Network traffic identification method, device, equipment, medium and product

Abstract

The invention discloses a network traffic identification method, device and equipment, a medium and a product. The method comprises the following steps: determining sliding windows of a service area in different time periods; identifying input network traffic of the service area based on the sliding window, and outputting first traffic of the service area in different time periods to a service requester; the first flow is the flow which can be used by the service requester.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, medium, and product for identifying network traffic. Background Technology

[0002] In recent years, advanced persistent threat attacks have gradually become the mainstream cyberattack method. This type of attack is often hidden in various daily behaviors and is difficult to detect.

[0003] In related technologies, the detection methods for network traffic attacks require adding an additional detection module before the Intrusion Detection System (IDS). However, with the increasing diversity of network attack methods, adding additional modules if the IDS cannot handle more attacks will lead to increasingly poor real-time performance of the IDS. Summary of the Invention

[0004] This application provides a network traffic identification method, apparatus, device, medium, and product.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] A network traffic identification method, the method comprising:

[0007] Determine the sliding window for the service area at different time periods;

[0008] Based on the sliding window, the input network traffic of the service area is identified, and the first traffic of the service area at different time periods is output to the service requester; the first traffic is the traffic that the service requester can use.

[0009] A network traffic identification device, the network traffic identification device comprising:

[0010] The determining unit is used to determine the sliding window of the service area at different time periods;

[0011] The identification unit is used to identify the input network traffic of the service area based on the sliding window, and output the first traffic of the service area at different time periods to the service requester; the first traffic is the traffic that the service requester can use.

[0012] An electronic device includes: a processor and a memory for storing a computer program capable of running on the processor.

[0013] When the processor runs the computer program, it performs the steps of any of the methods described above.

[0014] A storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described above.

[0015] A computer product includes a computer program that, when executed by a processor, implements the steps of any of the methods described above.

[0016] The network traffic identification method, apparatus, device, medium, and product provided in the embodiments of this application determine a sliding window of a service area in different time periods; identify the input network traffic of the service area based on the sliding window, and output the first traffic of the service area in different time periods to the service requester; the first traffic is the traffic that the service requester can use. In other words, by determining a sliding window of a service area in different time periods and identifying the input network traffic of the service area based on the sliding window, the embodiments of this application obtain the traffic that can be used in the service area in different time periods and output it to the service requester. That is, without relying on additional modules, the usable traffic is output in real time through the sliding window, solving the technical problem in related technologies that cannot improve the real-time performance of IDS, and realizing rapid identification of usable traffic. Attached Figure Description

[0017] Figure 1 A flowchart illustrating a network traffic identification method provided in an embodiment of this application;

[0018] Figure 2 A flowchart illustrating another network traffic identification method provided in this application embodiment;

[0019] Figure 3 This is a schematic diagram of the structure of a flow detection module provided in an embodiment of this application;

[0020] Figure 4 This is a schematic diagram of the structure of a network traffic identification device provided in an embodiment of this application;

[0021] Figure 5 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0024] The terms "first / second / third" used in this application are merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0025] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0026] Intrusion Detection System (IDS) is a computer monitoring system, categorized into several types based on information sources and detection methods: According to information source, it can be divided into host-based IDS and network-based IDS; according to detection method, it can be divided into anomaly detection and misuse detection. Unlike firewalls, an IDS is a listening device, not connected to any link, and can operate without network traffic flowing through it. Therefore, the only requirement for deploying an IDS is that it should be connected to a link through which all traffic of concern must pass. Traffic of concern refers to access traffic from high-risk network areas and network packets that need to be statistically analyzed and monitored. Therefore, in switched networks, the location of an IDS is generally chosen as close as possible to the attack source or as close as possible to the protected resource. These locations are typically: on switches in server areas; on the first switch after the Internet access router; and on LAN switches in key protected network segments.

[0027] Given the continuous evolution of intrusion attacks, machine learning (ML) is being applied to network intrusion detection. Attackers can often create samples by introducing small perturbations (such as slightly increasing the packet arrival interval), which may mislead well-trained models to output arbitrary labels other than the true labels with a high probability. Attackers launching adversarial example attacks can lead to a significant increase in both false positive and false negative rates, rendering intrusion detection systems (IDS) almost useless. To address this type of attack, a composite and decision boundary-based adversarial example detection system (MANDA) can place a separate module before the IDS. Traffic passes through this module before passing through the IDS, separating traffic that may be adversarial example attacks and blocking it before the IDS can detect it. However, with the increasing diversity of network attack methods, adding additional modules if the IDS cannot handle more attacks will lead to increasingly poor real-time performance of the IDS.

