Network traffic abnormity monitoring method, system and device and storage medium

Abstract

The invention discloses a network traffic abnormity monitoring method, system and device and a storage medium. In the scheme, target monitoring data including network traffic data and traffic associated multi-source data are collected in real time. And based on the target monitoring data, determining a normal traffic interval by using a preset adaptive traffic interval model. And if the network traffic data exceeds the normal traffic interval, generating a traffic feature image based on the target monitoring data. And determining an image analysis result by using a pre-trained image analysis model based on the traffic feature image. And under the condition that the image analysis result indicates that the traffic data is abnormal, based on the target monitoring data, performing anomaly detection by using a pre-trained classification model and an image anomaly detection model, and determining a target anomaly result. According to the technical scheme, the normal traffic interval is dynamically generated by fusing the multi-source data, and the accuracy and reliability of network traffic anomaly monitoring are improved by combining the traffic feature image and multi-model detection.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of finance, in particular to a network traffic anomaly monitoring method, system, device and storage medium. BACKGROUND

[0002] The network of a financial institution carries massive transaction data and customer information transmission, covering key business scenarios such as online payment, securities trading, core account system and the like. The network traffic presents high complexity and strong real-time characteristics, and any abnormal fluctuation may cause significant risks such as transaction interruption or data leakage.

[0003] Network traffic anomaly monitoring is a core technology to ensure business continuity. Existing solutions generally rely on a static threshold detection mechanism (such as setting a fixed upper limit of bandwidth), but face two major defects: first, the financial business traffic has significant dynamic volatility (such as the difference between weekdays and holidays, the difference between transaction peaks and troughs, etc.), and the fixed threshold leads to high false alarm rate and missing report risk due to its inability to adapt to traffic changes; second, the detection dimension is limited to a single indicator at the network traffic layer, lacking multi-dimensional correlation analysis capability, resulting in insufficient accuracy of abnormal attribution. When an anomaly is detected, it is difficult for operation and maintenance personnel to quickly locate the root cause (such as DDoS attack or sudden business growth), leading to delayed response or improper handling. SUMMARY

[0004] Based on the above problems, the application provides a network traffic anomaly monitoring method, system, device and storage medium, aiming to improve the accuracy and reliability of network traffic anomaly monitoring.

[0005] The embodiments of the application disclose the following technical solutions:

[0006] The first aspect of the application provides a network traffic anomaly monitoring method, which comprises:

[0007] Real-time collection of target monitoring data of a target system; the target monitoring data comprises network traffic data and traffic correlation multi-source data; the traffic correlation multi-source data is multi-source data having a correlation relationship with network traffic;

[0008] Based on the target monitoring data, a preset adaptive traffic interval model is used to determine a normal traffic interval corresponding to the target monitoring data; the adaptive traffic interval model uses a machine learning algorithm combined with time series analysis, and is trained by historical target monitoring data of the target system to output a dynamically updated normal traffic interval;

[0009] In the case where the network traffic data exceeds the normal traffic interval, a traffic feature image is generated based on the target monitoring data;

[0010] determine an image analysis result based on the traffic feature image by using a pre-trained image analysis model; the image analysis result comprises a first analysis result or a second analysis result, the first analysis result indicating that the traffic data is abnormal, and the second analysis result indicating that the traffic data is normal;

[0011] In a case where the image analysis result is the first analysis result, perform abnormality detection based on the target monitoring data by using a pre-trained classification model and an image abnormality detection model, and determine a target abnormality result; the target abnormality result indicates a reason for the abnormal traffic data.

[0012] In an optional implementation, the generating of the traffic feature image based on the target monitoring data comprises:

[0013] extracting network traffic features corresponding to the network traffic data based on the target monitoring data;

[0014] generating the traffic feature image based on the network traffic features.

[0015] In an optional implementation, the performing of the abnormality detection based on the target monitoring data by using the pre-trained classification model and the image abnormality detection model to determine the target abnormality result comprises:

[0016] determining a first abnormality result based on the network traffic features by using the classification model; the first abnormality result indicates a reason for the abnormal traffic data;

[0017] determining a second abnormality result based on the traffic feature image by using the image abnormality detection model; the second abnormality result indicates a reason for the abnormal traffic data;

[0018] determining the target abnormality result based on the first abnormality result and the second abnormality result.

[0019] In an optional implementation, the determining of the target abnormality result based on the first abnormality result and the second abnormality result comprises:

[0020] in a case where the first abnormality result and the second abnormality result are consistent, taking the first abnormality result or the second abnormality result as the target abnormality result;

[0021] in a case where the first abnormality result and the second abnormality result are inconsistent, obtaining a first accuracy rate of the classification model in a training and verification stage, a first confidence degree corresponding to the first abnormality result, a second accuracy rate of the image abnormality detection model in the training and verification stage, and a second confidence degree corresponding to the second abnormality result;

[0022] determine a target abnormal result based on the first accuracy, the first confidence, the second accuracy and the second confidence.

