Fttr-b multi-tenant distributed anomaly detection method and device, equipment and medium

Abstract

The application discloses an FTTR-B multi-tenant distributed anomaly detection method and device, equipment and a medium, wherein the method comprises the following steps: dividing a to-be-detected area into a plurality of sub-areas based on the network topology of the to-be-detected area and historical traffic data of each slave gateway; calculating traffic change data of each sub-area; setting a threshold adjustment strategy for each sub-area based on the traffic change data of each sub-area; and performing anomaly detection on the to-be-detected area based on the threshold adjustment strategy of each sub-area. The application solves the problem that the traditional anomaly detection method sets a global unified detection standard, and when local traffic changes, false positives or missed detections occur.

Description

Technical Field

[0001] This application relates to the field of FTTR data anomaly detection, and in particular to an FTTR-B multi-tenant distributed anomaly detection method, apparatus, equipment and medium. Background Technology

[0002] Fiber to the Room (FTTR-B), as the core architecture of enterprise-grade all-optical networks, delivers high-speed, low-latency, and highly reliable connections via fiber optic cables directly to office areas, server rooms, and production workshops. This supports high-bandwidth, low-latency services such as cloud computing and industrial IoT in multi-tenant enterprise scenarios. When network traffic anomalies occur, precise detection is necessary to ensure business continuity.

[0003] However, traditional anomaly detection methods rely on fixed thresholds, i.e., setting globally uniform detection standards, which cannot detect dynamic changes in local traffic. When enterprise networks experience frequent device access or a sudden surge in temporary video conferences due to business adjustments, traditional anomaly detection methods may be prone to misjudgment or missed detection. Summary of the Invention

[0004] The main purpose of this application is to provide an FTTR-B multi-tenant distributed anomaly detection method, device, equipment and medium, which aims to solve the technical problem that traditional anomaly detection methods, due to the setting of globally unified detection standards, may result in misjudgment or missed detection when local traffic changes.

[0005] To achieve the above objectives, this application provides an FTTR-B multi-tenant distributed anomaly detection method, comprising: dividing the area to be detected into multiple sub-areas based on the network topology of the area to be detected and the historical traffic data of each slave gateway; calculating the traffic change data of each sub-area; setting a threshold adjustment strategy for each sub-area based on the traffic change data of each sub-area; and performing anomaly detection on the area to be detected based on the threshold adjustment strategy of each sub-area.

[0006] Optionally, the traffic change data is the difference between the traffic data at the current time point and the traffic data at the previous time point.

[0007] Optionally, dividing the area to be detected into multiple sub-regions based on the network topology of the area to be detected and the historical traffic data of each slave gateway includes: determining the proximity between the target slave gateway and each other slave gateway based on the network topology; calculating the traffic approximation between the target slave gateway and each other slave gateway based on the historical traffic data of each slave gateway; and dividing the area to be detected into multiple sub-regions based on the proximity and the traffic approximation.

[0008] Optionally, dividing the region to be detected into multiple sub-regions based on the proximity and the traffic approximation includes: establishing a pattern similarity matrix based on the proximity and the traffic approximation, and according to the order of the proximity from small to large and the order of the traffic approximation from large to small; and dividing the region to be detected into multiple sub-regions based on the pattern similarity matrix.

[0009] Optionally, dividing the region to be detected into multiple sub-regions based on the pattern similarity matrix includes: constructing a scatter plot based on each slave gateway, wherein each node in the scatter plot represents each slave gateway; connecting different nodes in the scatter plot based on the pattern similarity matrix and determining at least one connected component; and dividing the region to be detected into multiple sub-regions based on the connected component.

[0010] Optionally, each sub-region includes multiple slave gateways, and the step of setting a threshold adjustment strategy for each sub-region based on the traffic change data of each sub-region includes: determining the traffic change anomaly factor of a target sub-region among all sub-regions; and setting a threshold adjustment strategy for the target sub-region based on the traffic change anomaly factor of the target sub-region.