[0028] The present application will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0029] Embodiments of this application provide a network traffic identification method, referring to... Figure 1 As shown, the method includes the following steps:

[0030] Step S101: Determine the sliding window of the service area at different time periods.

[0031] It is understood that network traffic enters the service area, which can be located on a switch; this application does not limit this. The sliding window can include, but is not limited to, the size of the network traffic, the content format of normal requested data, and the services provided by the service area.

[0032] In practical applications, an IDS can be configured with a sliding window module based on machine learning. This module can determine the sliding window for different time periods based on the input network traffic data of the service area. The input network traffic data can include, but is not limited to, the network traffic volume of the service area at different time periods, the content format of normal request data, and the services provided by the service area. This embodiment uses the network traffic volume received by the service area as an example to illustrate the sliding window. The sliding window module can be a sliding window model trained based on the input network traffic data of the service area.

[0033] Step S102: Identify the input network traffic of the service area based on the sliding window, and output the first traffic of the service area at different time periods to the service requester; the first traffic is the traffic that the service requester can use.

[0034] Understandably, the input network traffic can be network traffic input to the service area within any time period. For example, taking the initial first time period as an example, after determining the sliding window, the input network traffic of the service area during the first time period can be entered into the corresponding sliding window to determine the window traffic of the service area during that time period, which is the actual amount of network traffic that can be received. For instance, if the input network traffic during the first time period is 16 packets, and the corresponding sliding window is 10, then the actual window traffic is 10 packets. The service requester can be a user consuming network traffic.

[0035] In practical applications, an IDS can also incorporate a traffic detection module based on machine learning. This module can be a traffic detection model trained on the normal traffic characteristics of the service area, capable of detecting and judging window traffic. The traffic detection module model can categorize window traffic into normal traffic, malicious traffic, and suspicious traffic. The first type of traffic can be understood as normal traffic. The service area outputs normal traffic from different time periods to the service requester, discards malicious traffic, and saves suspicious traffic from the current time period for further evaluation in the next time period.

[0036] As can be seen from the above, in this embodiment of the application, by determining the sliding window of the service area in different time periods, the input network traffic of the service area is identified based on the sliding window to obtain the traffic available in the service area in different time periods and output it to the service requester. That is, without relying on additional modules, the available traffic is output in real time through the sliding window, which solves the technical problem in related technologies that cannot improve the real-time performance of IDS. Combining the sliding window and traffic detection to quickly identify normal traffic improves the efficiency of IDS in identifying normal traffic.

[0037] In some embodiments of this application, step S101, which determines the sliding window of the service area at different time periods, can be implemented in the following way:

[0038] Acquire input network traffic data; the input network traffic data includes the first traffic data of the service area at different time periods;

[0039] The sliding window is determined based on the first flow data and the sliding window model.

[0040] Understandably, a sliding window module can be a sliding window model trained based on the input network traffic data of the service area. A sliding window model can be understood as a model built on a neural network. Types of neural networks include, but are not limited to, Deep Neural Networks (DNNs), Recurrent Neural Networks (RNNs), Convolutional Neural Networks (CNNs), Feedforward Neural Networks (FFs), and Generative Adversarial Networks (GANs).

[0041] In practical applications, the input network traffic data of the service area can be preprocessed, the normal traffic data of different time periods can be labeled, and the data can be input into the sliding window model for training to determine the sliding window for each time period.

[0042] In some embodiments of this application, determining the sliding window based on first traffic data and a sliding window model includes:

[0043] The first traffic data is input into a sliding window model for feature extraction to obtain the network traffic size characteristics of the service area.

[0044] The sliding window is determined based on the characteristics of network traffic volume.

[0045] It is understandable that features can be extracted using methods such as variance filtering and chi-square filtering, and the variance can be used to filter the classes of network traffic size features. This application does not limit this to any specific method.

[0046] In practical applications, the labeled normal traffic data can be divided into multiple sample groups and input into a sliding window model. The sliding window model can use multiple samples to extract the network traffic size features for each time period, forming a sliding window.

