Abnormal flow detection method and device based on time sequence characteristics and model training method and device

Abstract

The invention provides an abnormal traffic detection method based on time sequence features, and a model training method and device, and relates to a deep learning technology and the like in the fields of big data and artificial intelligence. The specific implementation scheme is as follows: acquiring flow data generated when an entity accesses an online service; sliding sampling is conducted on the flow data through a sliding window according to the preset window length and the sliding step length, feature extraction is conducted on data in the sampling window to obtain a time sequence feature matrix of the entity, the length of the time sequence feature matrix is N, the feature dimension is M, N is the data of the sampling window, and M is an integer larger than 1; and predicting the time sequence characteristic matrix by adopting a pre-trained time sequence model to obtain a prediction probability that the traffic generated by the entity for accessing the online service is abnormal traffic. According to the invention, high-precision, high-recall and low-misjudgment real-time identification of the abnormal traffic can be realized.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of data processing, especially to the field of big data, deep learning technology in the field of artificial intelligence, and in particular to an abnormal traffic detection method based on time sequence characteristics, a model training method and device. BACKGROUND

[0002] In related technologies, the strategy based on static rules and single-dimensional features (such as IP (Internet Protocol) black and white lists, single request frequency) is difficult to cope with the increasingly evolving black production technology, such as using high-quality proxy IP pool, dynamically changing user identifier (UID), simulating normal user behavior, etc. These abnormal traffic not only consumes a large amount of server resources and occupies bandwidth, but also may steal core business data, disrupt normal service order, and cause economic losses. SUMMARY

[0003] The present disclosure provides an abnormal traffic detection method based on time sequence characteristics, a model training method and device.

[0004] According to a first aspect of the present disclosure, an abnormal traffic detection method based on time sequence characteristics is provided, comprising:

[0005] Obtaining traffic data generated by an entity accessing an online service;

[0006] Using a sliding window with a preset window length and a sliding step to perform sliding sampling on the traffic data, and performing feature extraction on the data in the sampling window to obtain a time sequence feature matrix of the entity, the time sequence feature matrix has a length N and a feature dimension M, the N is the data of the sampling window, and the M is an integer greater than 1;

[0007] Using a pre-trained time sequence model to predict the time sequence feature matrix to obtain a prediction probability that the traffic generated by the entity accessing the online service is abnormal traffic.

[0008] According to a second aspect of the present disclosure, a time sequence model training method is provided, wherein the time sequence model is used to implement the method of the first aspect, and the training method comprises:

[0009] Obtaining training samples, the training samples including normal traffic data as positive samples and abnormal traffic data as negative samples;

[0010] Using a sliding window with a preset window length and a sliding step to perform sliding sampling on the training samples, and performing feature extraction on the data in the sampling window to obtain a time sequence feature matrix of the training samples, the time sequence feature matrix has a length N and a feature dimension M, the N is the data of the sampling window, and the M is an integer greater than 1;

[0011] inputting the time sequence feature matrix into a time sequence model to perform prediction to obtain a prediction probability that the training sample is abnormal traffic;

[0012] determining a model loss value based on the prediction probability of the training sample and a real label value of the training sample, and training the time sequence model according to the model loss value.

[0013] According to a third aspect of the present disclosure, an abnormal traffic detection device based on time sequence features is provided, comprising:

[0014] an acquisition module configured to acquire traffic data generated by an entity accessing an online service;

[0015] a sampling module configured to perform sliding sampling on the traffic data by using a sliding window with a preset window length and a sliding step;

[0016] a feature extraction module configured to perform feature extraction on data in the sampling window to obtain a time sequence feature matrix of the entity, the time sequence feature matrix having a length N and a feature dimension M, the N being data of the sampling window, and the M being an integer greater than 1;

[0017] a prediction module configured to perform prediction on the time sequence feature matrix by using a pre-trained time sequence model to obtain a prediction probability that the traffic generated by the entity accessing the online service is abnormal traffic.

