline traffic fingerprint library, thereby providing a reliable and rich detection tool for subsequent detection of business traffic fingerprints.

[0009] In some embodiments, the initial detection model is a long short-term memory artificial neural network model or a random forest model.

[0010] Some embodiments of the present application select different types of models as initial detection models to obtain a flow detection model that meets the requirements.

[0011] In some embodiments, the traffic fingerprint detection tool is stored in the protection engine in the Bypass mode.

[0012] Some embodiments of the present application can achieve quick startup by storing the traffic fingerprint detection tool in the protection engine in Bypass mode without the need for external device storage.

[0013] In some embodiments, the traffic fingerprint detection tool is the baseline traffic fingerprint library, and the traffic fingerprint detection tool is used to detect the business traffic fingerprint to obtain a detection result, including: if the business traffic fingerprint exists in the baseline traffic fingerprint library, then the detection result is that the business traffic fingerprint is normal; if the business traffic fingerprint does not exist in the baseline traffic fingerprint library, then the detection result is that the business traffic fingerprint is abnormal.

[0014] Some embodiments of the present application compare the business traffic fingerprint with the traffic in the baseline traffic fingerprint library to determine whether it exists therein, and obtain a detection result, thereby realizing security detection of the business traffic fingerprint.

[0015] In some embodiments, the traffic fingerprint detection tool is the traffic detection model, and the use of the traffic fingerprint detection tool to detect the business traffic fingerprint and obtain the detection result includes: inputting the business traffic fingerprint into the traffic detection model to obtain an output result; if the output result shows that there is no attack on the business traffic fingerprint, then the detection result is that the business traffic fingerprint is normal; if the output result shows the type of attack that exists in the business traffic fingerprint, then the detection result is that the business traffic fingerprint is abnormal.

[0016] Some embodiments of the present application obtain corresponding output results by inputting business traffic fingerprints into a traffic detection model, and obtain detection results by determining whether the output results contain attack type content, thereby achieving security detection of whether there is an attack in the business traffic fingerprint.

[0017] In some embodiments, the method further includes: when the detection result characterizes that the business traffic fingerprint is abnormal, generating an alarm message and generating temporary protection rules, wherein the temporary protection rules include: refusing to forward the business traffic fingerprint, blocking the device corresponding to the business traffic fingerprint, or reducing the forwarding rate of the business traffic fingerprint.

[0018] Some embodiments of the present application provide timely alarms and generate protection rules when there are anomalies in the business traffic fingerprint, thereby achieving immediate response and processing of anomalies and maintaining network security.

[0019] In a second aspect, some embodiments of the present application provide a device for traffic fingerprint detection, which is applied to a network device using a Bypass mode when in an abnormal state, and includes: a receiving module for receiving a business traffic fingerprint; a detection module for using a traffic fingerprint detection tool to detect the business traffic fingerprint and obtain a detection result; wherein the detection result characterizes whether there is an abnormality in the business traffic fingerprint; the traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model; the baseline traffic fingerprint library is generated by collecting network traffic characteristics when the network device is in operation; the traffic detection model is obtained by training an initial detection model with a historical traffic data set; the historical traffic data set includes historical business traffic and attack patterns existing in the historical business traffic; a sending module is used to send the business traffic fingerprint to the target device when the detection result characterizes that the business traffic fingerprint is normal.

[0020] In a third aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0021] In a fourth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor can implement a method as described in any embodiment of the first aspect when executing the program.