[0047] In some embodiments of this application, the method further includes:

[0048] The first traffic data is input into the traffic detection model for feature extraction to obtain the first traffic features of the service area.

[0049] Understandably, traffic detection models can be understood as models built on neural networks. Types of neural networks include, but are not limited to, DNN, RNN, CNN, FF, and GAN.

[0050] In practical applications, the input network traffic data of the service area can be preprocessed, and normal traffic data from different time periods can be labeled and input into the traffic detection model. Clustering is then used to form different normal traffic groups. The first traffic feature can be understood as the feature of any group within the normal traffic group. Window traffic is then judged: if the window traffic is less than a set threshold from any normal traffic group, it is classified as normal traffic; if the window traffic is much greater than the set threshold from any normal traffic group, it is classified as malicious traffic; traffic that is neither normal nor malicious is classified as suspicious traffic.

[0051] As can be seen from the above, in this embodiment of the application, network traffic size characteristics are used to form a sliding window size. This ensures the normal operation of the network and serves as a condition for the traffic detection model to identify traffic. It does not identify the attack type of the attack traffic, but only compares it with the characteristics of normal traffic to determine that traffic that is far away is attack traffic. It does not analyze what kind of attack it is, and it has stronger robustness against unknown attacks.

[0052] In some embodiments of this application, step S102 identifies the input network traffic of the service area based on a sliding window and outputs the first traffic of the service area at different time periods to the service requester. This can be achieved in the following way:

[0053] Based on sliding window, the window traffic received by the service area in different time periods is determined from the input network traffic;

[0054] The first flow in the window flow is identified based on the first flow feature.

[0055] In practical applications, taking the initial first time period as an example, after determining the sliding window, the input network traffic of the service area in the first time period can be entered into the corresponding sliding window to determine the window traffic of the service area in the first time period, which is the actual amount of network traffic that can be received. For example, if the input network traffic in the first time period is 16 packets, and the sliding window corresponding to the first time period is 10, then the actual window traffic is 10 packets.

[0056] After determining the window traffic, the window traffic is judged. If the window traffic is less than a set threshold from any normal traffic group, it is classified as normal traffic; if the window traffic is much greater than the set threshold from any normal traffic group, it is classified as malicious traffic; if it is neither normal traffic nor malicious traffic, it is classified as suspicious traffic.

[0057] In a feasible scenario, refer to Figure 2 As shown, network traffic identification can be implemented in the following way:

[0058] S201: Start, acquire network traffic data for the service area.

[0059] S202: Input network traffic data into the sliding window model.

[0060] S203: Calculate the flow rate within a fixed time period and set the sliding window size.

[0061] S204: Determine whether the flow within the sliding window is normal flow. If yes, proceed to step S205; otherwise, proceed to step S205.

[0062] S205: Normal network traffic output.

[0063] S206: Determine if it is malicious traffic. If not, proceed to step S207; if yes, proceed to step S208.

[0064] S207: Suspicious traffic is saved; slide the window to proceed.

[0065] S208: Malicious traffic dropped.

[0066] As can be seen from the above, this embodiment uses network traffic size characteristics to form a sliding window size. This ensures the normal operation of the network while also serving as a condition for the traffic detection model to determine traffic. The traffic is divided into three categories: normal traffic, abnormal traffic, and suspicious traffic. Normal traffic is output to the user, abnormal traffic is discarded, and suspicious traffic remains in the traffic detection model to await further judgment in the next round. Without relying on additional modules, normal traffic is output in real time through the sliding window, which solves the technical problem of not being able to improve the real-time performance of IDS in related technologies. This ensures both the network operating speed and the recognition rate of normal traffic, effectively guaranteeing normal use for users.

[0067] In some embodiments of this application, the method further includes:

[0068] The second and third traffic within the window traffic are identified based on the first traffic feature; the second traffic is traffic attacking the service area; the third traffic is traffic that is neither the first nor the second traffic.

[0069] The traffic window is updated based on the first, second, and third traffic flows.

[0070] Understandably, the second type of traffic can be interpreted as malicious traffic, and the third type as suspicious traffic. After determining the sliding window for different time periods, the sliding window parameters for the corresponding time periods can be updated based on the weights of the actual number of normal and attack traffic received by the service area in different time periods.