[0023] In an optional implementation, the determining the target abnormal result based on the first accuracy, the first confidence, the second accuracy and the second confidence comprises:

[0024] multiplying the first accuracy and the first confidence to obtain a first abnormal score;

[0025] multiplying the second accuracy and the second confidence to obtain a second abnormal score;

[0026] taking the abnormal result corresponding to the abnormal score with the larger value as the target abnormal result.

[0027] In an optional implementation, in a case where the image analysis result is the second analysis result, an artificial review signal is generated and displayed.

[0028] In an optional implementation, after the target abnormal result is determined, the method further comprises:

[0029] generating an alarm information based on the target abnormal result; and simultaneously, starting a corresponding emergency response plan according to the target abnormal result.

[0030] The second aspect of the application provides a network traffic anomaly monitoring system, which comprises:

[0031] a data collection module configured to collect target monitoring data of a target system in real time; the target monitoring data comprises network traffic data and traffic-associated multi-source data; the traffic-associated multi-source data is multi-source data having an association with network traffic;

[0032] an interval determination module configured to determine a normal traffic interval corresponding to the target monitoring data based on the target monitoring data and by using a preset adaptive traffic interval model; the adaptive traffic interval model is trained by using a machine learning algorithm in combination with time series analysis and by using historical target monitoring data of the target system, and outputs a dynamically updated normal traffic interval;

[0033] an image generation module configured to generate a traffic feature image based on the target monitoring data in a case where the network traffic data exceeds the normal traffic interval;

[0034] a first determination module configured to determine an image analysis result based on the traffic feature image and by using a pre-trained image analysis model; the image analysis result comprises a first analysis result or a second analysis result, the first analysis result indicating traffic data anomaly, and the second analysis result indicating traffic data normality.

[0035] The second determining module is configured to, when the image analysis result is the first analysis result, perform abnormality detection based on the target monitoring data, using a pre-trained classification model and an image abnormality detection model, to determine a target abnormality result, wherein the target abnormality result indicates a reason for the abnormality of the traffic data.

[0036] The third aspect of the present application provides a network traffic abnormality monitoring device, which comprises a processor and a memory.

[0037] The memory is configured to store program code and transmit the program code to the processor.

[0038] The processor is configured to execute the steps of the network traffic abnormality monitoring method according to the instructions in the program code.

[0039] The fourth aspect of the present application provides a computer readable storage medium for storing program code, wherein the program code is configured to execute the steps of the network traffic abnormality monitoring method according to any one of the implementations of the first aspect.

[0040] Compared with the prior art, the present application has the following beneficial effects:

[0041] In the technical solution of the present application, the target monitoring data of the target system is collected in real time, including network traffic data and traffic-related multi-source data. Then, based on the target monitoring data, a preset adaptive traffic interval model is used to determine the normal traffic interval corresponding to the target monitoring data, wherein the adaptive traffic interval model uses a machine learning algorithm combined with time series analysis, and is trained by historical target monitoring data of the target system to output a dynamically updated normal traffic interval. In the case where the network traffic data exceeds the normal traffic interval, a traffic feature image is generated based on the target monitoring data. Then, based on the traffic feature image, a pre-trained image analysis model is used to determine an image analysis result. Finally, in the case where the image analysis result indicates an abnormality of the traffic data, an abnormality detection is performed based on the target monitoring data, using a pre-trained classification model and an image abnormality detection model, to determine a target abnormality result.

[0042] As can be seen, in the technical solution of the present application, by fusing network traffic data and traffic-related multi-source data, using an adaptive traffic interval model to dynamically generate a normal traffic interval, the traffic fluctuations in different time periods and business scenarios can be accurately adapted, and the false positive probability and the missing report risk can be reduced. Further, by combining traffic feature image analysis and using a multi-modal abnormality detection mechanism of the classification model and the image abnormality detection model, abnormal features can be comprehensively captured and abnormal reasons can be accurately located, thereby improving the accuracy and reliability of network traffic abnormality monitoring. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0044] Figure 1 A flow chart of a network traffic anomaly monitoring method provided by an embodiment of the present application;

[0045] Figure 2 A structural schematic diagram of a network traffic anomaly monitoring system provided by an embodiment of the present application. DETAILED DESCRIPTION

[0046] As described above, the current network traffic monitoring method based on fixed threshold has the problems of high false alarm and missed alarm rates and low anomaly attribution accuracy.

