Flow relationship determination method and device based on mean trend and confidence interval analysis

Abstract

The present invention discloses a method and device for determining traffic relationships based on mean trend and confidence interval analysis, belonging to the field of network security technology. The method comprises the following steps: establishing a flexible determination mechanism controlled by trend and confidence during the communication traffic correlation determination process; the flexible determination mechanism controlled by trend and confidence specifically includes: using the mean change trend as the modeling object, using the correlation value of each round to perform real-time updating and fitting of the correlation rolling mean sequence, combining the convergence value and the confidence interval offset direction, dynamically determining whether a conclusion is sufficient, and achieving early termination of the determination process. The present invention improves determination efficiency and response speed, and enhances adaptability and practicality.

Description

Technical Field

[0001] The present invention relates to the field of network security, and more specifically, to a method and device for determining flow relationship based on mean trend and confidence interval analysis. Background Art

[0002] Existing traffic correlation methods often struggle to maintain stable results under complex network conditions. Factors such as network bandwidth fluctuations, uncertain routing paths, traffic perturbations introduced by obfuscation mechanisms, and other forms of random interference can weaken the temporal consistency of communication flows, rendering similarity calculations based on time series features unreliable and, in turn, affecting the accuracy of communication correlation determination.

[0003] To address these challenges, some methods attempt to improve judgment robustness through multiple rounds of data observation. Specifically, correlation metrics are obtained multiple times across sampling periods, and the results from each round are averaged to form the final judgment basis. This approach leverages the gradual convergence of mean statistics over the sample accumulation process, which helps to mitigate the interference of individual anomalous observations on the overall judgment.

[0004] However, this strategy still has several limitations. First, to obtain a representative statistical mean, a sufficient number of sampling rounds must be performed, which means the determination process is often time-consuming and inefficient. Second, such methods implicitly assume that the communicating subject remains active within a relatively continuous time window. In real-world anonymous network scenarios, communication behavior is often transient and highly variable, making it difficult to meet these sampling conditions. Therefore, such methods still face challenges in practical deployment, such as high barriers to entry and limited applicability. Summary of the Invention

[0005] The purpose of the present invention is to overcome the shortcomings of the existing technology and provide a flow relationship determination method and device based on mean trend and confidence interval analysis, which improves the judgment efficiency and response speed and enhances adaptability and practicality.

[0006] The object of the present invention is achieved through the following solutions:

[0007] A method for determining flow relationship based on mean trend and confidence interval analysis includes the following steps:

[0008] In the process of determining the correlation relationship of communication traffic, a flexible determination mechanism based on trend and confidence control is established;

[0009] The flexible judgment mechanism based on trend and confidence control specifically includes: taking the mean change trend as the modeling object, using the correlation value of each round to update and fit the correlation rolling mean sequence in real time, combining the convergence value and the confidence interval offset direction, dynamically judging whether it is sufficient to draw a conclusion, and realizing early termination of the judgment process.

[0010] Furthermore, the method takes the mean change trend as the modeling object, uses the correlation value of each round to perform real-time updating and fitting on the correlation rolling mean sequence, combines the convergence value and the confidence interval offset direction, and dynamically judges whether it is sufficient to draw a conclusion, thereby realizing early termination of the judgment process. Specifically, the method includes the following sub-steps:

[0011] S1, setting parameters for communication association determination, including setting the target interval and the maximum number of acquisition times;

[0012] S2, collects a new round of communication traffic and calculates its correlation value;

[0013] S3, accumulating the correlation values ​​and calculating rolling means, updating the correlation rolling mean sequence, and forming a correlation rolling mean sequence;

[0014] S4, using the current rolling mean sequence, fitting the mean convergence trend curve;

[0015] S5, extract the convergence value based on the fitting results and construct the confidence interval;

[0016] S6, judging the communication relationship based on the limit convergence value and the confidence interval position.

[0017] Furthermore, in step S1, setting the target interval and the maximum number of acquisitions specifically includes the following sub-steps:

[0018] Set key parameters for communication association determination: including setting target convergence interval , used to define the statistical interval range of non-associated communication traffic; maximum sampling period , used to limit the upper limit of the number of rounds of data collection.