[0011] Optionally, determining the traffic change anomaly factor of the target sub-region includes: acquiring the traffic data change trend of each slave gateway in the target sub-region; and determining the traffic change anomaly factor of the target sub-region based on the similarity of the traffic data change trends of different slave gateways in the target sub-region.

[0012] Furthermore, to achieve the above objectives, this application also provides an FTTR-B multi-tenant distributed anomaly detection device, comprising: a region division module, used to divide the region to be detected into multiple sub-regions based on the network topology of the region to be detected and the historical traffic data of each slave gateway; a traffic change calculation module, used to calculate the traffic change data of each of the sub-regions; a threshold adjustment strategy setting module, used to set a threshold adjustment strategy for each of the sub-regions based on the traffic change data of each of the sub-regions; and an anomaly detection module, used to perform anomaly detection on the region to be detected based on the threshold adjustment strategy of each of the sub-regions.

[0013] This application also provides an FTTR-B multi-tenant distributed anomaly detection device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method in any of the above possible implementations.

[0014] This application also provides a computer-readable storage medium, comprising: storing a computer program, wherein when the computer program is executed by a processor, it implements the above-described FTTR-B multi-tenant distributed anomaly detection method.

[0015] This application proposes an FTTR-B multi-tenant distributed anomaly detection method, apparatus, device, and medium. First, the area to be detected is divided into multiple sub-areas based on the network topology and historical traffic data of each slave gateway. Then, traffic change data for each sub-area is calculated, and a threshold adjustment strategy is set for each sub-area based on this data. Finally, anomaly detection is performed on the area to be detected based on the threshold adjustment strategies for each sub-area. This application solves the technical problem of misjudgment or missed detection in traditional anomaly detection methods due to the need for globally uniform detection standards and the resulting changes in local traffic. Attached Figure Description

[0016] Figure 1 This is a flowchart of an FTTR-B multi-tenant distributed anomaly detection method according to one embodiment of this application;

[0017] Figure 2 This is a structural block diagram of an FTTR-B multi-tenant distributed anomaly detection device according to one embodiment of this application;

[0018] Figure 3 This is a schematic diagram of the structure of an FTTR-B multi-tenant distributed anomaly detection device according to one embodiment of this application.

[0019] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0021] In FTTR-B scenarios, traditional anomaly detection methods typically use globally uniform fixed thresholds based on historical data, which cannot detect dynamic changes in local traffic, leading to significant errors. For example, when there is a sudden surge in traffic during a company's ad-hoc video conference, the fixed threshold may not adapt dynamically, triggering incorrect interception. Another example is at the end of the month, when there is a surge in network traffic for settlement data in the company's finance area, abnormal attack traffic may be hidden within normal traffic and missed by the system.

[0022] To address the aforementioned issues, this application provides an FTTR-B multi-tenant distributed anomaly detection method, apparatus, device, and medium. The solution described in this application is detailed below.

[0023] Figure 1This is a flowchart illustrating an FTTR-B multi-tenant distributed anomaly detection method according to one embodiment of this application. This FTTR-B multi-tenant distributed anomaly detection method can be applied to an FTTR-B system. The FTTR-B system may include: an FTTR-B master gateway, multiple slave gateways, and an intelligent management platform. The operator's fiber optic access is provided to the master gateway. The master gateway distributes optical signals to each slave gateway via a fiber optic splitter. Each slave gateway connects to terminal devices in each room via wired or wireless means, providing them with network services. The intelligent management platform is used to monitor and optimize network traffic to ensure efficient network operation. (Refer to...) Figure 1 The FTTR-B multi-tenant distributed anomaly detection method may include the following steps:

[0024] S11. Based on the network topology of the area to be detected and the historical traffic data of each slave gateway, the area to be detected is divided into multiple sub-areas.

[0025] Each sub-region represents a region with a different working mode within the region to be detected.