[0018] According to a fourth aspect of the present disclosure, a time sequence model training device is provided, wherein the time sequence model is used to implement the method of the first aspect, and the device comprises:

[0019] an acquisition module configured to acquire training samples, the training samples including normal traffic data as positive samples and abnormal traffic data as negative samples;

[0020] a feature extraction module configured to perform sliding sampling on the training samples by using a sliding window with a preset window length and a sliding step, and perform feature extraction on data in the sampling window to obtain a time sequence feature matrix of the training samples, the time sequence feature matrix having a length N and a feature dimension M, the N being data of the sampling window, and the M being an integer greater than 1;

[0021] a prediction module configured to input the time sequence feature matrix into a time sequence model to perform prediction to obtain a prediction probability that the training sample is abnormal traffic;

[0022] a training module configured to determine a model loss value based on the prediction probability of the training sample and a real label value of the training sample, and train the time sequence model according to the model loss value.

[0023] According to a fifth aspect of this disclosure, an abnormal traffic detection system based on time-series characteristics is provided, including a gateway and an abnormal traffic detection device, wherein,

[0024] The gateway is configured to send traffic data generated by entity pairs accessing online services to the abnormal traffic detection device;

[0025] The abnormal flow detection device is configured to perform the method described in the first aspect above.

[0026] According to a sixth aspect of this disclosure, an electronic device is provided, comprising:

[0027] At least one processor; and

[0028] A memory communicatively connected to the at least one processor; wherein,

[0029] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the methods described in the first and second aspects above.

[0030] According to a seventh aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are configured to cause the computer to perform the methods described in the first and second aspects above.

[0031] According to an eighth aspect of this disclosure, a computer program product is provided, comprising a computer program, wherein the computer program, when executed by a processor, implements the steps of the methods described in the first and second aspects.

[0032] The technology disclosed herein enables real-time identification of abnormal traffic with high accuracy, high recall, and low false positives. This disclosure reduces the cost of manual rule maintenance through end-to-end automation, and the short model inference time meets real-time risk control requirements.

[0033] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0034] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0035] Figure 1 This is a flowchart of an abnormal traffic detection method based on time-series features provided in an embodiment of this disclosure;

[0036] Figure 2This is a flowchart of an abnormal traffic detection method based on time-series features provided in an embodiment of this disclosure;

[0037] Figure 3 This is a schematic diagram of the internal processing of the timing model provided in the embodiments of this disclosure;

[0038] Figure 4 This is a flowchart of an abnormal traffic detection method based on time-series features provided in an embodiment of this disclosure;

[0039] Figure 5 This is a flowchart of the time series model training method provided in the embodiments of this disclosure;

[0040] Figure 6 This is a block diagram of an abnormal traffic detection device based on time-series characteristics provided in an embodiment of this disclosure;

[0041] Figure 7 This is a block diagram of an abnormal traffic detection device based on time-series characteristics provided in an embodiment of this disclosure;

[0042] Figure 8 This is a block diagram of the time series model training apparatus provided in the embodiments of this disclosure;

[0043] Figure 9 This is a block diagram of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0044] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0045] This disclosure is not exhaustive, but merely illustrative of some embodiments, and is not intended to limit the scope of protection of this disclosure. Unless otherwise specified, each step in a particular embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment can be arbitrarily interchanged. Furthermore, the optional implementation methods in a particular embodiment can be arbitrarily combined; moreover, the embodiments can be arbitrarily combined, for example, some or all steps of different embodiments can be arbitrarily combined, and a particular embodiment can be arbitrarily combined with the optional implementation methods of other embodiments.

[0046] In each of the disclosed embodiments, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions of the embodiments are consistent and can be referenced by each other. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0047] It should be noted that the collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0048] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, data stored, data displayed, etc.) and signals involved in this disclosure are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0049] It is worth noting that in the embodiments disclosed herein, certain software, components, models, and other existing solutions in the industry may be mentioned. These should be considered as exemplary, and their purpose is only to illustrate the feasibility of implementing the technical solutions disclosed herein. However, this does not mean that the applicant has used or necessarily used such solutions.

[0050] Strategies based on static rules and single-dimensional characteristics (such as IP (Internet Protocol) blacklists and whitelists, and single request frequency) in related technologies are insufficient to cope with the ever-evolving black market techniques, such as the use of high-quality proxy IP pools, dynamic changes to user IDs (UIDs), and simulation of normal user behavior. These abnormal traffic not only consume a large amount of server resources and bandwidth but may also steal core business data, disrupt normal service order, and cause economic losses.