[0022] In a fifth aspect, some embodiments of the present application provide a computer program product, comprising a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the following is a brief introduction to the drawings required for use in some embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0024] Figure 1 A system diagram of traffic fingerprint detection provided for some embodiments of the present application;

[0025] Figure 2 A flow chart of a method for obtaining a baseline traffic fingerprint library provided in some embodiments of the present application;

[0026] Figure 3 One of the flow charts of the method for traffic fingerprint detection provided in some embodiments of the present application;

[0027] Figure 4 Flowchart 2 of the method for traffic fingerprint detection provided in some embodiments of the present application;

[0028] Figure 5 A block diagram of a device for traffic fingerprint detection provided in some embodiments of the present application;

[0029] Figure 6 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0030] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0031] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0032] In related technologies, enabling bypass functionality during the reboot of network devices such as firewalls and routers can ensure uninterrupted service traffic. However, this temporarily disables the network's security features (such as intrusion detection and traffic filtering), exposing the network to potential attacks. As can be seen from the aforementioned related technologies, there is currently a lack of a mechanism to dynamically protect networks in bypass mode.

[0033] In view of this, some embodiments of the present application provide a method for traffic fingerprint detection, which can be applied to network devices using Bypass mode when in an abnormal state. After receiving the service traffic fingerprint, the network device using Bypass mode uses a traffic fingerprint detection tool to detect the service traffic fingerprint and obtain a detection result; finally, through the detection, it can be determined whether to continue forwarding the service traffic fingerprint to the next target device. Some embodiments of the present application provide a mechanism for dynamically protecting the network in Bypass mode, which can achieve comprehensive security protection of the network, ensure the safe forwarding of traffic data, and have high security.

[0034] The following is combined with Figure 1 The overall composition structure of the traffic fingerprint detection system provided by some embodiments of the present application is exemplified.

[0035] like Figure 1 As shown, some embodiments of the present application provide a system diagram for traffic fingerprint detection, and the traffic fingerprint detection system may include: a terminal 100 and a network device 200. The terminal 100 can establish a communication connection with the network device 200. When the network device 200 is in an abnormal state such as a restart state or a fault state, the Bypass mode will be started. At this time, the terminal 100 can continue to send business traffic fingerprints to the network device 200. The network device 200 can continue to receive business traffic fingerprints; thereafter, the network device 200 can use the traffic fingerprint detection tool to perform a security test on the business traffic fingerprint and obtain a test result. Determine whether to forward the business traffic fingerprint to the next target device based on the test result. It can be seen that the present application can still achieve network security protection in the Bypass mode, improve the security of traffic forwarding, and improve the security protection level.

[0036] In some embodiments of the present application, the terminal 100 may be a mobile terminal or a non-portable computer terminal; the network device 200 may be a Figure 1 The server device shown may also be other types of devices such as a firewall, a router, etc. The target device may be network hardware, etc. Specifically, the selection may be made according to the actual scenario, and the embodiment of the present application does not make any specific limitation here.

[0037] To implement secure traffic fingerprinting in Bypass mode, you first need to prepare a traffic fingerprinting tool. The following example illustrates how to obtain the traffic fingerprinting tool.

[0038] The following is combined with Figure 2 The implementation process of building a baseline traffic fingerprint library provided by some embodiments of the present application is exemplified.

[0039] Please see the attached Figure 2 , Figure 2 A flowchart of a method for constructing a baseline traffic fingerprint library is provided for some embodiments of the present application. The baseline traffic fingerprint library is constructed when the network device 200 is in normal operation. The method for constructing the baseline traffic fingerprint library may include:

[0040] S210, regularly extracting features from the collected network traffic to obtain the network traffic features; wherein the network traffic features include: at least one of: network protocol type, traffic packet size, session frequency and IP information.

[0041] For example, in some embodiments of the present application, when network device 200 is operating normally, network traffic received by network device 200 is periodically and continuously collected, and features of the network traffic are extracted to obtain network traffic features. For example, network traffic features may include: network protocol type, data packet size (as a specific example of traffic packet size), session duration, session content, session frequency, IP reputation database, etc. It should be understood that network traffic features can be flexibly extracted based on actual circumstances, and the embodiments of the present application are not limited to this.

[0042] S220: Expand the network traffic feature to generate a traffic expansion feature.