[0026] It is understandable that network topology can reflect the connection relationship between terminal devices and slave gateways within the area to be detected, as well as the connection relationship between each slave gateway and the master gateway. Historical traffic data of each slave gateway can characterize the working mode of each slave gateway. In this embodiment, by using the network topology of the area to be detected and the historical traffic data of each slave gateway, slave gateways with similar working modes and geographical locations can be divided into a sub-region, and the different sub-regions obtained can characterize different working modes.

[0027] In the specific implementation process, the network topology of the area to be detected is first obtained by using the FTTR master gateway and intelligent management platform, and then the historical traffic data of each slave gateway is obtained from the intelligent management platform.

[0028] Furthermore, based on the network topology of the area to be detected and the historical traffic data of each slave gateway, the area to be detected is divided into multiple sub-areas.

[0029] In one embodiment, step S11, dividing the area to be detected into multiple sub-areas based on the network topology of the area to be detected and the historical traffic data of each slave gateway, may specifically include:

[0030] S111. Determine the proximity of the target from the gateway and each of the other gateways based on the network topology;

[0031] S112. Calculate the degree of traffic approximation between the target slave gateway and each other slave gateway based on the historical traffic data of each slave gateway;

[0032] S113. The area to be detected is divided into multiple sub-regions based on proximity and flow similarity.

[0033] In the specific implementation process, the proximity between the target gateway and each other gateway is first determined according to the network topology, and the traffic approximation between the target gateway and each other gateway is calculated based on the historical traffic data of each gateway.

[0034] For example, this embodiment can use a shortest path algorithm to determine the shortest distance between the target gateway and every other gateway in the network topology of the area to be detected, and use this shortest distance as the proximity between the target gateway and every other gateway. This embodiment can also calculate the DTW distance between the historical traffic data of the target gateway and the historical traffic data of every other gateway, and determine the traffic approximation between the target gateway and every other gateway based on this DTW distance, that is, use this DTW distance as the traffic approximation between the target gateway and every other gateway.

[0035] It should be noted that, since a larger DTW distance indicates less similarity between the two sets of sequences, this example first performs linear normalization on the calculated DTW distance, linearly mapping it to the range (0,1]. Then, 1 minus the linearly normalized DTW distance is used as the approximation of the traffic between the target gateway and each other gateway. Correspondingly, since a smaller shortest distance indicates closer proximity between the two gateways, this embodiment also performs linear normalization on the calculated shortest distance, using the linearly normalized shortest distance as the proximity between the target gateway and each other gateway. It is understandable that after linear processing and subtraction from the constant 1, a larger approximation of the traffic indicates more similar operating modes between the two gateways; conversely, a smaller shortest distance after linear processing indicates closer physical connection locations between the two gateways.

[0036] In other embodiments, the maximum flow algorithm can be used to determine the proximity between the target gateway and each of the other gateways. Furthermore, in other embodiments, the traffic approximation between the target gateway and each of the other gateways can be determined by calculating the correlation coefficient of historical traffic data between the target gateway and each of the other gateways. This embodiment does not specifically limit the calculation methods for proximity and traffic approximation.

[0037] Furthermore, the area to be detected is divided into multiple sub-regions based on proximity and flow similarity.

[0038] It is understandable that if two secondary gateways are located close to each other and have similar historical traffic data, it means that the user terminals connected to these two secondary gateways are performing similar tasks. In this embodiment, secondary gateways performing similar tasks are grouped into one sub-region.

[0039] In one embodiment, step S113, dividing the area to be detected into multiple sub-regions based on proximity and traffic approximation, may specifically include:

[0040] S1131. Based on proximity and traffic similarity, establish a pattern similarity matrix according to the order of proximity from small to large and traffic similarity from large to small.

[0041] S1132. The region to be detected is divided into multiple sub-regions based on the pattern similarity matrix.