[0019] Furthermore, in step S2, the collection of a new round of communication traffic and calculation of its correlation value specifically includes the following sub-steps:

[0020] In the new sampling cycle Collect the network traffic of the current communication source and target node to be analyzed, extract its time series characteristics, and calculate the correlation value of this round ; The correlation calculation adopts the similarity measurement method, which is recorded as:

[0021]

[0022] in, 、 Indicates the Traffic characteristic sequences of the sender and receiver in a round.

[0023] Furthermore, in step S3, the updating of the rolling mean sequence of correlation degrees specifically includes the following sub-steps:

[0024] Before The correlation degree calculated by round collection Accumulate and calculate Rolling mean after round sampling :

[0025]

[0026] Constructing a rolling mean series , as the original data for subsequent trend fitting.

[0027] Furthermore, in step S4, the fitting mean convergence trend curve specifically includes the following sub-steps:

[0028] Using the current rolling mean series , fitting its convergence trend; considering that the mean has an exponential decay characteristic that tends to be stable as the number of sampling rounds increases, the exponential function model is adopted:

[0029]

[0030] in, Indicates the limiting convergence value of the fit; 、 is the fitting coefficient, which represents the initial offset and convergence speed. The model is fitted with a nonlinear curve by the least squares method to estimate the parameters 、 、 .

[0031] Furthermore, in step S5, extracting the convergence value and constructing the confidence interval specifically includes the following sub-steps:

[0032] According to the fitted model As a result, the limit convergence value is extracted As the basis for judgment, and based on the covariance matrix returned by the fitting process ,calculate Standard deviation , construct the confidence interval:

[0033]

[0034] in, is the standard normal critical value at the corresponding confidence level.

[0035] Furthermore, in step S6, the determining of the communication relationship specifically includes the following sub-steps:

[0036] According to the limit convergence value and the confidence interval position, combined with the preset target convergence interval , to determine whether the node pair has a communication relationship:

[0037] If the convergence value With confidence interval Both fall into the target convergence interval , it is determined that there is no communication relationship and the sampling is terminated early;

[0038] If the convergence value With confidence interval Both deviate from the target convergence interval , it is determined that there is a communication relationship and the sampling is terminated early;

[0039] If the convergence value Falling into the target convergence interval , but the confidence interval Does not completely fall into the target convergence interval , and the number of sampling rounds has not yet reached , then return to step S2 to continue sampling and analysis; if the number of sampling rounds has reached , it is determined that there is no communication relationship.

[0040] Furthermore, the target convergence interval According to the statistical characteristics of the background traffic samples, the quantile value of the correlation distribution of non-correlated communication traffic is selected to construct the target convergence interval. ,in 、 They represent the values ​​of a certain quantile of the correlation degree in the background samples respectively.

[0041] Furthermore, the time series features include packet count, burst behavior and packet interval.

[0042] Furthermore, the similarity measurement method includes a Spearman rank correlation coefficient method and a Euclidean distance method.

[0043] A flow relationship determination device based on mean trend and confidence interval analysis includes a computer device, the computer device includes a processor and a memory, the memory stores a computer program, and when the computer program is loaded by the processor, the method described in any one of the above items is executed.

[0044] The beneficial effects of the present invention include:

[0045] 1. Trend Identification and Dynamic Termination: This method continuously updates the mean correlation value and fits its changing trend. Based on the fit results, it dynamically constructs confidence intervals, enabling dynamic advancement of correlation judgment. When the mean trend is observed to significantly deviate from or steadily converge within the "non-correlation characteristic interval," the sampling and judgment process is terminated prematurely, avoiding unnecessary data collection and resource waste, significantly improving judgment efficiency and response speed.

[0046] 2. Strong Adaptability and Practicality: This method constructs a target interval based on the statistical stability of the correlation distribution between non-communication flows, dynamically assessing the degree of deviation from the target traffic. Even in the presence of strong interference factors such as obfuscation strategies, traffic padding, and path perturbations in anonymous networks, it can still use a stable "white background" as a judgment baseline, achieving robust adaptation to dynamic environments. This method has excellent engineering feasibility and practical application value.