[0047] The inventor has proposed a network traffic anomaly monitoring method after research.

[0048] Real-time target monitoring data of a target system are collected, including network traffic data and traffic correlation multi-source data. Then, based on the target monitoring data, a preset adaptive traffic interval model is used to determine the normal traffic interval corresponding to the target monitoring data, wherein the adaptive traffic interval model is trained by historical target monitoring data of the target system using a machine learning algorithm combined with time series analysis, and outputs a dynamically updated normal traffic interval. In the case that the network traffic data exceeds the normal traffic interval, a traffic feature image is generated based on the target monitoring data. Then, based on the traffic feature image, a pre-trained image analysis model is used to determine an image analysis result. Finally, in the case that the image analysis result indicates that the traffic data is abnormal, based on the target monitoring data, a pre-trained classification model and an image anomaly detection model are used for anomaly detection to determine a target anomaly result.

[0049] As can be seen in the technical solutions of the present application, by fusing network traffic data and traffic correlation multi-source data, and dynamically generating a normal traffic interval using an adaptive traffic interval model, the traffic fluctuations in different time periods and business scenarios can be accurately adapted, and the false alarm probability and missed alarm risk can be reduced. Further, combined with traffic feature image analysis, and using the multi-modal anomaly detection mechanism of the classification model and the image anomaly detection model, the abnormal features can be comprehensively captured and the abnormal reasons can be accurately located, thereby improving the accuracy and reliability of network traffic anomaly monitoring.

[0050] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application, so that those skilled in the art can better understand the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of the present application.

[0051] Referring to Figure 1 , the figure is a network traffic anomaly monitoring method flowchart provided by an embodiment of the present application. As Figure 1 shown, the method comprises the following steps:

[0052] S101, real-time collection of target monitoring data of a target system.

[0053] In an embodiment of the present application, the target system refers to various network environments that need to be monitored, such as financial business system network, etc.

[0054] The target monitoring data refers to a comprehensive data set for analyzing network traffic status, including network traffic data directly reflecting network status, and traffic correlation multi-source data associated with network traffic.

[0055] In an embodiment of the present application, the network traffic data includes traffic data of all network devices in the target system, such as router, switch, etc., including packet size, traffic transmission rate, source / desination Internet Protocol (IP) address, etc.

[0056] The traffic correlation multi-source data at least includes server performance data and application layer business data. Taking the financial business system as an example, the server performance data includes Central Processing Unit (CPU) usage, memory occupancy, etc. The application layer business data includes transaction number, transaction amount, etc.

[0057] In an example implementation, the network traffic data can be obtained in real time through a traffic collection tool (such as a collector based on NetFlow protocol, a packet capture tool) deployed on a network node. For the traffic correlation multi-source data, the server performance data can be collected through a built-in monitoring agent (such as Prometheus, Zabbix) of the server. At the same time, by connecting a business system database or an Application Programming Interface (API), the application layer data such as transaction number and transaction amount can be obtained.

[0058] In the embodiments of the present application, the collection frequency can be set according to the real-time requirement of the system, for example, the financial transaction system can adopt millisecond-level collection, and the general office network can adopt second-level collection, to ensure the timeliness of the data.

[0059] Optionally, the collected target monitoring data is preliminarily cleaned, such as removing duplicate data packets and correcting format errors.

[0060] In the embodiments of the present application, the network traffic and associated data are comprehensively collected, the traffic scene is described from the network layer, the system layer and the business layer in multiple dimensions, the misjudgment caused by one-sided data is avoided, and the data foundation is laid for subsequent accurate identification of abnormalities.

[0061] S102, based on the target monitoring data, a preset adaptive traffic interval model is used to determine a normal traffic interval corresponding to the target monitoring data.

[0062] In the embodiments of the present application, the adaptive traffic interval model uses a machine learning algorithm combined with time series analysis, and is trained through historical target monitoring data of the target system to output a dynamically updated normal traffic interval.

[0063] The adaptive traffic interval model is an intelligent model that can dynamically adjust the judgment standard according to historical data and real-time data, and it can update the judgment interval of the normal traffic without human intervention.

[0064] The machine learning algorithm refers to a technology that enables the model to autonomously discover rules through learning historical data, such as deep autoencoder (Deep Autoencoder, DAE) and random forest.

[0065] Time series analysis is a method for analyzing the trend of data over time, which can capture the periodicity (such as daily peak, weekly regularity) and trend (such as long-term increase in traffic due to business growth) of traffic.

[0066] The normal traffic interval refers to the reasonable fluctuation range of network traffic under a specific time and business scenario.