[0043] For example, in some embodiments of the present application, certain features of the aforementioned extracted network traffic features can be expanded in the same manner to obtain traffic extension features. For example, with respect to network protocol types, after extracting a network protocol, related protocol types similar in principle to the network protocol and capable of transmitting the service traffic fingerprint can be expanded; with respect to packet size, the range of packet sizes corresponding to this type of traffic can be expanded, etc.

[0044] S230: Build the baseline traffic fingerprint library based on the network traffic characteristics and the traffic extension characteristics.

[0045] For example, in some embodiments of the present application, the above-mentioned network traffic features and traffic extension features can constitute a rich baseline traffic fingerprint library. In addition, the baseline traffic fingerprint library can be continuously updated, and as long as the network device 200 returns to normal operation, it can collect new network traffic and update the baseline traffic fingerprint library. In order to ensure that there is no redundancy in the traffic features in the baseline traffic fingerprint library, it can be confirmed that the network traffic features do not exist in the library before updating the baseline traffic fingerprint library. Alternatively, the network traffic features of the newly collected network traffic are first stored in the baseline traffic fingerprint library, and the baseline traffic fingerprint library can be deduplicated regularly at a later stage to obtain a high-quality baseline traffic fingerprint library. It should be understood that the update method of the baseline traffic fingerprint library can be flexibly selected, and the embodiments of the present application are not limited to this.

[0046] In other embodiments of the present application, S220 may not be performed, and only a baseline traffic fingerprint library may be constructed based on network traffic characteristics. Specific selections may be made based on actual application scenarios, and the present application embodiment does not specifically limit this.

[0047] The following is an example of the implementation process of obtaining a traffic detection model.

[0048] The first step is to build a machine learning model (as a specific example of an initial detection model).

[0049] For example, in some embodiments of the present application, the initial detection model is a long short-term memory artificial neural network model LSTM or a random forest model, etc., but the embodiments of the present application are not limited thereto.

[0050] The second step is to build a historical traffic dataset.

[0051] In some embodiments of the present application, the historical traffic data set includes: historical service traffic and attack patterns present in the historical service traffic. For example, the attack patterns present in the historical traffic data (i.e., historical service traffic) may include DDoS, port scanning, malicious payloads, etc.

[0052] The third step is to train the machine learning model using the historical traffic data set to obtain a traffic detection model.

[0053] In actual applications, historical traffic data sets can be continuously updated, and the traffic detection model can be continuously reinforced and updated, so that the traffic detection model can be applied to more scenarios.

[0054] Different traffic fingerprint detection tools, namely the baseline traffic fingerprint library and the traffic detection model, can be obtained through the above two methods.

[0055] In some embodiments of the present application, the traffic fingerprint detection tool is stored in the protection engine in the Bypass mode.

[0056] For example, the baseline traffic fingerprint library and traffic detection model are pre-stored in a lightweight protection engine in bypass mode. Specifically, a memory-resident protection module is provided within the lightweight protection engine. When network device 200 restarts, core protection functions (such as the baseline traffic fingerprint library and traffic detection model) are retained in memory, independent of hard disk or external storage, ensuring a fast startup and reducing response time.

[0057] The following is combined with Figure 3 The implementation process of traffic fingerprint detection performed by the network device 200 using the Bypass mode when in an abnormal state is exemplified in some embodiments of the present application.

[0058] Please see the attached Figure 3 , Figure 3 A flow chart of a method for traffic fingerprint detection is provided for some embodiments of the present application. The method for traffic fingerprint detection may include:

[0059] S310: Receive a service traffic fingerprint.

[0060] For example, in some embodiments of the present application, the network device 200 receives the service traffic data (as a specific example of a service traffic fingerprint) sent by the terminal 100 in real time.

[0061] S320: Use a traffic fingerprint detection tool to detect the service traffic fingerprint and obtain a detection result; wherein the detection result indicates whether there is any abnormality in the service traffic fingerprint.