[0047] 3. Good Scalability: This method constructs judgment criteria based on trend modeling and confidence interval theory in time series analysis. It has clear mathematical logic, a clear reasoning path, and good interpretability. Furthermore, it can be combined with cluster analysis and goodness-of-fit tests to further enhance the model's intelligent judgment capabilities, laying the foundation for subsequent model iteration and deployment optimization. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 It is a model diagram of anonymous network traffic association scenario;

[0050] Figure 2 The present invention is a flowchart of a method for determining a communication traffic correlation relationship based on mean trend fitting and confidence interval analysis. DETAILED DESCRIPTION

[0051] All features disclosed in all embodiments in this specification, or steps in all methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or expanded or replaced in any manner.

[0052] In response to the limitations of multi-round traffic collection and mean statistics methods in anonymous network traffic association, the present invention proposes a communication traffic association relationship determination method based on mean trend fitting and confidence interval analysis. The purpose is to solve the technical problems of the existing determination method based on multi-round traffic collection and mean statistics in the anonymous network traffic association process based on time series feature matching, such as the large number of sampling rounds, high time cost, low determination efficiency, and the requirement that the monitored object maintain long-term continuous communication behavior and the harsh usage conditions resulting in poor practicality.

[0053] In a preferred embodiment, the specific application is as follows Figure 1 Anonymous network traffic correlation scenario shown. Figure 1 In this scenario, communication sources 1, 2, 3 to i and communication targets 1, 2, 3 to k communicate anonymously using an anonymous service network that includes relays 1, 2, 3 to j. This scenario requires setting up sender monitoring and receiver monitoring facilities between the communication source and the entry relay node, and between the exit relay node and the communication target, respectively, to monitor the traffic of the communication source and the communication target. Figure 1 In the scenario shown, a sending-end listening facility is deployed between source 1 and relay 1. This facility can be deployed on the exit of source 1, or on the corresponding entrance of relay 1, or on the traffic forwarding device between the two. Here, it is uniformly represented by the midpoint of the connection line between source 1 and relay 1, and is denoted as Fa11. Similarly, there are sending-end listening points Fa21, Fa34, and Fai7. A receiving-end listening facility is deployed between relay 3 and target 1. This facility can be deployed on the corresponding exit of relay 3, or on the entrance of target 1, or on the traffic forwarding device between the two. Here, it is uniformly represented by the midpoint of the connection line between relay 3 and target 1, and is denoted as Shou31. Similarly, there are receiving-end listening points Shou62, Shou63, and Shou9k. In the process of these communication source nodes and communication target nodes communicating with the outside world respectively, the network traffic at the corresponding locations can be captured through sending-end listening and receiving-end listening. The goal of anonymous network traffic association is to identify the source node and target node that are communicating. For example, Figure 1 In the example, it is necessary to identify that source 2 is communicating with target 3, while source i is communicating with target 1 through traffic information correlation.

[0054] like Figure 2 As shown, the method for determining traffic relationship based on mean trend and confidence interval analysis proposed in an embodiment of the present invention specifically performs the following steps: "setting the target interval and the maximum number of collection times", "collecting a new round of communication traffic and calculating its correlation value", "updating the correlation rolling mean sequence", "fitting the mean convergence trend curve", "extracting the convergence value and constructing the confidence interval", and "determining the communication relationship", which are described in detail below:

[0055] Step S1, set the target interval and maximum number of acquisitions

[0056] Set key parameters for communication association determination, including target convergence interval , used to define the statistical interval range of "non-associated communication traffic"; maximum sampling period , used to limit the upper limit of the number of rounds of data collection. This target interval is usually determined based on the statistical characteristics of background traffic samples, and can be constructed using the percentile value of the correlation distribution of non-correlated communication traffic, such as: ,in 、 Respectively represent the value of a certain quantile of the correlation degree in the background sample. At the same time, set the maximum number of sampling cycles , to avoid system congestion and resource waste caused by infinite sampling.

[0057] For example: Based on the statistical distribution of the correlation of non-communication traffic samples, extract its quartiles and quartiles , construct the target interval as: , set the maximum number of sampling cycles to =10, that is, if the convergence judgment cannot be completed within 10 rounds, the judgment process will be forced to terminate.

[0058] Step S2: Collect the new round of communication traffic and calculate its correlation value

[0059] In the new sampling cycle Collect the network traffic of the current communication source and target node to be analyzed, extract its time series characteristics (such as packet count, burst behavior, packet interval, etc.), and calculate the correlation value of this round The correlation calculation can be done using similarity measurement methods, such as Spearman rank correlation coefficient, Euclidean distance, etc., which can be uniformly expressed as:

[0060]

[0061] in 、 Indicates the Traffic characteristic sequences of the sender and receiver in a round.