[0042] In the specific implementation process, firstly, any two slave gateways are grouped into a gateway pair. The proximity of each gateway pair is arranged in ascending order, forming the first column of the pattern similarity matrix. The traffic similarity of the corresponding slave gateways in the first column forms the second column of the pattern similarity matrix. It can be understood that if there are three slave gateways, gateway a, gateway b, and gateway c, then the gateway pairs include the first gateway pair (gateway a and gateway b), the second gateway pair (gateway a and gateway c), and the third gateway pair (gateway b and gateway c).

[0043] It should be noted that if two gateway pairs have the same degree of proximity, they are arranged in descending order of the similarity of their corresponding traffic. For example, if gateway pair A and gateway pair B have the same degree of proximity, and the similarity of gateway pair A's traffic is greater than that of gateway pair B, then gateway pair A is arranged before gateway pair B.

[0044] In one embodiment, step S1132, dividing the region to be detected into multiple sub-regions based on the pattern similarity matrix, may specifically include:

[0045] S11321. Construct a scatter plot based on each slave gateway, where each node in the scatter plot represents each slave gateway;

[0046] S11322. Connect different nodes in a scatter plot based on the pattern similarity matrix and determine at least one connected component;

[0047] S11323. Divide the region to be detected into multiple sub-regions based on connected components.

[0048] In the specific implementation process, a scatter plot is first constructed. Each node in the scatter plot represents a gateway. It can be understood that the scatter plot only contains at least one node and does not contain the connection relationship between nodes (edges between nodes).

[0049] Furthermore, in the pattern similarity matrix, the top 50% of gateway pairs are selected from the first column as physically approximate gateway pairs. If the traffic approximation degree of any physically approximate gateway pair is greater than a first preset threshold, an edge is added between the two nodes corresponding to that physically approximate gateway in the scatter plot, ultimately resulting in an edged scatter plot. In this embodiment, the traffic approximation degree is arranged in descending order, and the value corresponding to the last traffic approximation degree in the top 70% is set as the first preset threshold.

[0050] Furthermore, using a priority search algorithm, all initially connected components in the edged scatter graph are determined, resulting in at least one isolated node, i.e., a node not connected to any other node. It is understandable that each initially connected component represents a number of nodes that are connected to each other.

[0051] It should be noted that in this embodiment, an initial connected component can be assigned to a sub-region, and an isolated node can be assigned to a sub-region to divide the area to be detected. Alternatively, the isolated node can be assigned to the sub-region where that node is located if the traffic similarity between the isolated node and a certain node is greater than a second preset threshold, thus completing the merging of the isolated node's regions and obtaining the final sub-regions. For example, in this embodiment, the traffic similarity is arranged in descending order, and the value corresponding to the last traffic similarity in the first 50% is set as the second preset threshold.

[0052] S12. Calculate the flow change data for each sub-region;

[0053] S13. Set threshold adjustment strategies for each sub-region based on the traffic change data of each sub-region;

[0054] S14. Anomaly detection is performed on the region to be detected based on the threshold adjustment strategy for each sub-region.

[0055] In the specific implementation process, taking the target sub-region among all sub-regions as an example, the traffic change data of each slave gateway in the target sub-region is obtained in the intelligent management platform, and the traffic change data of the target sub-region is determined using the traffic change data of each slave gateway in the target sub-region. For example, the mean of the similarity of traffic between each slave gateway and other slave gateways in the target sub-region can be calculated, and the traffic change data of the slave gateway with the smallest mean can be used as the traffic change data of the target sub-region.

[0056] It is understandable that, since the traffic change data of different sub-regions are different, the threshold adjustment strategies of different sub-regions are also different. It is necessary to set the threshold adjustment strategy for each sub-region according to the traffic change data of each sub-region.

[0057] In the specific implementation process, the reference sub-region of the target sub-region is first determined from all sub-regions based on the traffic change data of the target sub-region. Then, the threshold set by the reference sub-region for anomaly detection of historical traffic data is used as the initial threshold of the target sub-region.

[0058] Specifically, the DTW distance can be used to calculate the similarity between the historical traffic data of the target sub-region and other sub-regions, and the sub-region with the highest similarity can be used as the reference sub-region for the target sub-region. The reference sub-region can provide a reference for setting the initial anomaly detection threshold for the target sub-region.