[0051] Based on this, embodiments of this disclosure provide an abnormal traffic detection method based on temporal features. This method constructs temporal features capable of depicting the dynamic behavior profile of entities and employs a deep learning model capable of capturing long-range dependencies and focusing on key risk segments for processing. This enables high-precision, low-false-error real-time identification of abnormal traffic. This disclosure can be directly applied to risk control systems in online services such as enterprise information query platforms, and can also be extended to any internet application field that requires distinguishing between human and machine behavior, such as e-commerce platforms, social media, and online finance. For example, it can be applied to e-commerce platforms to identify bots that engage in coupon grabbing, order brushing, and scraping product information; it can be applied to social media to identify fake accounts that register in bulk, post, and scrape user data; it can be applied to online finance to identify loan application fraud, API credential stuffing, and market data scraping; and it can be applied to any internet product with API (Application Programming Interface) or Web (World Wide Web) services to prevent API abuse and ensure fair use of resources.

[0052] The present disclosure describes, with reference to the accompanying drawings, an abnormal traffic detection method, a model training method, and an apparatus based on time-series features.

[0053] It should be noted that the execution entity of the time-series-based abnormal traffic detection method in this embodiment can be a time-series-based abnormal traffic detection device. This device can be implemented in software and / or hardware and can be configured in an electronic device. For example, the electronic device can be a data center device (such as a server, switch, etc.).

[0054] Figure 1 This is a flowchart of an abnormal traffic detection method based on time-series characteristics provided in an embodiment of this disclosure. Figure 1 As shown, the abnormal traffic detection method based on time-series characteristics may include, but is not limited to, the following steps.

[0055] In step 101, traffic data generated by the entity accessing the online service is obtained.

[0056] Optionally, in embodiments of this disclosure, a user ID (UID) or IP address can be used as the basic entity (key) for identification and tracking.

[0057] In the embodiments of this disclosure, the traffic data generated by the entity accessing the online service can be obtained from the gateway. For example, the gateway corresponding to the online service acts as a traffic entry point, sending the traffic data generated by the entity accessing the online service to the electronic device, allowing the electronic device to process the traffic data to detect whether it is abnormal traffic. For example, the traffic data generated by the entity accessing the online service can be sent to the electronic device by the gateway in real time, or it can be sent to the electronic device periodically by the gateway.

[0058] In some embodiments, the traffic data generated by the aforementioned entity accessing the online service can be recorded in the form of a log stream. For example, an electronic device can receive in real time the log stream (traffic data) generated by the entity (user) accessing the online service sent by the gateway, which may include, but is not limited to, one or more of the following: IP, UID (User Identifier), URL (Uniform Resource Locator), UA (User Agent), Timestamp, etc.

[0059] In some embodiments, the online services described above may include any of the following: enterprise information query platforms, e-commerce platforms, social media, online finance, but are not limited to these. For example, the online service may be any Internet product with API or Web services.

[0060] In step 102, a sliding window is used to sample the traffic data with a preset window length and sliding step size, and feature extraction is performed on the data within the sampling window to obtain the temporal feature matrix of the entity. The temporal feature matrix has a length of N and a feature dimension of M, where N is the data in the sampling window and M is an integer greater than 1.

[0061] In the embodiments of this disclosure, the preset window length and sliding step size can be determined based on actual conditions. For example, the preset window length can be 1 minute and the sliding step size can be 1 minute, but it is not limited to this.

[0062] In some embodiments, a stream processing engine can be used to perform sliding sampling on the collected traffic data using a sliding window, and independently calculate N-dimensional features within the sampling window to transform an entity into a time-series feature matrix (N×M) of length N and feature dimension M. This stream processing engine can be, for example, the Flink or Spark Streaming engine. For instance, the stream processing engine is invoked, and a sliding window with a preset window length and sliding step size is used to perform sliding sampling on the traffic data generated by the entity accessing the online service.

[0063] For example, the traffic data is slid across time windows of 1 minute each, with a step size of 1 minute. For each entity, the traffic data of that entity is sampled using the sliding window. 60 windows (1 hour) are continuously captured, and M-dimensional features are independently calculated within each sampling window. This allows the entity to be transformed into a time-series feature matrix with a length of 60 and a feature dimension of M.