[0062] For example, in the fifth round of sampling, the system extracts the 60-second data packet size and packet interval sequence of the source node and the target node, and uses the Spearman correlation function to calculate the correlation value of this round. .

[0063] Step S3: Update the rolling mean sequence of correlation

[0064] Before The correlation degree calculated by round collection Accumulate and calculate Rolling mean after round sampling :

[0065]

[0066] Constructing a rolling mean series , as the original data for subsequent trend fitting.

[0067] For example, suppose five rounds of sampling have been completed, and their correlation values ​​are: , , , , , then the rolling mean series is: , , , , .

[0068] Step S4: Fitting the mean convergence trend curve

[0069] Using the current rolling mean series , fitting its convergence trend. Considering that the mean has an exponential decay characteristic that tends to be stable as the number of sampling rounds increases, the exponential function model is adopted:

[0070]

[0071] in Indicates the limiting convergence value of the fit; 、 is the fitting coefficient, which represents the initial offset and convergence speed. The above model can be fitted with a nonlinear curve by the least squares method to estimate the parameters 、 、 .

[0072] For example, after calculating the rolling mean sequence for the 10 collected samples, we fit the exponential model using Scipy's curve_fit method to obtain the optimal parameters: =0.162, , , the fitting function is:

[0073] .

[0074] Step S5: extract the convergence value and construct the confidence interval

[0075] According to the fitted model As a result, the limit convergence value is extracted As the basis for judgment, and based on the covariance matrix returned by the fitting process ,calculate Standard deviation , construct the confidence interval:

[0076]

[0077] in is the standard normal critical value under the corresponding confidence level (such as 95%), which is usually taken .

[0078] For example: The fitting output parameter is =0.162, corresponding to the standard deviation , then the 95% confidence interval is:

[0079] .

[0080] Step S6: Determine the communication relationship

[0081] According to the limit convergence value and the confidence interval position, combined with the preset target convergence interval , to determine whether the node pair has a communication relationship:

[0082] If the convergence value With confidence interval All fall within the target range , it is determined as "no communication relationship" and the sampling is terminated early;

[0083] If the convergence value With confidence interval Deviated from the target range , it is determined that "communication relationship exists" and the sampling is terminated early;

[0084] If the convergence value Falling into the target range , but the confidence interval Not fully within the target range , and the number of sampling rounds has not yet reached , then return to step 2 to continue sampling and analysis. If the number of sampling rounds has reached , it is judged as “no communication relationship”.

[0085] For example: Let the target interval be If the predicted convergence value is 0.162 and the confidence interval is , because both the convergence value and the confidence interval fall into the target interval, it is determined to be "no communication relationship" and the sampling ends. If the predicted convergence value is 0.25 and the confidence interval is , because both the convergence value and the confidence interval deviate from the target interval, it is determined that "communication relationship exists" and the sampling ends. If the predicted convergence value is 0.19 and the confidence interval is , the maximum number of sampling times is 10 times, and only 7 rounds of sampling have been experienced so far. Because the convergence value falls into the target interval but the confidence interval does not completely fall into the target interval, and the number of sampling rounds has not reached the maximum number of acquisition times of 10 times, return to step 2 to continue sampling analysis; if the number of sampling times has reached 10 times at this time, it is determined to be "no communication relationship".

[0086] The beneficial effects of the technical solutions of the embodiments of the present invention are further described in detail as follows:

[0087] The technical solution of the embodiment of the present invention solves the technical problems in the process of anonymous network traffic correlation based on time series feature matching, such as the large number of sampling rounds, high time cost, low judgment efficiency, and the requirement that the monitored object maintains long-term continuous communication behavior and harsh usage conditions, which leads to poor practicality. This solution takes the mean change trend as the core modeling object, uses the correlation value of each round to update and fit the correlation rolling mean sequence in real time, combines the convergence value and the confidence interval offset direction, and dynamically judges whether it is sufficient to draw a conclusion, thereby realizing early termination of the judgment process. This solution breaks away from the traditional idea of ​​relying on fixed rounds and static threshold judgments, and instead introduces a flexible judgment mechanism of "trend and confidence control", which has stronger real-time performance, judgment rationality and algorithm interpretability.