[0062] For example, in some embodiments of the present application, a traffic fingerprint detection tool is enabled to perform security detection on business traffic data to obtain detection results.

[0063] In some embodiments of the present application, the traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model; the baseline traffic fingerprint library is generated by collecting network traffic characteristics when the network device is in operation; the traffic detection model is obtained by training an initial detection model through a historical traffic data set; the historical traffic data set includes historical business traffic and attack patterns existing in the historical business traffic.

[0064] In some embodiments of the present application, when the traffic fingerprint detection tool is the baseline traffic fingerprint library, S320 may include: if the business traffic fingerprint exists in the baseline traffic fingerprint library, then the detection result is that the business traffic fingerprint is normal; if the business traffic fingerprint does not exist in the baseline traffic fingerprint library, then the detection result is that the business traffic fingerprint is abnormal.

[0065] For example, in some embodiments of the present application, real-time service flow data is compared with a baseline flow fingerprint library to determine whether the characteristics of the service flow data exist in the baseline flow fingerprint library. If the characteristics of the service flow data exist in the baseline flow fingerprint library, the service flow data is normal; otherwise, there is an abnormality.

[0066] In some embodiments of the present application, when the traffic fingerprint detection tool is the traffic detection model, S320 may include: inputting the business traffic fingerprint into the traffic detection model to obtain an output result; if the output result shows that there is no attack on the business traffic fingerprint, then the detection result is that the business traffic fingerprint is normal; if the output result shows the type of attack that exists in the business traffic fingerprint, then the detection result is that the business traffic fingerprint is abnormal.

[0067] For example, in some embodiments of the present application, real-time service traffic data is input into a traffic detection model to obtain an output result of the model. If the output result detects an attack type present in the service traffic data, the service traffic data is determined to be abnormal; otherwise, the service traffic data is normal.

[0068] S330: If the detection result indicates that the service traffic fingerprint is normal, send the service traffic fingerprint to the target device.

[0069] For example, in some embodiments of the present application, when it is determined that the business traffic data is normal, it can be directly sent to the network hardware (as a specific example of the target device, such as a switching chip, FPGA) to perform related business operations.

[0070] In some embodiments of the present application, the method for traffic fingerprint detection also includes: when the detection result characterizes that the business traffic fingerprint is abnormal, generating an alarm information and generating a temporary protection rule, wherein the temporary protection rule includes: refusing to forward the business traffic fingerprint, blocking the device corresponding to the business traffic fingerprint, or reducing the forwarding rate of the business traffic fingerprint.

[0071] For example, in some embodiments of the present application, if an anomaly exists in the service traffic data, an alarm message can be generated, and temporary protection rules can be dynamically generated, such as blocking a specific IP address (as a specific example of blocking the device corresponding to the service traffic fingerprint), limiting the traffic rate (as a specific example of reducing the forwarding rate of the service traffic fingerprint), etc. For example, the attack type present in the traffic can be confirmed through an anomaly detection model, and the corresponding protection method (i.e., a temporary protection rule) can be found in the protection rule table; alternatively, a defense strategy (i.e., a temporary protection rule) can be autonomously generated based on the attack type in the detection results; or traffic can be directly rejected (as a specific example of rejecting the forwarding of the service traffic fingerprint). The generated alarm message can be promptly notified to the relevant technical personnel.

[0072] In other embodiments, after using the baseline traffic fingerprint library to determine if service traffic data is abnormal, the traffic detection model can also be used to detect attack signatures (as a specific example of an attack type) in the service traffic data to generate corresponding temporary protection rules. In other words, during traffic fingerprint detection, security protection can rely on at least one of the baseline traffic fingerprint library and the traffic detection model.

[0073] The following is combined with Figure 4 The specific process of traffic fingerprint detection provided by some embodiments of the present application is exemplified.