[0064] In the embodiments of this disclosure, the determination of the number of dimensions of the aforementioned M-dimensional feature mainly considers the deduplication of various identifiers in all situations, including UA requests, URI (Uniform Resource Identifier) ​​requests, etc., the request volume and proportion of various sub-features, as well as the statistical values ​​of specific sequences, information entropy features, etc., which can characterize the risk profile of an entity from multiple perspectives within a sliding time window. For example, the M-dimensional feature can be a 75-dimensional feature, but it is not limited to this and can be determined according to the actual situation of the application scenario.

[0065] In step 103, a pre-trained time series model is used to predict the time series feature matrix to obtain the predicted probability that the traffic generated by the entity accessing the online service is abnormal traffic.

[0066] In the embodiments of this disclosure, the temporal feature matrix of an entity can be input into a pre-trained temporal model for prediction. The temporal model can output a risk probability value, which can be used as the predicted probability that the traffic generated by the entity accessing the online service is abnormal traffic.

[0067] In the embodiments of this disclosure, the input to the time series model includes a time series feature matrix, and the model output includes a risk probability (also called a risk score). The time series model can be pre-trained based on training samples, which can include normal traffic data as positive samples and abnormal traffic data as negative samples. The positive samples can be traffic data not detected by any existing risk control strategies; the negative samples can be traffic data explicitly identified as abnormal by existing risk control strategies. Optionally, to maintain sample balance and representativeness of the time distribution, positive and negative samples can be extracted from different dates and time periods (e.g., 0-6 AM, 6-12 PM, etc.) at a certain ratio (e.g., 4:1), ensuring that the model can learn normal and abnormal patterns at different times. The implementation method for training the time series model can be found in the description of subsequent embodiments, and will not be repeated here.

[0068] In the above embodiments, by constructing temporal features capable of depicting the dynamic behavior profile of entities, and processing them using a deep learning model that can capture long-range dependencies and focus on key risk segments, high-precision, high-recall, and low-false-judgment real-time identification of abnormal traffic can be achieved. This disclosure reduces the cost of manual rule maintenance through end-to-end automated processes, and the short model inference time can meet real-time risk control requirements.

[0069] Figure 2 This is a flowchart of an abnormal traffic detection method based on time-series characteristics provided in an embodiment of this disclosure. Figure 2 As shown, the abnormal traffic detection method based on time-series characteristics may include, but is not limited to, the following steps.

[0070] In step 201, traffic data generated by the entity accessing the online service is obtained.

[0071] Optionally, step 201 can be implemented using any of the implementation methods in the various embodiments of this disclosure. This disclosure does not limit this implementation and will not elaborate further.

[0072] In step 202, a sliding window with a preset window length and sliding step size is used to perform sliding sampling on the flow data.

[0073] In the embodiments of this disclosure, the preset window length and sliding step size can be determined based on actual conditions. For example, the preset window length can be 1 minute and the sliding step size can be 1 minute, but it is not limited to this.

[0074] In some embodiments, a stream processing engine can be used to perform sliding sampling on the collected traffic data using a sliding window, and independently calculate N-dimensional features within the sampling window to transform an entity into a time-series feature matrix (N×M) of length N and feature dimension M. This stream processing engine can be, for example, the Flink or Spark Streaming engine. For instance, the stream processing engine is invoked, and a sliding window with a preset window length and sliding step size is used to perform sliding sampling on the traffic data generated by the entity accessing the online service.

[0075] In step 203, for each sampling window, multi-dimensional behavioral features of the entity under multiple feature categories are extracted from the data within the sampling window, which are used as M-dimensional features calculated independently within the sampling window.

[0076] In some embodiments, the aforementioned multiple feature categories may include, but are not limited to: dispersion features, total quantity and ratio features, statistical features, and information entropy features. The dispersion feature may include the number of duplicate identifiers of various types in the traffic data, which can be used to quantify the diversity of various identifiers. The total quantity and ratio feature may include the total request volume and the request volume and proportion of various sub-features, which can be used to quantify the activity and behavioral tendencies of entities. The statistical feature may include statistical values ​​of a specific sequence, which can be used to quantify the stability and consistency of behavior. The information entropy feature may include request entropy, which can be used to quantify the regularity of an entity's request behavior.