[0088] The method of the technical solution of the embodiment of the present invention has the following three technical advantages:

[0089] 1. Trend Identification and Dynamic Termination: This method continuously updates the mean correlation value and fits its changing trend. Based on the fit results, it dynamically constructs confidence intervals, enabling dynamic advancement of correlation judgment. When the mean trend is observed to significantly deviate from or steadily converge within the "non-correlation characteristic interval," the sampling and judgment process is terminated prematurely, avoiding unnecessary data collection and resource waste, significantly improving judgment efficiency and response speed.

[0090] 2. Strong Adaptability and Practicality: This method constructs a target interval based on the statistical stability of the correlation distribution between non-communication flows, dynamically assessing the degree of deviation from the target traffic. Even in the presence of strong interference factors such as obfuscation strategies, traffic padding, and path perturbations in anonymous networks, this method can still use a stable "white background" as a judgment baseline, achieving robust adaptation to dynamic environments. This method has strong engineering feasibility and practical application value.

[0091] 3. Good Scalability: This method builds its judgment criteria based on trend modeling and confidence interval theory from time series analysis. It has clear mathematical logic, a well-defined reasoning path, and good interpretability. Furthermore, it can be combined with cluster analysis and goodness-of-fit tests to further enhance the model's intelligent judgment capabilities, laying a theoretical foundation for subsequent model iteration and deployment optimization.

[0092] It should be noted that within the scope of protection defined in the claims of the present invention, the following embodiments can be combined and / or expanded or replaced in any logical way from the above specific implementation methods, such as disclosed technical principles, disclosed technical features or implicitly disclosed technical features.

[0093] Example 1

[0094] A method for determining flow relationship based on mean trend and confidence interval analysis includes the following steps:

[0095] In the process of determining the correlation relationship of communication traffic, a flexible determination mechanism based on trend and confidence control is established;

[0096] The flexible judgment mechanism based on trend and confidence control specifically includes: taking the mean change trend as the modeling object, using the correlation value of each round to update and fit the correlation rolling mean sequence in real time, combining the convergence value and the confidence interval offset direction, dynamically judging whether it is sufficient to draw a conclusion, and realizing early termination of the judgment process.

[0097] Example 2

[0098] On the basis of Example 1, the method takes the mean change trend as the modeling object, uses the correlation value of each round to update and fit the correlation rolling mean sequence in real time, combines the convergence value and the confidence interval offset direction, and dynamically judges whether it is sufficient to draw a conclusion, thereby realizing early termination of the judgment process. Specifically, the method includes the following sub-steps:

[0099] S1, setting parameters for communication association determination, including setting the target interval and the maximum number of acquisition times;

[0100] S2, collects a new round of communication traffic and calculates its correlation value;

[0101] S3, accumulating the correlation values ​​and calculating rolling means, updating the correlation rolling mean sequence, and forming a correlation rolling mean sequence;

[0102] S4, using the current rolling mean sequence, fitting the mean convergence trend curve;

[0103] S5, extract the convergence value based on the fitting results and construct the confidence interval;

[0104] S6, judging the communication relationship based on the limit convergence value and the confidence interval position.

[0105] Example 3

[0106] On the basis of Example 2, in step S1, setting the target interval and the maximum number of acquisitions specifically includes the following sub-steps:

[0107] Set key parameters for communication association determination: including setting target convergence interval , used to define the statistical interval range of "non-associated communication traffic"; maximum sampling period , used to limit the upper limit of the number of rounds of data collection.

[0108] Example 4

[0109] Based on Example 2, in step S2, collecting a new round of communication traffic and calculating its correlation value specifically includes the following sub-steps:

[0110] In the new sampling cycle Collect the network traffic of the current communication source and target node to be analyzed, extract its time series characteristics, and calculate the correlation value of this round ; The correlation calculation adopts the similarity measurement method, which is recorded as:

[0111]

[0112] in, 、 Indicates the Traffic characteristic sequences of the sender and receiver in a round.

