Data traffic cleaning and protection method and system based on security service chain

Abstract

The invention relates to the technical field of computer information processing, and discloses a data traffic cleaning and protection method and system based on a security service chain, and the method comprises the steps: obtaining a bandwidth utilization rate change curve of traffic data in a preset time period, screening out a to-be-processed traffic data set according to the traffic data bandwidth utilization rate change curve in a preset time period; acquiring a security function set of the to-be-processed traffic data set, and deploying an initial security service chain according to the security function set; and screening out abnormal outlier nodes of the initial security service chain, replacing the abnormal outlier nodes to obtain a final security service chain, and performing traffic cleaning on the to-be-processed traffic data set according to the final security service chain. The abnormal traffic data in the traffic data can be accurately detected, traffic cleaning is performed on the abnormal traffic data by reducing delay, balancing load and avoiding a security service chain of an outlier node, and the security protection efficiency of traffic attacks is improved.

Description

Technical Field

[0001] The present application relates to the field of computer information processing technology, and more specifically, to a data traffic cleaning and protection method and system based on a security service chain. Background Art

[0002] With the continuous development of the Internet, business operations in various fields are becoming increasingly dependent on the Internet. However, the network security environment is deteriorating, and Distributed Denial-Of-Service (DDOS) attacks are increasingly threatening basic business systems and data security. Therefore, timely and efficient protection against DDOS attacks is crucial.

[0003] Existing technologies establish a security resource pool to pull the attacked traffic data, and then pull the attacked traffic data into the security service chain deployed in the security resource pool, and clean the attacked traffic data through the security service chain. However, when an abnormality occurs in the service chain node, the fixed security service chain cannot promptly perform load balancing on the abnormal node, resulting in increased traffic cleaning delays and poor adaptability to complex network environments. Summary of the Invention

[0004] The present invention provides a data traffic cleaning and protection method and system based on a security service chain, which is used to solve the problem of poor adaptability of the security service chain in the existing technology in complex network environments. The method includes: Obtain a bandwidth utilization change curve of traffic data within a preset time period, and filter out a set of traffic data to be processed based on the bandwidth utilization change curve of traffic data within the preset time period; obtain a security function set of the traffic data set to be processed, and deploy an initial security service chain based on the security function set; filter out abnormal outlier nodes in the initial security service chain, replace the abnormal outlier nodes to obtain a final security service chain, and perform traffic cleaning on the traffic data set to be processed based on the final security service chain.

[0005] Furthermore, the method of screening out the to-be-processed traffic data set based on the bandwidth utilization change curve of the traffic data within a preset time period includes: obtaining a standard bandwidth utilization change curve, setting a preset data interval, and segmenting the standard bandwidth utilization change curve according to the preset data interval; calculating the upper quartile and the lower quartile of each preset data interval in the standard bandwidth utilization change curve, and calculating the interquartile range based on the upper quartile and the lower quartile; using the upper quartile and the lower quartile as boundary intervals, and counting the minimum distance value between each bandwidth utilization data in the current time period and the boundary interval; calculating the box plot multiples based on the bandwidth utilization change curve of the traffic data within the preset time period, and determining whether there is data with a minimum distance value greater than the box plot multiples of the interquartile range; if so, setting the traffic data set of the corresponding time period as the to-be-processed traffic data set.

[0006] Furthermore, the calculating of the box plot multiple based on the bandwidth utilization change curve of the traffic data within a preset time period includes: obtaining a preset rolling time window, dividing the bandwidth utilization change curve according to the preset rolling time window to obtain a plurality of sub-bandwidth utilization change curves; obtaining a plurality of historical abnormal bandwidth utilization change curves, calculating the correlation coefficient between the sub-bandwidth utilization change curves and each historical abnormal bandwidth utilization change curve; determining the abnormal approximation based on the correlation coefficient between the sub-bandwidth utilization change curves and each historical abnormal bandwidth utilization change curve, and multiplying the abnormal approximation by the initial box plot multiple to obtain a final box plot multiple.

[0007] Furthermore, the method of obtaining a security function set of a traffic data set to be processed includes: obtaining a historical traffic data set to be cleaned and a corresponding security function set, and preprocessing the historical traffic data set to be cleaned and the corresponding security function set; establishing a training sample set based on the preprocessed historical traffic data set to be cleaned and the corresponding security function set, establishing a security function evaluation model based on the training sample set and training the security function evaluation model to obtain a trained security function evaluation model; obtaining current traffic data to be cleaned, and inputting the current traffic data to be cleaned into the trained security function evaluation model to obtain a security function set.