[0071] In practical applications, starting from the first time period, the next time period is the second time period. Assume that the sliding window for the first time period is 10 packets, and the sliding window for the second time period is 20 packets. The sliding window model will provide a redundancy of 30% based on this, which is 13 packets. At this time, assume that 8 normal packets and 8 attack packets arrive. According to the arrival order, only 13 packets can be received in the service area at this time, and the rest will be temporarily stored. Now assume that among these 13 packets, 6 normal packets and 7 attack packets are obtained. After passing through the traffic detection module, assuming the recognition accuracy rate is 100%, the current normal traffic is 6, and the calculated result of the attack traffic count is 16 - 6 = 10 packets. Then the sliding window for the first time period can be updated to 10 (the past window) * 0.3 + 0.7 * (6 (normal traffic count) + 10 (attack traffic count) / 6 (normal traffic count)) ≈ 8.36667, rounded up to 9, that is, the size of the sliding window for the first time period changes from 10 to 9, and the sliding window for the second time period can be updated to 10 (the past window) * 0.3 + 0.7 * (6 (normal traffic count) + 10 (attack traffic count) / 6 (normal traffic count)) + 20 (the predicted size calculated by the model) ≈ 28.36667, rounded up to 29, that is, the size of the sliding window for the second time period changes from 20 to 29. At this time, the model can update the sizes of the sliding windows for the first and second time periods.

[0072] Next, there are 2 normal packets and 1 attack packet remaining in the first time period. At the same time, assume that 2 attack packets among the packets passing through the recognition module are identified as suspicious packets. So the total number of packets temporarily stored in the first time period is 5. At this time, 23 normal traffic and 11 attack traffic arrive. Assume that these 5 packets plus 18 normal packets and 6 attack packets are input into the traffic detection module. The packets temporarily stored in the second time period are 5 normal packets and 5 attack packets. After determination, 20 normal packets pass through. Then the sliding window for the next time period can be updated to 29 (the past window) * 0.3 + 0.7 * (20 (normal traffic count) + 19 (attack traffic count = 5 previous + 23 + 11 - 20) / 20 (normal traffic count)) + 20 (the predicted size of the next window calculated by the model, still assumed to be 20 here) = 43.365, rounded up to 44. The sliding window for the second time period can be updated to 29 (the past window) * 0.3 + 0.7 * (20 (normal traffic count) + 19 (attack traffic count = 5 previous + 23 + 11 - 20) / 20 (normal traffic count)) = 23.365, rounded up to 24.

[0073] In a realizable scenario, refer to Figure 3As shown, the traffic detection module's functions can include time-period traffic statistics, normal traffic identification, traffic splitting, and traffic sliding window settings. Time-period traffic statistics include total input traffic statistics, normal traffic statistics, abnormal traffic statistics, and suspicious traffic statistics within a fixed time period. Normal traffic identification includes identifying normal traffic within a window and marking all traffic as normal, abnormal, or suspicious. Traffic splitting includes splitting the traffic marked in the previous time period: normal traffic is output, abnormal traffic is discarded, and suspicious traffic is stored in the current module for subsequent statistics and traffic identification. To ensure that network throughput is not affected by the module, the output window size of the traffic sliding window setting can be used as the basis for the normal traffic identification function. After each round of identification, the sliding window is re-planned.

[0074] Because the service area may continuously expand into new businesses, and users' usage patterns within the service area may also change, a parameter update strategy can be adopted to address these changes. When new businesses emerge in the service area, the original model can be migrated using a small amount of new business traffic data to generate a new model suitable for the new business traffic. New user traffic will be updated using a method similar to the sliding window model; that is, each time traffic input is identified as normal traffic, the parameters of the normal traffic group are updated, and the center and range of the new normal traffic group are recalculated. To prevent the module from slowing down due to the ever-increasing data volume, a forgetting strategy can be implemented. This ensures that earlier data accounts for a smaller proportion, and when the proportion reaches 0, the data is discarded. The specific implementation process is as follows:

[0075] This application uses a Cartesian coordinate system as a simplified example for the traffic detection module. Assume there are four types of normal traffic, located at (2,2), (2,-2), (-2,2), and (-2,-2), respectively. Traffic within a Euclidean distance of 1 is considered similar. If a new service traffic suddenly approaches (5,0), it will undoubtedly be judged as abnormal and discarded. Normally, if a user finds the new service unusable, they will try multiple times, resulting in an increasing number of traffic points near (5,0). The model will find that the current traffic center has become five. After judging these five centers, it finds four are previous centers and one is newly added. The model then simulates the fifth center traffic, sending an empty message to the user to obtain further user responses. The traffic records are then analyzed for characteristics. The new traffic is then treated as normal traffic and allowed to pass. Through 24-hour (customizable) analysis of new traffic characteristics, if the new traffic: 1. Does not affect the passage of existing normal traffic; 2. Its characteristics remain fixed within the time period without significant shifts. The characteristics of the new traffic are then written into the model, resulting in 5 normal traffic groups. If at the same time, a service is no longer in use, for example, (2,2) is no longer in use, then condition 1 is obviously not met. In this case, a second detection is performed to re-detect the new service traffic. The second detection results in 3 stable traffic groups without affecting the previous three. Then, these are added back into the model, resulting in 4 traffic groups.

[0076] This application's embodiments utilize a machine learning-based dynamic sliding window to identify and control traffic, eliminating the need to deploy additional identification modules on the IDS, thus improving the accuracy of network traffic attack identification and reducing redundancy. It can quickly and accurately identify specific traffic types within the network, ensuring identification effectiveness without relying on the overall traffic graph, thereby improving identification efficiency. Furthermore, it can dynamically combine with real-time network traffic data for rapid and accurate identification of normal traffic. By employing a method of dynamically learning from normal traffic to identify network attacks, prioritizing the identification and passage of normal traffic, it enhances network security.

[0077] Based on the same inventive concept as described above, Figure 4 This is a schematic diagram of a network traffic identification device provided in an embodiment of the present invention. The device 400 includes:

[0078] The determining unit 401 is used to determine the sliding window of the service area at different time periods;

[0079] The identification unit 402 is used to identify the input network traffic of the service area based on a sliding window, and output the first traffic of the service area at different time periods to the service requester; the first traffic is the traffic that the service requester can use.

[0080] In some embodiments of this application, the determining unit 401 is further configured to acquire input network traffic data; the input network traffic data includes first traffic data of the service area at different time periods;

[0081] The sliding window is determined based on the first flow data and the sliding window model.

[0082] In some embodiments of this application, the determining unit 401 is further configured to input the first traffic data into a sliding window model for feature extraction to obtain the network traffic size characteristics of the service area;

[0083] The sliding window is determined based on the characteristics of network traffic volume.

[0084] In some embodiments of this application, the determining unit 401 is further configured to input the first traffic data into the traffic detection model for feature extraction to obtain the first traffic features of the service area.

[0085] In some embodiments of this application, the identification unit 402 is further configured to determine the window traffic received by the service area in different time periods from the input network traffic based on a sliding window;

[0086] The first flow in the window flow is identified based on the first flow feature.

[0087] In some embodiments of this application, the identification unit 402 is further configured to identify a second flow and a third flow in the window flow based on a first flow feature; the second flow is the flow that attacks the service area; the third flow is the flow that is neither the first flow nor the second flow.

[0088] The traffic window is updated based on the first, second, and third traffic flows.

[0089] Based on the foregoing embodiments, embodiments of this application provide an electronic device. Figure 5 This is a schematic diagram of a hardware structure of an electronic device according to an embodiment of the present invention. The electronic device 500 includes at least one processor 501 and a memory 502. Optionally, the electronic device 500 may further include at least one communication interface 503. The various components in the electronic device 500 are coupled together through a bus system 504. It can be understood that the bus system 504 is used to realize the connection and communication between these components. In addition to a data bus, the bus system 504 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 5 The general designated all buses as Bus System 504.

[0090] Based on the hardware implementation of the above program modules, the communication interface 503 is able to interact with other communication devices.

[0091] The processor 501 is connected to the communication interface 503 to enable information exchange with other communication devices and to execute the methods provided by one or more of the above-mentioned technical solutions when running a computer program;

[0092] Memory 502, the computer program is stored in memory 502.

[0093] Specifically, processor 501 is used to determine the sliding window of the service area at different time periods;

[0094] The system identifies the input network traffic of the service area based on a sliding window and outputs the first traffic of the service area at different time periods to the service requester; the first traffic is the traffic that the service requester can use.