[0067] In an example implementation, the adaptive traffic interval model is constructed in the following manner:

[0068] First, the historical target monitoring data (including network traffic and associated multi-source data) of the target system in the past six months is collected, and noise (such as abnormal values caused by instantaneous network jitter) and missing values are removed through data cleaning to obtain a standardized data set.

[0069] DAE is used as the core algorithm, combined with the time series analysis module, to enable the model to learn the traffic characteristics in different time periods (such as 9:00-11:00 during work, 18:00-20:00 during holidays) and business scenarios (such as e-commerce promotion, daily office work). For example, the model learns that "during the morning peak of weekdays, the average network traffic is 80 Mbps, with a fluctuation range of 60-100 Mbps", "the average traffic on weekends is 30 Mbps, with a fluctuation range of 20-40 Mbps", and other rules, and converts these rules into dynamic normal traffic intervals.

[0070] After the model training is completed, the target monitoring data collected in step S101 is received in real time, the time series analysis module is used to identify the time period and business scenario to which the current target monitoring data belongs, and the normal traffic interval corresponding to the scenario is determined.

[0071] Optionally, to improve the adaptability of the adaptive traffic interval model, an iterative mechanism of pre-training combined with fine-tuning can be used. In the pre-training phase, the model is trained using large-scale historical data to master general traffic rules. In the fine-tuning phase, the model parameters are updated daily using new data from the previous day to adapt to short-term traffic changes. When major business changes occur (such as system upgrades, new business launches), the model can be retrained to include data features of new scenarios.

[0072] The time series analysis module can be refined into multiple levels of period detection, such as hourly, daily, and weekly periods, corresponding to intra-day peak, weekday / weekend differences, and monthly business rules.

[0073] The output of the normal traffic interval can be in the form of "mean ± dynamic standard deviation", and the standard deviation is automatically adjusted according to the volatility of historical traffic, for example, the standard deviation is larger during a volatile promotion period, and the interval is wider.

[0074] In the embodiments of the present application, the normal traffic interval is dynamically generated by the adaptive model, solving the problem that traditional fixed thresholds cannot adapt to traffic fluctuations. For example, when the traffic of a business system temporarily increases to 120 Mbps due to a promotion activity, the model will automatically adjust the upper limit of the normal interval to 150 Mbps based on the traffic rules during the historical promotion period, avoiding false positives. At the same time, the model adjusts the interval based on multiple source data (such as transaction volume growth), ensuring that the judgment criteria match the actual business, and providing accurate judgment criteria for subsequent anomaly detection.

[0075] S103, generating a traffic feature image based on the target monitoring data when the network traffic data exceeds the normal traffic interval.

[0076] In the embodiments of the present application, when the network traffic data exceeds the normal interval, the abstract network traffic data and associated multi-source data are converted into a visual image, i.e. a traffic feature image.

[0077] The traffic feature map can reflect the dynamic changes and correlation of the traffic through visual features such as texture, color, shape, and the like of the image.

[0078] In the embodiments of the present application, through the image processing, the originally dispersed multi-source data features are integrated into visual information with spatial correlation, which facilitates the subsequent image analysis model to capture complex abnormal patterns.

[0079] In S104, an image analysis result is determined based on the traffic feature image by using a pre-trained image analysis model.

[0080] In the embodiments of the present application, the image analysis result includes a first analysis result or a second analysis result, the first analysis result indicating that the traffic data is abnormal, and the second analysis result indicating that the traffic data is normal.

[0081] In the embodiments of the present application, the image analysis model is a trained deep learning model, such as a convolutional neural network (CNN), which is used to identify and analyze feature patterns in the image and output the analysis result.

[0082] In an example implementation, the training of the image analysis model can prepare a large-scale labeled data set in advance, including normal traffic feature images (labeled as “second analysis result”) and abnormal traffic feature images (labeled as “first analysis result”), and the abnormal types cover distributed denial of service (DDoS) attacks, data leakage, server failure, and the like. ResNet or YOLO network architecture is adopted to initialize the model parameters through transfer learning, and then the traffic feature image data set is fine-tuned. During the training process, the hyperparameters (such as learning rate and iteration number) can be optimized through cross-validation to ensure that the accuracy of the model on the validation set reaches the expectation.

[0083] In the embodiments of the present application, the traffic feature image generated in S103 is input into the trained image analysis model, and the model outputs the image analysis result.

[0084] In the embodiments of the present application, through the intelligent analysis of the traffic feature image by the pre-trained model, the automatic preliminary screening of the abnormality is realized.

[0085] Optionally, in the case where the image analysis result is the second analysis result, an artificial review signal is generated and displayed.

[0086] In the embodiments of the present application, if the next analysis result of the graph indicates that the traffic data is normal, an automatic verification mechanism is triggered to generate a verification signal containing key information. These information includes the specific value of the current network traffic data, the corresponding normal traffic interval, the key region screenshot of the traffic feature image, and the server performance data and application layer service data of the period.