[0008] Furthermore, the deployment of the initial security service chain according to the security function set includes: initializing the particle swarm parameters, where each particle represents a deployment plan for the security service chain, and the initial particle swarm parameters include the population size, the maximum number of iterations, the inertia weight, and the learning factor; setting the fitness function, calculating the fitness function value of each particle, and determining the individual optimal value and the global optimal value; the fitness function is, ;in, is the transmission delay between all nodes, The bandwidth requirements of the security service chain, , are the first weight and the second weight respectively; based on the fitness function value of each particle, the global optimal position and the historical optimal position of the particle are updated; the particle with the lowest fitness is eliminated, and the particle speed and the particle position are updated based on the fitness value; the above steps are repeated until the maximum number of iterations is reached or the convergence condition is met, the optimization is completed, and the optimal solution is output, that is, the optimal security service chain deployment plan.

[0009] Furthermore, the method of screening out abnormal outlier nodes in the initial security service chain and replacing the abnormal outlier nodes includes: calculating the traffic characteristic parameters of each service node in the initial security service chain, determining the outlier parameters of the service node according to the traffic characteristic parameters based on the LOF algorithm, and screening out the abnormal outlier nodes according to the outlier parameters of the service node; obtaining the backup service node closest to the abnormal outlier node, and replacing the backup service node with the abnormal outlier node; obtaining the outlier parameters of the backup service node after the node replacement in the security service chain, determining the node deviation according to the outlier parameters of the backup service node in the security service chain, and replacing the abnormal outlier node according to the node deviation.

[0010] Furthermore, determining the node deviation according to the outlier parameter of the standby service node in the security service chain includes: calculating the node deviation according to a node deviation calculation formula, wherein the node deviation calculation formula is specifically: , in, is the node deviation, The bandwidth requirement of the security service chain after the standby service node is replaced. is the outlier parameter of the backup service node, is the outlier parameter of the abnormal outlier node, is the natural exponential function.

[0011] Furthermore, the replacing of the abnormal outlier node according to the node deviation includes: if the node deviation is less than a first preset threshold, replacing the backup service node with the abnormal outlier node; if the node deviation is greater than or equal to the first preset threshold, not replacing the abnormal outlier node.

[0012] Furthermore, the traffic cleaning of the traffic data set to be processed according to the final security service chain includes: pulling the traffic data to be cleaned to the corresponding security service chain, cleaning and filtering the traffic to be cleaned according to the security service chain to obtain a cleaned traffic data set; and reinjecting the cleaned traffic data set to replace the traffic data set to be processed.

[0013] To achieve the above objectives, the present invention further provides a data traffic cleaning and protection system based on a security service chain, comprising: The protection module is used to obtain the bandwidth utilization change curve of the traffic data in a preset time period, and filter out the traffic data set to be processed based on the bandwidth utilization change curve of the traffic data in the preset time period; the deployment module is used to obtain the security function set of the traffic data set to be processed, and deploy the initial security service chain based on the security function set; the cleaning module is used to filter out abnormal outlier nodes in the initial security service chain, replace the abnormal outlier nodes to obtain the final security service chain, and perform traffic cleaning on the traffic data set to be processed based on the final security service chain.

[0014] The beneficial effects of the present invention are: By applying the above technical solutions, the present invention accurately detects abnormal traffic data sets through changes in bandwidth utilization of traffic data, and realizes intelligent orchestration of security service chains by screening abnormal outlier nodes in the security service chain and replacing them in a timely manner, significantly reducing latency, balancing loads, ensuring adaptability to complex network environments, and improving the security protection efficiency of traffic attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 A schematic diagram of a process for cleaning and protecting data traffic based on a security service chain according to an embodiment of the present invention is shown; Figure 2 The figure shows the overall structure of a data traffic cleaning and protection system based on a security service chain proposed in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0018] The present application embodiment provides a data flow cleaning and protection method based on a security service chain, such as Figure 1 Shown, including: S101, obtaining a bandwidth utilization change curve of traffic data within a preset period, and filtering out a set of traffic data to be processed according to the bandwidth utilization change curve of traffic data within the preset period; In some embodiments of the present application, the method of screening out a set of traffic data to be processed based on a bandwidth utilization change curve of traffic data within a preset time period includes: obtaining a standard bandwidth utilization change curve, setting a preset data interval, and segmenting the standard bandwidth utilization change curve according to the preset data interval; calculating the upper quartile and lower quartile of each preset data interval in the standard bandwidth utilization change curve, and calculating the interquartile range based on the upper quartile and lower quartile; using the upper quartile and lower quartile as boundary intervals, and counting the minimum distance value between each bandwidth utilization data in the current time period and the boundary interval; calculating a box plot multiple based on the bandwidth utilization change curve of the traffic data within the preset time period, and determining whether there is data with a minimum distance value greater than the box plot multiple of the interquartile range; if so, setting the traffic data set of the corresponding time period as the set of traffic data to be processed.