[0113] Example 5

[0114] On the basis of Example 2, in step S3, the updating of the rolling mean sequence of correlation degrees specifically includes the following sub-steps:

[0115] Before The correlation degree calculated by round collection Accumulate and calculate Rolling mean after round sampling :

[0116]

[0117] Constructing a rolling mean series , as the original data for subsequent trend fitting.

[0118] Example 6

[0119] On the basis of Example 2, in step S4, the fitting of the mean convergence trend curve specifically includes the following sub-steps:

[0120] Using the current rolling mean series , fitting its convergence trend; considering that the mean has an exponential decay characteristic that tends to be stable as the number of sampling rounds increases, the exponential function model is adopted:

[0121]

[0122] in, Indicates the limiting convergence value of the fit; 、 is the fitting coefficient, which represents the initial offset and convergence speed. The model is fitted with a nonlinear curve by the least squares method to estimate the parameters 、 、 .

[0123] Example 7

[0124] Based on Example 2, in step S5, extracting the convergence value and constructing the confidence interval specifically includes the following sub-steps:

[0125] According to the fitted model As a result, the limit convergence value is extracted As the basis for judgment, and based on the covariance matrix returned by the fitting process ,calculate Standard deviation , construct the confidence interval:

[0126]

[0127] in, is the standard normal critical value at the corresponding confidence level.

[0128] Example 8

[0129] Based on Example 2, in step S6, determining the communication relationship specifically includes the following sub-steps:

[0130] According to the limit convergence value and the confidence interval position, combined with the preset target convergence interval , to determine whether the node pair has a communication relationship:

[0131] If the convergence value With confidence interval Both fall into the target convergence interval , it is determined as "no communication relationship" and the sampling is terminated early;

[0132] If the convergence value With confidence interval Both deviate from the target convergence interval , it is determined that "communication relationship exists" and the sampling is terminated early;

[0133] If the convergence value Falling into the target convergence interval , but the confidence interval Does not completely fall into the target convergence interval , and the number of sampling rounds has not yet reached , then return to step S2 to continue sampling and analysis; if the number of sampling rounds has reached , it is judged as “no communication relationship”.

[0134] Example 9

[0135] Based on Example 3, the target convergence interval According to the statistical characteristics of the background traffic samples, the quantile value of the correlation distribution of non-correlated communication traffic is selected to construct the target convergence interval. ,in 、 They represent the values ​​of a certain quantile of the correlation degree in the background samples respectively.

[0136] Example 10

[0137] Based on Example 4, the time series features include data packet count, burst behavior and packet interval.

[0138] Example 11

[0139] Based on Example 4, the similarity measurement method includes the Spearman rank correlation coefficient method and the Euclidean distance method.

[0140] Example 12

[0141] A flow relationship determination device based on mean trend and confidence interval analysis includes a computer device, the computer device includes a processor and a memory, the memory stores a computer program, and when the computer program is loaded by the processor, executes the method described in any one of Examples 1 to 11.

[0142] The units involved in the embodiments of the present invention may be implemented in software or hardware, and the units described may also be provided in a processor. In some cases, the names of these units do not limit the units themselves.

[0143] According to one aspect of an embodiment of the present invention, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations described above.

[0144] As another aspect, embodiments of the present invention further provide a computer-readable medium, which may be included in the electronic device described in the above embodiments, or may exist independently and not incorporated into the electronic device. The computer-readable medium carries one or more programs, and when executed by the electronic device, the electronic device implements the methods described in the above embodiments.