[0077] For example, under the dispersed feature category, the number of duplicates of various identifiers within the sampling window can be counted, such as ua_cnt (number of User-Agent types), url_cnt (number of access URL types), and ja3_cnt (number of JA3 fingerprint types), to quantify the diversity of various identifiers. Abnormal clients often exhibit abnormal diversity in these identifiers due to automated tools or virtual environments. Under the total quantity and ratio feature category, the total number of requests (req) within the sampling window, as well as the request quantity and proportion of various sub-features, can be counted, such as python_req (suspected crawler requests), nologin_req (not logged in requests), and specific website platform account id_lt_2h_req (requests using short-lived specific website platform account IDs). These features reflect the activity level and behavioral tendencies of entities. Under the statistical feature category, statistical values ​​for specific sequences can be calculated, such as `req_ua_avg` (average number of requests per User Agent), `req_uri_path_std` (standard deviation of the number of access paths), and `online_time_std` (standard deviation of the request time interval), to quantify the stability and consistency of behavior. Machine behavior typically exhibits low variance and high consistency. Under the information entropy feature category, values ​​such as `req_ua_entropy` (User Agent request entropy) and `req_uri_entropy` (URI request entropy) can be calculated. Higher entropy values ​​indicate more random and human-like behavior; excessively low entropy values ​​may indicate a regular automated script.

[0078] In the embodiments of this disclosure, for each entity, N sampling windows can be continuously captured, and the above-mentioned M-dimensional features can be independently calculated in each sampling window (i.e., one sampling window corresponds to one M-dimensional feature). The M-dimensional features of each sampling window can extract the multi-dimensional behavioral features of the entity under multiple feature categories from the data in the corresponding sampling window.

[0079] In step 204, the M-dimensional features of the N sampling windows are combined to obtain the temporal feature matrix of the entity.

[0080] For example, by combining the M-dimensional features of N sampling windows, an entity can be transformed into a temporal feature matrix of length N and feature dimension M.

[0081] In step 205, a pre-trained time series model is used to predict the time series feature matrix to obtain the predicted probability that the traffic generated by the entity accessing the online service is abnormal traffic.

[0082] In some embodiments, based on the window number distribution, the M-dimensional features of the first n sampling windows are extracted from the temporal feature matrix as model input; n is a positive integer less than or equal to N; the M-dimensional features of the first n sampling windows are input into the temporal model for prediction. For example, based on the window number distribution, the temporal features (e.g., 30×75) of the first n windows (e.g., 30) are extracted from a temporal feature matrix of length N and feature dimension M as the final input to the model, which can effectively handle the differences in the active duration of different entities.

[0083] In some embodiments, the above-mentioned temporal model may include at least one of the following: a temporal model based on a long short-term memory network (LSTM) and attention mechanism; a Transformer model; or a long short-term memory network (LSTM) model.

[0084] Optionally, in embodiments of this disclosure, the temporal model can be a temporal model based on a Long Short-Term Memory (LSTM) network and an attention mechanism. For example, this temporal model based on LSTM and an attention mechanism can be a deep learning model combining LSTM and Attention. This temporal model may include, but is not limited to, an LSTM layer, an Attention layer, and an output layer. The LSTM layer receives a temporal feature matrix as input. LSTM units can effectively capture long-range dependencies in the sequence, memorize and transmit historical information, and understand the evolution of behavioral patterns. The Attention layer can be connected after the LSTM layer. The core function of the Attention layer is to allow the model to automatically learn and assign different weights to different time windows. For example, the model can learn to pay more attention to an entity's "exploratory" behavior in the early stages of a session (the first few windows) or abnormal bursts of behavior at a specific time point, rather than treating all time windows equally. This solves the problem of different importance of sample windows and significantly improves the model's ability to perceive key risk segments. The output layer includes a fully connected layer and a Softmax function, which outputs the predicted probability that an entity is an abnormal flow.