[0019] In this embodiment, a standard bandwidth utilization change curve is preset. The upper quartile and the lower quartile are calculated by the median of the bandwidth utilization within a preset data interval to establish a boundary interval and obtain the interquartile range. The bandwidth utilization change curve of the traffic data within a preset time period is detected in real time, and the boundary interval is substituted into the change curve to calculate the minimum distance value. Abnormal data is filtered out by comparing the minimum distance value with the box plot multiple of the interquartile range to obtain a set of traffic data to be processed with abnormal data.

[0020] In some embodiments of the present application, the calculating of the box plot multiple based on the bandwidth utilization change curve of the traffic data within a preset time period includes: obtaining a preset rolling time window, dividing the bandwidth utilization change curve according to the preset rolling time window to obtain a plurality of sub-bandwidth utilization change curves; obtaining a plurality of historical abnormal bandwidth utilization change curves, calculating the correlation coefficient between the sub-bandwidth utilization change curves and each historical abnormal bandwidth utilization change curve; determining the abnormal approximation based on the correlation coefficient between the sub-bandwidth utilization change curves and each historical abnormal bandwidth utilization change curve, and multiplying the abnormal approximation by the initial box plot multiple to obtain a final box plot multiple.

[0021] In this embodiment, the box plot multiple will affect the sensitivity of abnormal data detection. By counting multiple historical abnormal bandwidth utilization change curves through historical traffic abnormal events, the highest correlation coefficient between the sub-bandwidth utilization change curve and the historical abnormal bandwidth utilization change curve is screened out. The larger the highest correlation coefficient, the higher the abnormal probability. The reciprocal of the highest correlation coefficient is calculated, and the reciprocal of the highest correlation coefficient is normalized. The range of the reciprocal of the highest correlation coefficient is set to [0, 2]. The reciprocal of the highest correlation coefficient after normalization is used as the abnormal approximation. In this embodiment, the initial box plot multiple is set to 1.5, and the initial box plot multiple is corrected by the abnormal approximation to obtain the final box plot multiple.

[0022] S102, obtaining a security function set for the traffic data set to be processed, and deploying an initial security service chain according to the security function set; In some embodiments of the present application, the security function set of the traffic data set to be processed is obtained, including: obtaining a historical traffic data set to be cleaned and a corresponding security function set, and preprocessing the historical traffic data set to be cleaned and the corresponding security function set; establishing a training sample set based on the preprocessed historical traffic data set to be cleaned and the corresponding security function set, establishing a security function evaluation model based on the training sample set and training the security function evaluation model to obtain a trained security function evaluation model; obtaining current traffic data to be cleaned, inputting the current traffic data to be cleaned into the trained security function evaluation model to obtain a security function set.

[0023] In this embodiment, the security service nodes required by the traffic data set to be processed are obtained through the security function set, and the initial security service chain is deployed by connecting the required security service nodes.

[0024] In this embodiment, a historical flow data set to be cleaned and a corresponding security function set are extracted from historical flow anomaly events, and the historical flow data set to be cleaned and the corresponding security function set extracted from the historical flow anomaly events are used as a group of sample data. All historical flow data sets to be cleaned and the corresponding security function sets in the historical flow anomaly events are statistically preprocessed, and the preprocessing includes at least one of the following: data cleaning, normalization, feature construction and feature extraction. A training sample set is established through the preprocessed data, and the defect grid feature set in the training sample set is used as an input variable, and the target removal amount is used as an output variable. A deep learning neural network model is established through the training sample set to obtain a safety function evaluation model, whose network structure is ResNet50, 80% of the training sample set is used as a training set and 20% as a test set, the mean square error loss function is used, and the optimizer uses Adam. After training, a trained safety function evaluation model is finally obtained, and the screened current flow data to be cleaned is input into the trained safety function evaluation model to obtain the corresponding safety function set.