[0059] It is understandable that the reference sub-region of the target sub-region is a sub-region in the historical traffic data that is similar to the traffic data of the target sub-region after the change. Therefore, the threshold for the initial anomaly detection of the target sub-region can be set according to the threshold setting method of the reference sub-region.

[0060] In one embodiment, step S13, which sets a threshold adjustment strategy for each sub-region based on the traffic change data of each sub-region, may specifically include:

[0061] S131. Determine the abnormal factors of traffic flow changes in the target sub-region;

[0062] S132. Set the threshold adjustment strategy for the target sub-region based on the abnormal factors of traffic changes in the target sub-region.

[0063] In the specific implementation process, the traffic data change trend of each slave gateway in the target sub-region is first obtained, and then the traffic change anomaly factor of the target sub-region is determined based on the similarity of the traffic data change trends of different slave gateways in the target sub-region.

[0064] For example, the traffic change trend of each slave gateway may include: increase, decrease, and no change. In this embodiment, no change and increase are classified as the same change trend, and then the threshold adjustment strategy of the target sub-region can be determined according to the number of slave gateways in the target sub-region that belong to the same change trend.

[0065] Specifically, the threshold adjustment strategy for the target sub-region is as follows: if the traffic change trend of the target sub-region at the current time point is increasing, that is, at the current time point, more than 50% of the traffic change trends of the sub-gateways in the target sub-region are increasing, then the initial threshold needs to be increased; if at the current time point, only less than 20% of the sub-gateways in the target sub-region have an increasing traffic change trend, then the initial threshold is not changed.

[0066] Additionally, if the traffic trend in the target sub-region at the current time point is decreasing (i.e., at the current time point, more than 50% of the slave gateways in the target sub-region are showing a decreasing traffic trend), then the initial threshold needs to be lowered. If less than 20% of the slave gateways in the target sub-region at the current time point are showing a decreasing traffic trend, then the initial threshold remains unchanged. It should be noted that the range for increasing or decreasing the initial threshold can be determined by the magnitude of the increase or decrease in traffic data for each slave gateway in the target sub-region.

[0067] It is understandable that if there are business changes in the target sub-region, the traffic of multiple slave gateways included in the target sub-region will change. In this case, the threshold needs to be adjusted. However, if only a few slave gateways in the target sub-region experience traffic changes, it may be that the slave gateway is abnormal. The threshold is not changed, and the possible abnormal values ​​can be obtained.

[0068] Furthermore, based on the threshold adjustment strategy for each sub-region, anomaly detection is performed on each sub-region to complete the anomaly detection of the region to be detected.

[0069] This application proposes an FTTR-B multi-tenant distributed anomaly detection method. First, the area to be detected is divided into multiple sub-areas based on the network topology and historical traffic data of each slave gateway. Then, traffic change data for each sub-area is calculated, and a threshold adjustment strategy is set for each sub-area based on this data. Finally, anomaly detection is performed on the area to be detected based on the threshold adjustment strategies for each sub-area. This application solves the problem of misjudgment or missed detection in traditional anomaly detection methods due to the use of globally unified detection standards and changes in local traffic. For example, when there is a sudden surge in traffic during a temporary video conference, the fixed threshold fails to adapt dynamically, triggering incorrect interception. Another example is at the end of the month, when there is a sudden surge in network traffic for settlement data in the company's financial area, abnormal attack traffic may be hidden within normal traffic and missed by the system.

[0070] Based on the above embodiments, Figure 2 Here is a structural block diagram of an FTTR-B multi-tenant distributed anomaly detection device according to one embodiment of this application, as follows: Figure 2 As shown, the FTTR-B multi-tenant distributed anomaly detection device 200 may include: a region division module 210, a traffic change calculation module 220, a threshold adjustment strategy setting module 230, and an anomaly detection module 240, wherein,

[0071] The region segmentation module 210 is used to divide the region to be detected into multiple sub-regions based on the network topology of the region to be detected and the historical traffic data of each slave gateway;

[0072] The flow change calculation module 220 is used to calculate the flow change data of each sub-region;

[0073] The threshold adjustment strategy setting module 230 is used to set threshold adjustment strategies for each sub-region based on the traffic change data of each sub-region.