[0085] In one possible implementation, the temporal feature matrix of an entity can be input into a temporal model based on a long short-term memory network and an attention mechanism. The long short-term memory network layer in the temporal model processes the input sequence step by step and outputs the hidden state at each time step. The attention layer in the temporal model calculates the weights for the hidden state at each time step. The weighted output layer in the temporal model multiplies the hidden state at each time step with the corresponding weight and sums them to obtain a context vector that integrates key information. The context vector outputs a risk probability value through a fully connected layer. The risk probability value output by the temporal model is obtained as the predicted probability that the traffic generated by the entity accessing the online service is abnormal traffic.

[0086] For example, such as Figure 3 As shown, taking the aforementioned 30×75 temporal feature matrix as the model input as an example, a temporal feature matrix with a length of 30 and a feature dimension of 75 (i.e., 75-dimensional features across 30 time steps) can be input into the temporal model. The LSTM layer in this temporal model processes the input sequence step by step, outputting the hidden state (h1~h30) for each time step to capture the dependencies between behaviors. For example, the hidden state for each time step can be calculated by determining the similarity between the temporal feature matrices of different time steps, serving as the hidden state vector for that time step. The Attention layer calculates a weight (a1~a30) for the hidden state of each time step in the LSTM layer, where the weight represents the importance of the behavior at that moment. The weighted output layer multiplies all weights by the corresponding hidden state and sums them to obtain a context vector that condenses key information. The context vector is then passed through a fully connected layer to output a risk probability value between 0 and 1, which is used as the predicted probability that the entity's traffic generated from accessing the online service is abnormal traffic.

[0087] To further improve efficiency, batch detection can be performed through batch processing tasks. Optionally, in some embodiments, batch processing tasks can be triggered at preset time intervals to retrieve the temporal feature matrices of each entity within that preset time interval from a time-series database, and then call the time-series model for batch detection; wherein, the time-series database can be used to store the temporal feature matrices of entities. For example, traffic data generated by entities accessing online services sent by the gateway can be received in real time, and M-dimensional features can be calculated in real time with a sliding window of a preset window length (e.g., 1 minute), and the minute-level feature sequences of all entities can be stored in the time-series database. Batch processing tasks are triggered at preset time intervals (e.g., 1 hour) to retrieve the temporal feature matrices of each entity within that preset time interval from the time-series database, and input into the time-series model for abnormal traffic detection. Thus, this disclosure reduces the cost of manual rule maintenance through end-to-end automated processes, ensures the timeliness of intelligence through hourly update frequencies, and meets the real-time risk control requirements through short model inference time.

[0088] In the above embodiments, by deeply mining behavioral time-series patterns, it is possible to effectively identify advanced black market activities that use high-quality IP pools and dynamically change identifiers, which can improve strong adversarial capabilities and further improve the accuracy and recall rate of abnormal traffic detection.

[0089] In some embodiments, based on any of the above embodiments, such as Figure 4 As shown, the abnormal traffic detection method based on time-series characteristics may include, but is not limited to, the following steps.

[0090] In step 401, traffic data generated by the entity accessing the online service is obtained.

[0091] Optionally, step 401 can be implemented using any of the implementation methods in the various embodiments of this disclosure. This disclosure does not limit this implementation and will not elaborate further.

[0092] In step 402, a sliding window with a preset window length and sliding step size is used to perform sliding sampling on the traffic data, and feature extraction is performed on the data within the sampling window to obtain the temporal feature matrix of the entity. The temporal feature matrix has a length of N and a feature dimension of M, where N is the data in the sampling window and M is an integer greater than 1.

[0093] Optionally, step 402 can be implemented using any of the implementation methods in the various embodiments of this disclosure. This disclosure does not limit this implementation and will not elaborate further.

[0094] In step 403, a pre-trained time series model is used to predict the time series feature matrix to obtain the predicted probability that the traffic generated by the entity accessing the online service is abnormal traffic.

[0095] Optionally, step 403 can be implemented using any of the implementation methods in the various embodiments of this disclosure. This disclosure does not limit this implementation and will not elaborate further.

[0096] In step 404, the predicted probability is combined with the threshold and exemption conditions to generate a risk list.