[0025] In some embodiments of the present application, the deployment of the initial security service chain according to the security function set includes: initializing particle swarm parameters, where each particle represents a deployment scheme for a security service chain, and the initial particle swarm parameters include population size, maximum number of iterations, inertia weight, and learning factor; setting a fitness function, calculating the fitness function value of each particle, and determining the individual optimal value and the global optimal value; the fitness function is, ;in, is the transmission delay between all nodes, The bandwidth requirements of the security service chain, , are the first weight and the second weight respectively; based on the fitness function value of each particle, the global optimal position and the historical optimal position of the particle are updated; the particle with the lowest fitness is eliminated, and the particle speed and the particle position are updated based on the fitness value; the above steps are repeated until the maximum number of iterations is reached or the convergence condition is met, the optimization is completed, and the optimal solution is output, that is, the optimal security service chain deployment plan.

[0026] In this embodiment, the fitness function is solved based on the particle swarm algorithm. The smaller the fitness function value, the higher the fitness of the particle. The particle swarm algorithm evaluates the position of each particle according to the fitness function and guides the particle to move to the area with a smaller fitness value, thereby finding the minimum value of the function and outputting the optimal solution to obtain the best security service chain deployment plan.

[0027] S103, screening out abnormal outlier nodes in the initial security service chain, replacing the abnormal outlier nodes to obtain a final security service chain, and performing traffic cleaning on the to-be-processed traffic data set according to the final security service chain.

[0028] In some embodiments of the present application, the method of screening out abnormal outlier nodes in the initial security service chain and replacing the abnormal outlier nodes includes: calculating the traffic characteristic parameters of each service node in the initial security service chain, determining the outlier parameters of the service node based on the traffic characteristic parameters based on the LOF algorithm, and screening out the abnormal outlier nodes according to the outlier parameters of the service node; obtaining the backup service node closest to the abnormal outlier node, and replacing the backup service node with the abnormal outlier node; obtaining the outlier parameters of the backup service node after the node replacement in the security service chain, determining the node deviation according to the outlier parameters of the backup service node in the security service chain, and replacing the abnormal outlier node according to the node deviation.

[0029] In this embodiment, the traffic characteristic parameters specifically include the memory occupancy rate and request processing time of the service node. A data graph is established through the memory occupancy rate and request processing time of each service node in the initial security service chain. The outlier parameter of each service node is determined in the data graph based on the LOF algorithm, so as to screen out abnormal outlier nodes with outlier parameters greater than 1. When an abnormal outlier node is detected, the backup service nodes around the node are searched in time and the nearest backup service node is temporarily replaced with the abnormal outlier node. The node deviation of the replacement backup service node is detected, and whether the abnormal outlier node can be replaced is determined by the node deviation.

[0030] In some embodiments of the present application, determining the node deviation according to the outlier parameter of the standby service node in the security service chain includes: calculating the node deviation according to a node deviation calculation formula, wherein the node deviation calculation formula is specifically: , in, is the node deviation, The bandwidth requirement of the security service chain after the standby service node is replaced. is the outlier parameter of the standby service node, is the outlier parameter of the abnormal outlier node, is the natural exponential function.

[0031] In this embodiment, the node deviation is judged by detecting the bandwidth requirement of the security service chain after the temporary replacement of the backup service node and the difference between the outlier parameters of the abnormal outlier node and the backup service node. The smaller the value, the better the adaptability of the backup service node in the security service chain, and the backup service node can be replaced in the security service chain.

[0032] In some embodiments of the present application, the replacement of abnormal outlier nodes according to the node deviation includes: if the node deviation is less than a first preset threshold, the backup service node is replaced with the abnormal outlier node; if the node deviation is greater than or equal to the first preset threshold, the abnormal outlier node is not replaced.

[0033] In this embodiment, when the node deviation is greater than the first preset threshold, the abnormal outlier node is permanently replaced; when it is less than or equal to the first preset threshold, the abnormal outlier node is not replaced. The first preset threshold of this embodiment can be manually set by a technician, and can be appropriately increased when bandwidth resources are sufficient, and appropriately reduced when resources are scarce, so as to make full use of bandwidth resources.