[0074] The anomaly detection module 240 is used to perform anomaly detection on the region to be detected based on the threshold adjustment strategy of each sub-region.

[0075] In an exemplary embodiment, the traffic change data in the traffic change calculation module 220 is the difference between the traffic data at the current time point and the traffic data at the previous time point.

[0076] In an exemplary embodiment, the region segmentation module 210 can also be used to determine the proximity between the target gateway and each other gateway based on the network topology; calculate the traffic approximation between the target gateway and each other gateway based on the historical traffic data of each gateway; and divide the region to be detected into multiple sub-regions based on the proximity and traffic approximation.

[0077] In an exemplary embodiment, the region segmentation module 210 can also be used to establish a pattern similarity matrix based on proximity and traffic similarity, and according to the order of proximity from small to large and the order of traffic similarity from large to small; and to divide the region to be detected into multiple sub-regions based on the pattern similarity matrix.

[0078] In an exemplary embodiment, the region division module 210 can also be used to construct a scatter plot based on each slave gateway, where each node in the scatter plot represents each slave gateway; connect different nodes in the scatter plot based on the pattern similarity matrix and determine at least one connected component; and divide the region to be detected into multiple sub-regions based on the connected components.

[0079] In an exemplary embodiment, the initial security detection model construction module 210 can also be used to determine the reference sub-region of the target sub-region among all sub-regions; and to set the threshold adjustment strategy of the target sub-region based on the preset abnormal threshold of the reference sub-region of the target sub-region.

[0080] In an exemplary embodiment, the initial security detection model construction module 210 can also be used to obtain the traffic data change trend of each slave gateway in the target sub-region; and determine the traffic change anomaly factor of the target sub-region based on the similarity of the traffic data change trends of different slave gateways in the target sub-region.

[0081] Those skilled in the art should understand that the division of the various modules in the embodiments is merely a logical functional division. In actual applications, they can be fully or partially integrated onto one or more actual carriers. These modules can be implemented entirely in software through processing unit calls, entirely in hardware, or a combination of software and hardware. It should be noted that each module in the FTTR-B multi-tenant distributed anomaly detection device in this embodiment corresponds one-to-one with each step in the FTTR-B multi-tenant distributed anomaly detection method in the aforementioned embodiments. Therefore, the specific implementation of this embodiment can refer to the implementation of the aforementioned FTTR-B multi-tenant distributed anomaly detection method, which will not be repeated here.

[0082] Based on the above embodiments, Figure 3 This is a schematic diagram of the structure of an FTTR-B multi-tenant distributed anomaly detection device according to one embodiment of this application, as shown below. Figure 3 As shown, the electronic device may include a processor 310, a communication interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 can call logical instructions in the memory 330 to execute an FTTR-B multi-tenant distributed anomaly detection method. The method includes: dividing the area to be detected into multiple sub-areas based on the network topology of the area to be detected and the historical traffic data of each slave gateway; calculating the traffic change data of each sub-area; setting a threshold adjustment strategy for each sub-area based on the traffic change data of each sub-area; and performing anomaly detection on the area to be detected based on the threshold adjustment strategy of each sub-area.

[0083] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0084] Based on the above embodiments, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the FTTR-B multi-tenant distributed anomaly detection method provided by the above methods. The method includes: dividing the area to be detected into multiple sub-areas based on the network topology of the area to be detected and the historical traffic data of each slave gateway; calculating the traffic change data of each sub-area; setting a threshold adjustment strategy for each sub-area based on the traffic change data of each sub-area; and performing anomaly detection on the area to be detected based on the threshold adjustment strategy of each sub-area.