[0074] Please see the attached Figure 4 , Figure 4 A flow chart of a method for traffic fingerprint detection provided in some embodiments of the present application.

[0075] The above process is explained below as an example.

[0076] S410: When the network device is in a normal operating state, feature extraction is performed on the collected network traffic at regular intervals to obtain network traffic features.

[0077] S420: Build a baseline traffic fingerprint library based on network traffic characteristics.

[0078] S430: When the network device is in the Bypass mode, receive a service traffic fingerprint.

[0079] S440, determine whether the service traffic fingerprint exists in the baseline traffic fingerprint library, if so, execute S450, otherwise execute S460.

[0080] S450: Send the service traffic fingerprint to the target device.

[0081] S460: Generate alarm information and temporary protection rules.

[0082] It is understood that the specific implementation process of S410 to S460 can refer to the method embodiment provided above, and detailed description is omitted here to avoid repetition. Although this embodiment only uses the baseline traffic fingerprint library as the basis for security detection of service traffic fingerprints, other embodiments can also use traffic detection models for security detection, and the embodiments of this application are not limited to this.

[0083] It can be seen from some of the above embodiments of the present application that when the Bypass function is enabled when the device is in an abnormal state, the present application analyzes the traffic behavior characteristics in real time, dynamically generates security rules and implements interception, thereby ensuring that the network is protected from attacks during the period of network device abnormality and improving security.

[0084] Please refer to Figure 5 , Figure 5 The following is a block diagram illustrating the components of a traffic fingerprint detection device provided by some embodiments of the present application. It should be understood that the traffic fingerprint detection device corresponds to the aforementioned method embodiment and is capable of executing each step involved in the aforementioned method embodiment. The specific functions of the traffic fingerprint detection device can be found in the description above, and a detailed description is omitted here to avoid repetition.

[0085] Figure 5 The device for traffic fingerprint detection includes at least one software functional module that can be stored in a memory in the form of software or firmware or solidified in the device for traffic fingerprint detection. The device for traffic fingerprint detection is applied to a network device that uses the Bypass mode when it is in an abnormal state. The device includes: a receiving module 510, which is used to receive a business traffic fingerprint; a detection module 520, which is used to use a traffic fingerprint detection tool to detect the business traffic fingerprint and obtain a detection result; wherein, the detection result indicates whether the business traffic fingerprint has an abnormality; the traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model; the baseline traffic fingerprint library is generated by collecting network traffic features when the network device is in operation; the traffic detection model is obtained by training an initial detection model with a historical traffic data set; the historical traffic data set includes historical business traffic and attack patterns existing in the historical business traffic; a sending module 530, which is used to send the business traffic fingerprint to the target device when the detection result indicates that the business traffic fingerprint is normal.

[0086] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0087] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0088] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0089] like Figure 6 As shown, some embodiments of the present application provide an electronic device 600, which includes: a memory 610, a processor 620, and a computer program stored in the memory 610 and executable on the processor 620, wherein the processor 620 can implement a method as described in any of the above embodiments when reading the program from the memory 610 through the bus 630 and executing the program.

[0090] Processor 620 can process digital signals and can include various computing architectures, such as a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements a combination of multiple instruction sets. In some examples, processor 620 can be a microprocessor.

[0091] The memory 610 can be used to store instructions executed by the processor 620 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all functions of one or more modules described in the embodiments of this application. The processor 620 of the embodiment of the present disclosure can be used to execute the instructions in the memory 610 to implement the method shown above. The memory 610 includes dynamic random access memory, static random access memory, flash memory, optical storage, or other memory known to those skilled in the art.