[0034] In some embodiments of the present application, the traffic cleaning of the traffic data set to be processed according to the final security service chain includes: pulling the traffic data to be cleaned to the corresponding security service chain, cleaning and filtering the traffic to be cleaned according to the security service chain to obtain a cleaned traffic data set; and reinjecting the cleaned traffic data set to replace the traffic data set to be processed.

[0035] In this embodiment, the intelligently orchestrated security service chain performs traffic cleaning on the traffic data set to be processed, which can significantly reduce latency, balance load, ensure adaptability to complex network environments, and thus improve the security protection efficiency of traffic attacks.

[0036] Based on the same technical concept, such as Figure 2 As shown, the present invention also provides a data traffic cleaning and protection system based on a security service chain, comprising: The protection module is used to obtain the bandwidth utilization change curve of the traffic data in a preset time period, and filter out the traffic data set to be processed based on the bandwidth utilization change curve of the traffic data in the preset time period; the deployment module is used to obtain the security function set of the traffic data set to be processed, and deploy the initial security service chain based on the security function set; the cleaning module is used to filter out abnormal outlier nodes in the initial security service chain, replace the abnormal outlier nodes to obtain the final security service chain, and perform traffic cleaning on the traffic data set to be processed based on the final security service chain.

[0037] By applying the above technical solution, the present invention obtains a bandwidth utilization change curve of traffic data within a preset time period, and screens out a set of traffic data to be processed based on the bandwidth utilization change curve of traffic data within the preset time period; obtains a security function set of the set of traffic data to be processed, and deploys an initial security service chain based on the security function set; screens out abnormal outlier nodes in the initial security service chain, replaces the abnormal outlier nodes, obtains a final security service chain, and performs traffic cleaning on the set of traffic data to be processed based on the final security service chain. The present invention can accurately detect abnormal traffic data in traffic data, and cleans abnormal traffic data through a security service chain that reduces latency, balances load, and avoids outlier nodes, thereby improving the security protection efficiency of traffic attacks.

[0038] Through the above description of the embodiments, those skilled in the art will clearly understand that the present invention can be implemented via hardware or via software combined with a necessary general-purpose hardware platform. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product. This software product can be stored on a non-volatile storage medium (such as a CD-ROM, USB flash drive, or external hard drive) and includes instructions for enabling a computer device (such as a personal computer, server, or network device) to execute the methods described in various implementation scenarios of the present invention.

[0039] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A data traffic cleaning and protection method based on a security service chain, characterized in that: The method comprises: Obtaining a bandwidth utilization change curve of traffic data within a preset period, and filtering out a set of traffic data to be processed according to the bandwidth utilization change curve of traffic data within the preset period; Obtain a security function set for the traffic data set to be processed, and deploy an initial security service chain based on the security function set; The abnormal outlier nodes of the initial security service chain are screened out and replaced to obtain the final security service chain. The traffic data set to be processed is cleaned according to the final security service chain.

2. The data traffic cleaning and protection method based on the security service chain according to claim 1 is characterized in that: The method of filtering out a set of traffic data to be processed according to a traffic data bandwidth utilization change curve within a preset time period includes: Obtaining a standard bandwidth utilization change curve, setting a preset data interval, and segmenting the standard bandwidth utilization change curve according to the preset data interval; Calculate the upper quartile and lower quartile of each preset data interval in the standard bandwidth utilization change curve, and calculate the interquartile range based on the upper quartile and lower quartile; The upper and lower quartiles are used as boundary intervals, and the minimum distance between each bandwidth utilization data in the current time period and the boundary interval is calculated. The box plot multiples are calculated based on the bandwidth utilization change curve of the traffic data in the preset time period, and it is determined whether there is data with a minimum distance value greater than the box plot multiple of the interquartile range. If so, the traffic data set of the corresponding time period is set as the traffic data set to be processed.

3. The data traffic cleaning and protection method based on the security service chain according to claim 2 is characterized in that: Calculating the box plot multiple based on the bandwidth utilization change curve of the traffic data within the preset time period includes: Obtaining a preset rolling time window, dividing the bandwidth utilization change curve according to the preset rolling time window, and obtaining a plurality of sub-bandwidth utilization change curves; Obtain multiple historical abnormal bandwidth utilization change curves, and calculate the correlation coefficient between the sub-bandwidth utilization change curve and each historical abnormal bandwidth utilization change curve; The abnormal approximation is determined according to the correlation coefficient between the sub-bandwidth utilization change curve and each historical abnormal bandwidth utilization change curve. The abnormal approximation is multiplied by the initial box plot multiple to obtain the final box plot multiple.