[0095] In some embodiments of this application, processor 501 is configured to acquire input network traffic data; the input network traffic data includes first traffic data of the service area at different time periods;

[0096] The sliding window is determined based on the first flow data and the sliding window model.

[0097] In some embodiments of this application, processor 501 is used to input first traffic data into a sliding window model for feature extraction to obtain network traffic size features of the service area;

[0098] The sliding window is determined based on the characteristics of network traffic volume.

[0099] In some embodiments of this application, processor 501 is used to input first traffic data into a traffic detection model for feature extraction to obtain first traffic features of the service area.

[0100] In some embodiments of this application, processor 501 is configured to determine, based on a sliding window, the window traffic received by the service area at different time periods from the input network traffic;

[0101] The first flow in the window flow is identified based on the first flow feature.

[0102] In some embodiments of this application, processor 501 is configured to identify second and third traffic in window traffic based on first traffic characteristics; the second traffic is traffic attacking the service area; and the third traffic is traffic that is neither the first nor the second traffic.

[0103] The traffic window is updated based on the first, second, and third traffic flows.

[0104] It is understood that memory 502 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), Sync Link Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 502 described in this embodiment of the invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0105] The memory 502 in this embodiment of the invention is used to store various types of data to support the operation of the electronic device 500. Examples of such data include any computer program for operation on the electronic device 500, and programs implementing the methods of this embodiment of the invention may be included in the memory 502.

[0106] The methods disclosed in the above embodiments of the present invention can be applied to or implemented by processor 501. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present invention can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory. The processor reads information from the memory and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0107] In an exemplary embodiment, the electronic device 500 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the methods described above.

[0108] Based on the foregoing embodiments, embodiments of this application provide a storage medium storing computer-executable instructions configured to execute... Figure 1 The corresponding implementation provides a network traffic identification method.

[0109] Based on the foregoing embodiments, embodiments of this application also provide a computer product, including a computer program, which, when executed by a processor, implements... Figure 1 The steps in the network traffic identification method provided in the corresponding embodiment.

[0110] It should be noted that the aforementioned computer storage media can be ROM, PROM, EPROM, EEPROM, FRAM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM, etc.; or it can be various electronic devices that include one or any combination of the above-mentioned storage media, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0111] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0112] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0113] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0114] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0115] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0116] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0117] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A method for identifying network traffic, characterized in that, The method includes: Determine the sliding window for the service area at different time periods; Based on the sliding window, the input network traffic of the service area is identified, and the first traffic of the service area at different time periods is output to the service requester; the first traffic is the traffic that the service requester can use.

2. The method according to claim 1, characterized in that, The sliding window for determining the service area at different time periods includes: Acquire input network traffic data; the input network traffic data includes first traffic data of the service area at different time periods; The sliding window is determined based on the first traffic data and the sliding window model.

3. The method according to claim 2, characterized in that, Determining the sliding window based on the first traffic data and the sliding window model includes: The first traffic data is input into the sliding window model for feature extraction to obtain the network traffic size features of the service area. The sliding window is determined based on the network traffic size characteristics.

4. The method according to claim 2, characterized in that, The method further includes: The first traffic data is input into the traffic detection model for feature extraction to obtain the first traffic feature of the service area.

5. The method according to claim 4, characterized in that, The step of identifying the input network traffic of the service area based on the sliding window and outputting the first traffic of the service area at different time periods to the service requester includes: Based on the sliding window, the window traffic received by the service area in different time periods is determined from the input network traffic; The first flow in the window flow is identified based on the first flow feature.

6. The method according to claim 5, characterized in that, The method further includes: The second and third traffic in the window traffic are identified based on the first traffic feature; the second traffic is traffic attacking the service area; the third traffic is traffic that is neither the first nor the second traffic. The traffic window is updated based on the first traffic, the second traffic, and the third traffic.

7. A network traffic identification device, characterized in that, The network traffic identification device includes: The determining unit is used to determine the sliding window of the service area at different time periods; The identification unit is used to identify the input network traffic of the service area based on the sliding window, and output the first traffic of the service area at different time periods to the service requester; the first traffic is the traffic that the service requester can use.

8. An electronic device, characterized in that, include: The processor and the memory used to store computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 6.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer product comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images