[0087] In an example implementation, the verification signal can be displayed through the visual interface of the operation and maintenance end.

[0088] S105, in the case of the image analysis result being the first analysis result, based on the target monitoring data, using a pre-trained classification model and an image anomaly detection model for anomaly detection to determine a target anomaly result.

[0089] In the embodiments of the present application, the classification model is a machine learning model for judging the type of anomaly, such as support vector machine (SVM) or decision tree, the input is the numerical traffic and associated features, and the output is the specific type of anomaly (such as DDoS attack, malware propagation or data leakage, etc.).

[0090] The image anomaly detection model is an enhanced image analysis model based on S104, which not only judges whether it is abnormal, but also identifies the type corresponding to the abnormal image pattern.

[0091] The target anomaly result refers to the final determined traffic anomaly reason after integrating the outputs of the two types of models.

[0092] In the embodiments of the present application, by fusing network traffic data and traffic associated multi-source data, using an adaptive traffic interval model to dynamically generate a normal traffic interval, it can accurately adapt to traffic fluctuations in different periods and business scenarios, reducing the probability of false positives and the risk of missed reports. Further combined with traffic feature image analysis, and using the multi-modal anomaly detection mechanism of the classification model and the image anomaly detection model, the abnormal features can be captured comprehensively and the abnormal reasons can be accurately located, which improves the accuracy and reliability of network traffic anomaly monitoring.

[0093] Optionally, the above step S103 comprises:

[0094] Step 1, based on the target monitoring data, extracting the network traffic features corresponding to the network traffic data.

[0095] In the embodiments of the present application, first, key network traffic features are extracted from the target monitoring data. In an example implementation, the network traffic features include: a time series of traffic rate, such as the traffic value per second in the past 5 minutes, a distribution of packet size, such as the proportion of small packets and the frequency of large packets, the concentration of source IP addresses, such as whether a single IP sends a large number of requests, the correlation curve of server CPU usage and traffic, the ratio of business transaction number to traffic, and the like.

[0096] Step 2, generating a traffic feature image based on the network traffic features.

[0097] In the embodiments of the present application, after the network traffic features are extracted in step 1, these features are converted into a multi-channel image: for example, a heat map can be used to represent the time-traffic rate relationship, with darker colors indicating larger traffic, a scatter plot gray value can be used to represent the packet size distribution, with higher gray values indicating more frequent packets of that size, and the shape change of a curve can be used to represent the linkage relationship between CPU usage and traffic.

[0098] Finally, the multi-channel image is fused into a traffic feature image, retaining the correlation of each dimension feature.

[0099] Optionally, the above step S105 includes:

[0100] Step 1, determining a first abnormal result based on the network traffic features using a classification model.

[0101] The first abnormal result is an abnormal reason judgment result output by the classification model based on the numerical features of the network traffic.

[0102] In an example implementation, based on the network traffic features extracted from the target monitoring data, such as source IP concentration and abnormal traffic duration, a pre-trained SVM model is input, and the SVM model outputs a first abnormal result, such as “DDoS attack”.

[0103] Step 2, determining a second abnormal result based on the traffic feature image using an image anomaly detection model.

[0104] The second abnormal result is an abnormal reason judgment result output by the image anomaly detection model based on the traffic feature image.

[0105] In an example implementation, a pre-trained CNN model is used to analyze the traffic feature image, the CNN model extracts local features (such as color block distribution and texture direction in a certain area) and global features (such as overall color distribution trend) of the image through convolution layers, compares them with abnormal image patterns (such as dense color blocks and disordered textures corresponding to DDoS attacks) in the training set, and outputs a second abnormal result, such as “DDoS attack”.

[0106] Step three, determining the target abnormal result based on the first abnormal result and the second abnormal result.

[0107] In the embodiments of the present application, the first abnormal result and the second abnormal result determined in steps one and two are comprehensively analyzed to determine the target abnormal result.

[0108] Optionally, step three includes:

[0109] In the case where the first abnormal result and the second abnormal result are consistent, the first abnormal result or the second abnormal result is taken as the target abnormal result.

[0110] In the case where the first abnormal result and the second abnormal result are inconsistent, the first accuracy of the classification model in the training verification stage and the first confidence corresponding to the first abnormal result, the second accuracy of the image anomaly detection model in the training verification stage and the second confidence corresponding to the second abnormal result are obtained.

[0111] The target abnormal result is determined based on the first accuracy, the first confidence, the second accuracy and the second confidence.

[0112] In the embodiments of the present application, the accuracy is the proportion of correct classification of the model in the historical verification, reflecting the reliability of the model. The confidence is the trust degree of the model to the current prediction result.