Claims

1. A method for determining flow relationship based on mean trend and confidence interval analysis, characterized in that: The following steps are involved: In the process of determining the correlation relationship of communication traffic, a flexible determination mechanism based on trend and confidence control is established; The flexible judgment mechanism based on trend and confidence control specifically includes: taking the mean change trend as the modeling object, using the correlation value of each round to update and fit the correlation rolling mean sequence in real time, combining the convergence value and the confidence interval deviation direction to dynamically judge whether it is sufficient to draw a conclusion, and realizing early termination of the judgment process; The method takes the mean change trend as the modeling object, uses the correlation value of each round to update and fit the correlation rolling mean sequence in real time, combines the convergence value and the confidence interval offset direction, and dynamically judges whether it is sufficient to draw a conclusion, thereby realizing early termination of the judgment process. Specifically, the method includes the following sub-steps: S1, setting parameters for communication association determination, including setting the target interval and the maximum number of acquisition times; S2, collects a new round of communication traffic and calculates its correlation value; S3, accumulating the correlation values ​​and calculating rolling means, updating the correlation rolling mean sequence, and forming a correlation rolling mean sequence; S4, using the current rolling mean sequence, fitting the mean convergence trend curve; S5, extract the convergence value based on the fitting results and construct the confidence interval; S6, judging the communication relationship based on the limit convergence value and the confidence interval position; In step S1, the setting of the target interval and the maximum number of acquisitions specifically includes the following sub-steps: Set key parameters for communication association determination: including setting target convergence interval , used to define the statistical interval range of non-associated communication traffic; maximum sampling period , used to limit the upper limit of the number of rounds of data collection; In step S6, the communication relationship is determined, specifically including the following sub-steps: According to the limit convergence value and the confidence interval position, combined with the preset target convergence interval , to determine whether the node pair has a communication relationship: If the convergence value With confidence interval Both fall into the target convergence interval , it is determined that there is no communication relationship and the sampling is terminated early; If the convergence value With confidence interval Both deviate from the target convergence interval , it is determined that there is a communication relationship and the sampling is terminated early; If the convergence value Falling into the target convergence interval , but the confidence interval Does not completely fall into the target convergence interval , and the number of sampling rounds has not yet reached , then return to step S2 to continue sampling and analysis; if the number of sampling rounds has reached , it is determined that there is no communication relationship; The flexible decision mechanism is used to determine the relationship between communication flows.

2. The flow relationship determination method based on mean trend and confidence interval analysis according to claim 1 is characterized in that: In step S2, the new round of communication traffic is collected and its correlation value is calculated, which specifically includes the following sub-steps: In the new sampling cycle Collect the network traffic of the current communication source and target node to be analyzed, extract its time series characteristics, and calculate the correlation value of this round ; The correlation calculation adopts the similarity measurement method, which is recorded as: in, 、 Indicates the Traffic characteristic sequences of the sender and receiver in a round.

3. The flow relationship determination method based on mean trend and confidence interval analysis according to claim 1 is characterized in that: In step S3, the updating of the rolling mean sequence of correlation degrees specifically includes the following sub-steps: Before The correlation degree calculated by round collection Accumulate and calculate Rolling mean after round sampling : Constructing a rolling mean series , as the original data for subsequent trend fitting.

4. The flow relationship determination method based on mean trend and confidence interval analysis according to claim 1 is characterized in that: In step S4, the fitting of the mean convergence trend curve specifically includes the following sub-steps: Using the current rolling mean series , fitting its convergence trend; Considering that the mean has an exponential decay characteristic that tends to be stable as the number of sampling rounds increases, an exponential function model is adopted: in, Indicates the limiting convergence value of the fit; 、 is the fitting coefficient, which represents the initial offset and convergence speed. The model is fitted with a nonlinear curve by the least squares method to estimate the parameters 、 、 .

5. The flow relationship determination method based on mean trend and confidence interval analysis according to claim 1 is characterized in that: In step S5, the extraction of the convergence value and the construction of the confidence interval specifically include the following sub-steps: According to the fitted model As a result, the limit convergence value is extracted As the basis for judgment, and based on the covariance matrix returned by the fitting process ,calculate Standard deviation , construct the confidence interval: in, is the standard normal critical value at the corresponding confidence level.

6. The flow relationship determination method based on mean trend and confidence interval analysis according to claim 1 is characterized in that: Target convergence interval According to the statistical characteristics of the background traffic samples, the quantile value of the correlation distribution of non-correlated communication traffic is selected to construct the target convergence interval. ,in 、 They represent the values ​​of a certain quantile of the correlation degree in the background samples respectively.

7. The flow relationship determination method based on mean trend and confidence interval analysis according to claim 2 is characterized in that: The time series features include packet count, burst behavior, and packet interval.

8. The flow relationship determination method based on mean trend and confidence interval analysis according to claim 2 is characterized in that: The similarity measurement method includes the Spearman rank correlation coefficient method and the Euclidean distance method.

9. A flow relationship determination device based on mean trend and confidence interval analysis, characterized in that: The method comprises a computer device comprising a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is loaded by the processor, the method according to any one of claims 1 to 8 is executed.

Images