[0092] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0093] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0094] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A method for traffic fingerprint detection, characterized in that: The method is applied to a network device that uses a Bypass mode when in an abnormal state, and the method includes: Receive business traffic fingerprint; The traffic fingerprint detection tool is used to detect the business traffic fingerprint and obtain a detection result; wherein, the detection result characterizes whether the business traffic fingerprint has an anomaly; the traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model; the baseline traffic fingerprint library is generated by collecting network traffic characteristics when the network device is in operation; the traffic detection model is obtained by training an initial detection model with a historical traffic data set; the historical traffic data set includes historical business traffic and attack patterns existing in the historical business traffic; the baseline traffic fingerprint library and the traffic detection model are pre-stored in a lightweight protection engine in Bypass mode; a memory-resident protection module is set in the lightweight protection engine; when the network device is restarted, the baseline traffic fingerprint library and the traffic detection model are resident in the memory to achieve fast startup; If the detection result indicates that the service traffic fingerprint is normal, the service traffic fingerprint is sent to the target device.

2. The method according to claim 1, wherein When the network device is in a normal operating state, before using the traffic fingerprint detection tool to detect the service traffic fingerprint and obtain the detection result, the method further includes: Regularly extracting features from the collected network traffic to obtain the network traffic features; wherein the network traffic features include: at least one of network protocol type, traffic packet size, session frequency, and IP information; Expanding the network traffic feature to generate a traffic expansion feature; The baseline traffic fingerprint library is constructed based on the network traffic characteristics and the traffic extension characteristics.

3. The method according to claim 1, wherein The initial detection model is a long short-term memory artificial neural network model or a random forest model.

4. The method according to claim 1 or 2, wherein: The traffic fingerprint detection tool is the baseline traffic fingerprint library, and the traffic fingerprint detection tool is used to detect the service traffic fingerprint to obtain the detection result, including: If the service traffic fingerprint exists in the baseline traffic fingerprint library, the detection result is that the service traffic fingerprint is normal; If the service traffic fingerprint does not exist in the baseline traffic fingerprint library, the detection result is that the service traffic fingerprint is abnormal.

5. The method according to claim 1 or 3, wherein: The traffic fingerprint detection tool is the traffic detection model, and the traffic fingerprint detection tool is used to detect the service traffic fingerprint and obtain the detection result, including: Inputting the service traffic fingerprint into the traffic detection model to obtain an output result; If the output result shows that there is no attack on the service traffic fingerprint, the detection result is that the service traffic fingerprint is normal; If the output result shows the attack type of the business traffic fingerprint, the detection result is that the business traffic fingerprint is abnormal.

6. The method according to any one of claims 1 to 3, wherein The method further includes: when the detection result indicates that the service flow fingerprint is abnormal, Generate alarm information and generate temporary protection rules, wherein the temporary protection rules include: refusing to forward the business traffic fingerprint, blocking the device corresponding to the business traffic fingerprint, or reducing the forwarding rate of the business traffic fingerprint.

7. A device for traffic fingerprint detection, characterized in that: The device is applied to a network device that uses a Bypass mode when in an abnormal state, and includes: A receiving module, used for receiving service traffic fingerprints; A detection module is used to detect the business traffic fingerprint using a traffic fingerprint detection tool to obtain a detection result; wherein, the detection result characterizes whether the business traffic fingerprint has an anomaly; the traffic fingerprint detection tool includes a baseline traffic fingerprint library and / or a traffic detection model; the baseline traffic fingerprint library is generated by collecting network traffic characteristics when the network device is in operation; the traffic detection model is obtained by training an initial detection model with a historical traffic data set; the historical traffic data set includes historical business traffic and attack patterns existing in the historical business traffic; the baseline traffic fingerprint library and the traffic detection model are pre-stored in a lightweight protection engine in Bypass mode; a memory-resident protection module is set in the lightweight protection engine; when the network device is restarted, the baseline traffic fingerprint library and the traffic detection model are resident in the memory to achieve fast startup; The sending module is used to send the business traffic fingerprint to the target device when the detection result indicates that the business traffic fingerprint is normal.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program is executed by a processor to perform the method according to any one of claims 1 to 6.

9. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 6 when being run by the processor.

Images