[0113] If the first abnormal result and the second abnormal result are consistent, for example, the first abnormal result and the second abnormal result are both “DDoS attack”, the target abnormal result is “DDoS attack”.

[0114] If the first abnormal result and the second abnormal result are inconsistent, for example, the first abnormal result is “DDoS attack” and the second abnormal result is “business growth”, the first accuracy of the classification model in the training verification stage and the first confidence corresponding to the first abnormal result, the second accuracy of the image anomaly detection model in the training verification stage and the second confidence corresponding to the second abnormal result are obtained. The target abnormal result is determined based on the first accuracy, the first confidence, the second accuracy and the second confidence.

[0115] Optionally, the specific steps of determining the target abnormal result based on the first accuracy, the first confidence, the second accuracy and the second confidence include:

[0116] The first accuracy is multiplied by the first confidence to obtain a first abnormal score.

[0117] The second accuracy is multiplied by the second confidence to obtain a second abnormal score.

[0118] The abnormal result corresponding to the larger one of the first abnormal score and the second abnormal score is taken as the target abnormal result.

[0119] In an example implementation, the first abnormal result is "DDoS attack", the first accuracy rate is 80%, and the first confidence is 90%. The second abnormal result is "business growth", the second accuracy rate is 90%, and the second confidence is 70%.

[0120] The first abnormal score is (80%)*(90%) = 0.72.

[0121] The second abnormal score is (90%)*(70%) = 0.62.

[0122] The first abnormal score is greater than the second abnormal score, and the target abnormal result is the first abnormal result corresponding to the first abnormal score, that is, the target abnormal result is "DDoS attack".

[0123] In the embodiments of the present application, the limitations of a single model are eliminated through multi-result fusion, the conclusion credibility is enhanced when two determinations are consistent, rational decisions are made based on model performance and result confidence when they are inconsistent, and the most reliable abnormal reason is finally output, providing clear basis for subsequent alarm and response.

[0124] Optionally, after determining the target abnormal result, the method further comprises:

[0125] Based on the target abnormal result, alarm information is generated; at the same time, according to the target abnormal result, a corresponding emergency response plan is started.

[0126] In the embodiments of the present application, based on the target abnormal result, such as "DDoS attack", a matching alarm content is called from a preset template library, including abnormal type, occurrence time, involved network node (such as "router IP: 192.168.1.1"), affected business scope (such as "online payment system"), and risk level (such as "high risk").

[0127] Optionally, the alarm information can be pushed through multiple channels, for example, sending a short message and a system pop-up window to the operation and maintenance team, sending an encrypted email to the security person in charge, and ensuring that key personnel know immediately.

[0128] In the embodiments of the present application, a preconfigured response strategy is matched according to the target abnormal result.

[0129] In an example implementation, if the target abnormal result is DDoS attack, the firewall is linked to start the traffic cleaning rule to limit the access frequency of the attack source IP, and the standby bandwidth resource is dispatched; if the target abnormal result is data leakage, the access permission of the involved data interface is automatically frozen, the data backup and isolation process is triggered, and the operation log is recorded for audit.

[0130] In the embodiments of the present application, standardized alarms are used to ensure efficient information transmission, and automatic preplans are used to reduce manual response delays, thereby minimizing the impact of abnormalities on the network system.

[0131] The network traffic anomaly monitoring method provided by the embodiments of the present application describes the traffic scene from multiple dimensions of network layer, system layer and service layer by collecting network traffic data and traffic correlation multi-source data in real time, thereby avoiding misjudgment caused by one-sided data; an adaptive traffic interval model is used in combination with machine learning and time series analysis to dynamically generate a normal traffic interval, adapt to traffic fluctuations in different time periods and service scenarios, and solve the false alarm and missed alarm problems caused by traditional fixed thresholds; a traffic feature image is generated and combined with an image analysis model, multi-modal anomaly detection is performed by using a classification model and an image anomaly detection model, a target anomaly result is comprehensively output, the accuracy of anomaly identification is improved, an alarm is automatically generated based on the target anomaly result, and an emergency response preplan is started, thereby realizing a closed loop from anomaly identification to active disposal, minimizing the impact of abnormalities, and comprehensively improving the accuracy, adaptability and efficiency of monitoring, thereby providing a strong guarantee for stable operation of the network system.

[0132] Based on the network traffic anomaly monitoring method provided by the foregoing embodiments, the present application also provides a network traffic anomaly monitoring system. Figure 2 A structural schematic diagram of a network traffic anomaly monitoring system provided by the embodiments of the present application is shown in FIG. 1. Figure 2 As shown in FIG. 1, the network traffic anomaly monitoring system includes a data collection module 201, an interval determination module 202, an image generation module 203, a first determination module 204 and a second determination module 205.