[0097] In the embodiments of this disclosure, the predicted probability that the traffic generated by the entity accessing the online service is abnormal traffic can be combined with a set risk threshold and exemption conditions. For example, the predicted probability can be compared with the risk threshold. If the predicted probability is less than the risk threshold, the entity's traffic can be considered normal traffic; if the predicted probability is greater than or equal to the risk threshold, the entity's traffic can be considered suspected abnormal traffic. Exemption conditions can be combined to determine whether the entity's traffic is abnormal traffic. For example, if the entity does not meet the exemption conditions, the entity's traffic can be considered abnormal traffic; if the entity meets the exemption conditions, the entity's traffic can be considered normal traffic. The exemption conditions can be determined according to the actual situation. For example, the exemption conditions may include whether it is accompanied by successful login behavior, but are not limited to this, and are not specifically limited here.

[0098] In embodiments of this disclosure, if an entity's traffic is identified as abnormal, the entity's identifier (such as IP and / or UID) can be added to a risk list.

[0099] In step 405, the risk list is sent to the cache so that the gateway or risk control engine can intercept and process the hit requests.

[0100] In the embodiments of this disclosure, the risk list can be synchronized to a cache (such as Redis). When processing each incoming request (an HTTP request from a client (such as a browser), the gateway or risk control engine can query the risk list in the cache in real time and perform interception operations such as CAPTCHA challenge, rate limiting, or direct rejection on the matching requests.

[0101] In the above embodiments, by combining the predicted probability that traffic generated by an entity accessing online services is abnormal traffic with thresholds and exemption conditions, a risk list is generated and sent to a cache for the gateway or risk control engine to intercept the hit requests. This allows for decision-making and interception of abnormal traffic, avoiding risks such as abnormal traffic consuming server resources and bandwidth.

[0102] Figure 5 This is a flowchart of a time-series model training method provided in this embodiment. It should be noted that the execution entity of the time-series model training method in this embodiment can be a time-series model training device, which can be implemented by software and / or hardware and can be configured in an electronic device. For example, the electronic device can be a data center device (such as a server, switch, etc.). It should also be noted that the time-series model can be used to implement the time-series feature-based abnormal traffic detection method in any of the above method embodiments.

[0103] like Figure 5As shown, the time series model training method may include, but is not limited to, the following steps.

[0104] In step 501, training samples are obtained.

[0105] In embodiments of this disclosure, the training samples may include normal traffic data as positive samples and abnormal traffic data as negative samples. The positive samples may be traffic not detected by any existing risk control strategies; the negative samples may be traffic explicitly identified as abnormal by existing risk control strategies. Optionally, to maintain sample balance and representativeness of the time distribution, positive and negative samples can be extracted from different dates and time periods (e.g., 0-6 AM, 6-12 PM, etc.) at a certain ratio (e.g., 4:1), ensuring that the model can learn normal and abnormal patterns at different times. The implementation method for training the time-series model can be found in the description of subsequent embodiments, and will not be repeated here.

[0106] In step 502, a sliding window is used to perform sliding sampling on the training samples with a preset window length and sliding step size, and feature extraction is performed on the data within the sampling window to obtain the temporal feature matrix of the training samples. The temporal feature matrix has a length of N and a feature dimension of M, where N is the data in the sampling window and M is an integer greater than 1.

[0107] In some embodiments, for each sampling window, multi-dimensional behavioral features of the training samples under multiple feature categories can be extracted from the data within the sampling window as M-dimensional features independently calculated within the sampling window; the M-dimensional features of N sampling windows are combined to obtain the temporal feature matrix of the training samples.

[0108] These multiple feature categories can include at least: dispersion features, total quantity and ratio features, statistical features, and information entropy features. Dispersion features include the number of duplicate identifiers in the traffic data, used to quantify the diversity of different identifiers; total quantity and ratio features include the total request volume and the request volume and proportion of each sub-feature, used to quantify the activity and behavioral tendencies of entities; statistical features include statistical values ​​of specific sequences, used to quantify the stability and consistency of behavior; and information entropy features include request entropy, used to quantify the regularity of entity request behavior.

[0109] The optional implementation of step 502 is similar to that of step 102 above, and can be found in the description of step 102 above, which will not be repeated here.

[0110] In step 503, the time series feature matrix is ​​input into the time series model for prediction to obtain the predicted probability that the training sample is abnormal traffic.