[0085] Based on the above embodiments, in another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the FTTR-B multi-tenant distributed anomaly detection method provided by the above methods. The method includes: dividing the area to be detected into multiple sub-areas based on the network topology of the area to be detected and the historical traffic data of each slave gateway; calculating the traffic change data of each sub-area; setting a threshold adjustment strategy for each sub-area based on the traffic change data of each sub-area; and performing anomaly detection on the area to be detected based on the threshold adjustment strategy of each sub-area.

[0086] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A multi-tenant distributed anomaly detection method for FTTR-B, characterized in that, include: Based on the network topology of the area to be detected and the historical traffic data of each gateway, the area to be detected is divided into multiple sub-areas; Calculate the flow change data for each of the sub-regions; Based on the traffic change data of each sub-region, a threshold adjustment strategy is set for each sub-region; Anomaly detection is performed on the region to be detected based on the threshold adjustment strategy of each sub-region; The process of dividing the area to be detected into multiple sub-regions based on the network topology of the area to be detected and the historical traffic data of each gateway includes: Based on the network topology, determine the proximity between the target gateway and each of the other gateways; Calculate the degree of traffic approximation between the target slave gateway and each other slave gateway based on the historical traffic data of each slave gateway; The area to be detected is divided into multiple sub-regions based on the proximity and the flow approximation. The process of dividing the area to be detected into multiple sub-regions based on the proximity and the flow approximation includes: Based on the proximity degree and the traffic approximation degree, and in accordance with the order of proximity degree from small to large and the order of traffic approximation degree from large to small, a pattern similarity matrix is ​​established; The region to be detected is divided into multiple sub-regions based on the pattern similarity matrix.

2. The method as described in claim 1, characterized in that, The traffic change data is the difference between the traffic data at the current time point and the traffic data at the previous time point.

3. The method as described in claim 1, characterized in that, The process of dividing the region to be detected into multiple sub-regions based on the pattern similarity matrix includes: A scatter plot is constructed based on each slave gateway, where each node in the scatter plot represents a slave gateway. Based on the pattern similarity matrix, different nodes in the scatter plot are connected, and at least one connected component is determined; The region to be detected is divided into multiple sub-regions based on the connected components.

4. The method as described in claim 1, characterized in that, Each of the sub-regions includes multiple slave gateways, and the step of setting a threshold adjustment strategy for each sub-region based on traffic change data of each sub-region includes: Identify the abnormal factors causing traffic changes in the target sub-region across all sub-regions; Based on the abnormal flow change factors of the target sub-region, a threshold adjustment strategy for the target sub-region is set.

5. The method as described in claim 4, characterized in that, The process of determining the abnormal factors of traffic changes in the target sub-region across all sub-regions includes: Obtain the traffic data change trend of each gateway in the target sub-region; The anomaly factor of traffic change in the target sub-region is determined based on the similarity of the traffic data change trends of different gateways in the target sub-region.

6. An FTTR-B multi-tenant distributed anomaly detection device, characterized in that, include: The region segmentation module is used to divide the region to be detected into multiple sub-regions based on the network topology of the region to be detected and the historical traffic data of each slave gateway. The flow change calculation module is used to calculate the flow change data of each of the sub-regions; The threshold adjustment strategy setting module is used to set a threshold adjustment strategy for each of the sub-regions based on the traffic change data of each sub-region. Anomaly detection module is used to perform anomaly detection on the region to be detected based on the threshold adjustment strategy of each sub-region; The region segmentation module is also used to determine the proximity between the target gateway and each other gateway based on the network topology; calculate the traffic similarity between the target gateway and each other gateway based on the historical traffic data of each gateway; and establish a pattern similarity matrix based on the proximity and the traffic similarity, according to the order of proximity from small to large and the order of traffic similarity from large to small. The region to be detected is divided into multiple sub-regions based on the pattern similarity matrix.

7. An FTTR-B multi-tenant distributed anomaly detection device, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The device contains a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 5.

Images