[0133] The data collection module 201 is configured to collect target monitoring data of a target system in real time. The target monitoring data includes network traffic data and traffic correlation multi-source data. The traffic correlation multi-source data is multi-source data that has a correlation relationship with the network traffic.

[0134] The interval determination module 202 is configured to determine a normal traffic interval corresponding to the target monitoring data based on the target monitoring data by using a preset adaptive traffic interval model. The adaptive traffic interval model uses a machine learning algorithm in combination with time series analysis, trains the historical target monitoring data of the target system, and outputs a dynamically updated normal traffic interval.

[0135] The image generation module 203 is configured to generate a traffic feature image based on the target monitoring data when the network traffic data exceeds the normal traffic interval.

[0136] The first determination module 204 is configured to determine an image analysis result by using a pre-trained image analysis model based on the traffic feature image. The image analysis result includes a first analysis result or a second analysis result. The first analysis result indicates that the traffic data is abnormal, and the second analysis result indicates that the traffic data is normal.

[0137] The second determination module 205 is configured to perform abnormality detection by using a pre-trained classification model and an image abnormality detection model based on the target monitoring data, to determine a target abnormality result, in a case where the image analysis result is the first analysis result. The target abnormality result indicates a reason for the abnormal traffic data.

[0138] The embodiments of the present application improve the accuracy and reliability of network traffic abnormality monitoring by the mutual combination of the data collection module 201, the interval determination module 202, the image generation module 203, the first determination module 204, and the second determination module 205.

[0139] In an optional implementation, the image generation module 203 is specifically configured to:

[0140] extract a network traffic feature corresponding to the network traffic data based on the target monitoring data;

[0141] generate a traffic feature image based on the network traffic feature.

[0142] In an optional implementation, the second determination module 205 includes a first result determination unit, a second result determination unit, and a target result determination unit.

[0143] The first result determination unit is configured to determine a first abnormality result by using a classification model based on a network traffic feature. The first abnormality result indicates a reason for abnormal traffic data.

[0144] The second result determination unit is configured to determine a second abnormality result by using an image abnormality detection model based on a traffic feature image. The second abnormality result indicates a reason for abnormal traffic data.

[0145] The target result determination unit is configured to determine a target abnormality result based on the first abnormality result and the second abnormality result.

[0146] In an optional implementation, the target result determination unit is specifically configured to:

[0147] in a case where the first abnormality result and the second abnormality result are consistent, taking the first abnormality result or the second abnormality result as the target abnormality result;

[0148] In a case where the first abnormal result and the second abnormal result are inconsistent, a first accuracy of the classification model in a training verification stage and a first confidence corresponding to the first abnormal result, a second accuracy of the image anomaly detection model in the training verification stage and a second confidence corresponding to the second abnormal result are obtained;

[0149] A target abnormal result is determined based on the first accuracy, the first confidence, the second accuracy and the second confidence.

[0150] In an optional implementation manner,

[0151] The first accuracy is multiplied by the first confidence to obtain a first abnormal score;

[0152] The second accuracy is multiplied by the second confidence to obtain a second abnormal score;

[0153] The abnormal result corresponding to the abnormal score with a larger value between the first abnormal score and the second abnormal score is taken as the target abnormal result.

[0154] In an optional implementation manner, the network traffic anomaly monitoring system further comprises a signal generation module configured to generate an artificial checking signal and display the artificial checking signal in a case where the image analysis result is the second analysis result.

[0155] In an optional implementation manner, the network traffic anomaly monitoring system further comprises an alarm module configured to generate alarm information based on the target abnormal result, and simultaneously, start a corresponding emergency response plan according to the target abnormal result.

[0156] In addition, an embodiment of the present application further provides a network traffic anomaly monitoring device, which comprises a processor and a memory.

[0157] The memory is configured to store program code and transmit the program code to the processor.

[0158] The processor is configured to execute steps of the network traffic anomaly monitoring method according to instructions in the program code.

[0159] In addition, an embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and when the program is run by a processor, the network traffic anomaly monitoring method as introduced in any manner of the method embodiment is implemented.