4. The data traffic cleaning and protection method based on the security service chain according to claim 1 is characterized in that: The security function set for obtaining the traffic data set to be processed includes: Obtain a historical flow data set to be cleaned and a corresponding security function set, and pre-process the historical flow data set to be cleaned and the corresponding security function set; A training sample set is established based on the pre-processed historical traffic data set to be cleaned and the corresponding security function set, a security function evaluation model is established based on the training sample set, and the security function evaluation model is trained to obtain a trained security function evaluation model; The current traffic data to be cleaned is obtained, and the current traffic data to be cleaned is input into the trained safety function evaluation model to obtain a safety function set.

5. The data traffic cleaning and protection method based on the security service chain according to claim 1 is characterized in that: The initial security service chain is deployed according to the security function set, including: Initialize the particle swarm parameters. Each particle represents a deployment plan for a security service chain. The initial particle swarm parameters include population size, maximum number of iterations, inertia weight, and learning factor. Set the fitness function, calculate the fitness function value of each particle, and determine the individual optimal value and the global optimal value; The fitness function is, ; in, is the transmission delay between all nodes, The bandwidth requirements of the security service chain, , are the first weight and the second weight respectively; Update the global optimal position and historical optimal position of the particle based on the fitness function value of each particle; Eliminate the particle with the lowest fitness and update the particle speed and position based on the fitness value; Repeat the above steps until the maximum number of iterations is reached or the convergence condition is met, the optimization ends, and the optimal solution, that is, the optimal security service chain deployment plan, is output.

6. The data traffic cleaning and protection method based on the security service chain according to claim 1 is characterized in that: The step of screening out abnormal outlier nodes in the initial security service chain and replacing the abnormal outlier nodes includes: Calculate the traffic characteristic parameters of each service node in the initial security service chain, determine the outlier parameters of the service node based on the traffic characteristic parameters based on the LOF algorithm, and filter out abnormal outlier nodes based on the outlier parameters of the service node; Obtain the backup service node closest to the abnormal outlier node and replace the backup service node with the abnormal outlier node; Obtain outlier parameters of the standby service node in the security service chain after the node replacement, determine the node deviation according to the outlier parameters of the standby service node in the security service chain, and replace the abnormal outlier node according to the node deviation.

7. The data traffic cleaning and protection method based on the security service chain according to claim 6 is characterized in that: The determining of the node deviation according to the outlier parameter of the standby service node in the security service chain includes: The node deviation is calculated according to the node deviation calculation formula. The node deviation calculation formula is specifically as follows: ， in, is the node deviation, The bandwidth requirement of the security service chain after the standby service node is replaced. is the outlier parameter of the backup service node, is the outlier parameter of the abnormal outlier node, is the natural exponential function.

8. The data traffic cleaning and protection method based on the security service chain according to claim 7 is characterized in that: The replacing of abnormal outlier nodes according to the node deviation degree includes: If the node deviation is less than a first preset threshold, the standby service node is replaced with the abnormal outlier node; If the node deviation is greater than or equal to the first preset threshold, the abnormal outlier node is not replaced.

9. The data traffic cleaning and protection method based on the security service chain according to claim 1 is characterized in that: The traffic cleaning of the to-be-processed traffic data set according to the final security service chain includes: Pull the traffic data to be cleaned to the corresponding security service chain, clean and filter the traffic to be cleaned according to the security service chain, and obtain the cleaned traffic data set; The cleaned traffic data set is reinjected to replace the traffic data set to be processed.

10. A data traffic cleaning and protection system based on a security service chain, characterized in that: include: A protection module is used to obtain a bandwidth utilization change curve of traffic data within a preset period, and filter out a set of traffic data to be processed according to the bandwidth utilization change curve of traffic data within the preset period; A deployment module is used to obtain a security function set of a set of traffic data to be processed and deploy an initial security service chain according to the security function set; The cleaning module is used to filter out abnormal outlier nodes in the initial security service chain, replace the abnormal outlier nodes to obtain the final security service chain, and perform traffic cleaning on the to-be-processed traffic data set according to the final security service chain.

Images