[0160] It should be noted that each of the embodiments described in the specification of the present application adopts a progressive mode for description, and the same or similar parts between the embodiments can be mutually referred to. Each of the embodiments focuses on the differences from other embodiments. In particular, the device and system embodiments are described more simply because they are basically similar to the method embodiments, and the relevant parts can be referred to the part of the method embodiments. The above-described device and system embodiments are only illustrative, and the units described as separate components can or can not be physically separated, and the components indicated as units can or can not be physical units, i.e., they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiments according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0161] The above describes only one specific embodiment of the present application, but the protection scope of the present application is not limited to this. Any skilled person in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A network traffic anomaly monitoring method, characterized by, The method comprises: collecting target monitoring data of a target system in real time; the target monitoring data comprises network traffic data and traffic correlation multi-source data; the traffic correlation multi-source data is multi-source data having a correlation relationship with network traffic; based on the target monitoring data, a preset adaptive traffic interval model is used to determine a normal traffic interval corresponding to the target monitoring data; the adaptive traffic interval model uses a machine learning algorithm combined with time series analysis, and is trained by historical target monitoring data of the target system to output a dynamically updated normal traffic interval; in a case where the network traffic data exceeds the normal traffic interval, a traffic feature image is generated based on the target monitoring data; based on the traffic feature image, a pre-trained image analysis model is used to determine an image analysis result; the image analysis result comprises a first analysis result or a second analysis result, the first analysis result indicating traffic data anomaly, and the second analysis result indicating normal traffic data; in a case where the image analysis result is the first analysis result, based on the target monitoring data, a pre-trained classification model and an image anomaly detection model are used for anomaly detection to determine a target anomaly result; the target anomaly result indicates the reason for traffic data anomaly.

2. The method of claim 1, wherein, The method comprises: extracting network traffic features corresponding to the network traffic data based on the target monitoring data; generating a traffic feature image based on the network traffic features.

3. The method of claim 2, wherein, The method comprises: based on the network traffic features, the classification model is used to determine a first anomaly result; the first anomaly result indicates the reason for traffic data anomaly; based on the traffic feature image, the image anomaly detection model is used to determine a second anomaly result; the second anomaly result indicates the reason for traffic data anomaly; based on the first anomaly result and the second anomaly result, the target anomaly result is determined.

4. The method of claim 3, wherein, The method comprises: in a case where the first anomaly result and the second anomaly result are consistent, the first anomaly result or the second anomaly result is taken as the target anomaly result; in a case where the first anomaly result and the second anomaly result are inconsistent, a first accuracy of the classification model in a training and verification stage, a first confidence corresponding to the first anomaly result, a second accuracy of the image anomaly detection model in the training and verification stage, and a second confidence corresponding to the second anomaly result are obtained; based on the first accuracy, the first confidence, the second accuracy, and the second confidence, a target anomaly result is determined.

5. The method of claim 4, wherein, The method comprises: the first accuracy and the first confidence are multiplied to obtain a first anomaly score; the second accuracy and the second confidence are multiplied to obtain a second anomaly score; The abnormal result corresponding to the larger value between the first abnormal score and the second abnormal score is taken as a target abnormal result.

6. The method of claim 1, wherein, In a case where the image analysis result is the second analysis result, an artificial checking signal is generated and displayed.

7. The method of claim 1, wherein, After the target abnormal result is determined, the method further includes: Based on the target abnormal result, an alarm information is generated; at the same time, according to the target abnormal result, a corresponding emergency response plan is started.

8. A network traffic anomaly monitoring system, characterized by, The system includes: A data acquisition module is configured to acquire target monitoring data of a target system in real time; the target monitoring data includes network traffic data and traffic correlation multi-source data; the traffic correlation multi-source data is multi-source data having a correlation relationship with network traffic; An interval determination module is configured to determine a normal traffic interval corresponding to the target monitoring data based on the target monitoring data and by using a preset adaptive traffic interval model; the adaptive traffic interval model is trained by historical target monitoring data of the target system by using a machine learning algorithm combined with time series analysis, and outputs a dynamically updated normal traffic interval; An image generation module is configured to generate a traffic feature image based on the target monitoring data in a case where the network traffic data exceeds the normal traffic interval; A first determination module is configured to determine an image analysis result based on the traffic feature image and by using a pre-trained image analysis model; the image analysis result includes a first analysis result or a second analysis result; the first analysis result indicates traffic data abnormality, and the second analysis result indicates normal traffic data; A second determination module is configured to, in a case where the image analysis result is the first analysis result, determine a target abnormal result by using a pre-trained classification model and an image abnormality detection model to perform abnormality detection based on the target monitoring data; the target abnormal result indicates a reason for traffic data abnormality.

9. A network traffic anomaly monitoring device, characterized by, It includes: A processor and a memory: The memory is configured to store program code and transmit the program code to the processor; The processor is configured to execute the steps of the network traffic abnormality monitoring method according to the instructions in the program code.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium is configured to store program code, and the program code is configured to execute the steps of the network traffic abnormality monitoring method. The computer readable storage medium is configured to store program code, and the program code is configured to execute the steps of the network traffic abnormality monitoring method.

Images