[0111] In some embodiments, the M-dimensional features of the first n sampling windows can be extracted from the temporal feature matrix as model input based on the window number distribution; n is a positive integer less than or equal to N; the M-dimensional features of the first n sampling windows are input into the temporal model for prediction.

[0112] In some embodiments, the temporal model includes at least one of the following: a temporal model based on long short-term memory networks and attention mechanisms; a Transformer model; or a long short-term memory network model.

[0113] In some embodiments, the temporal model may include a temporal model based on a long short-term memory network and an attention mechanism. In embodiments of this disclosure, the optional implementation of inputting the temporal feature matrix into the temporal model for prediction to obtain the predicted probability that the training sample is abnormal traffic includes: inputting the temporal feature matrix into a temporal model based on a long short-term memory network and an attention mechanism; the long short-term memory network layer in the temporal model processes the input sequence step by step, outputting the hidden state at each time step; the attention layer in the temporal model calculates weights for the hidden state at each time step; the weighted output layer in the temporal model multiplies the hidden state at each time step with the corresponding weights and sums them to obtain a context vector that integrates key information; the context vector outputs a risk probability value through a fully connected layer; and the risk probability value output by the temporal model is obtained as the predicted probability that the training sample is abnormal traffic.

[0114] In step 504, the model loss value is determined based on the predicted probability of the training samples and the true labeled value of the training samples, and the time series model is trained according to the model loss value.

[0115] For example, the cross-entropy loss function can be used to calculate the loss between the predicted probability of the training sample and the true labeled value of the training sample, which is used as the model loss value. The model parameters are then optimized using the backpropagation algorithm with the goal of minimizing the cross-entropy loss between the predicted label and the true label.

[0116] Optionally, in some embodiments, the trained time-series model can be deployed on a model server (such as TensorFlow Serving). It can run batch processing of data from all active entities over the past hour on an hourly basis, extract features, and input these features into the trained model for inference, obtaining a risk score for each entity, thus achieving hourly offline inference.

[0117] Figure 6 This is a block diagram of an abnormal traffic detection device based on time-series characteristics provided in an embodiment of this disclosure. Figure 6 As shown, the abnormal traffic detection device based on time-series features may include: an acquisition module 601, a sampling module 602, a feature extraction module 603, and a prediction module 604.

[0118] The acquisition module 601 is used to acquire traffic data generated by entities accessing online services.

[0119] The sampling module 602 is used to perform sliding sampling of traffic data using a sliding window with a preset window length and sliding step size.

[0120] The feature extraction module 603 is used to extract features from the data within the sampling window to obtain the temporal feature matrix of the entity. The temporal feature matrix has a length of N and a feature dimension of M, where N is the data in the sampling window and M is an integer greater than 1.

[0121] The prediction module 604 is used to predict the time series feature matrix using a pre-trained time series model to obtain the predicted probability that the traffic generated by an entity accessing the online service is abnormal traffic.

[0122] In some embodiments, the feature extraction module 603 is used to: for each sampling window, extract multi-dimensional behavioral features of the entity under multiple feature categories from the data within the sampling window, as M-dimensional features independently calculated within the sampling window; and combine the M-dimensional features of N sampling windows to obtain the temporal feature matrix of the entity.

[0123] In some embodiments, the multiple feature categories include at least: dispersion features, total quantity and ratio features, statistical features, and information entropy features; wherein, dispersion features include the number of duplicate identifiers of various types in traffic data, used to quantify the diversity of various identifiers; total quantity and ratio features include the total number of requests and the number and proportion of requests of various sub-features, used to quantify the activity and behavioral tendencies of entities; statistical features include statistical values ​​of specific sequences, used to quantify the stability and consistency of behavior; and information entropy features include request entropy, used to quantify the regularity of the request behavior of entities.

[0124] In some embodiments, the prediction module 604 is used to: extract the M-dimensional features of the first n sampling windows from the temporal feature matrix as model input according to the window number distribution; n is a positive integer less than or equal to N; and input the extracted M-dimensional features of the first n sampling windows into the temporal model for prediction.

[0125] In some embodiments, the temporal model includes at least one of the following: a temporal model based on long short-term memory networks and attention mechanisms; a Transformer model; or a long short-term memory network model.

[0126] In some embodiments, the temporal model includes a temporal model based on a long short-term memory network and an attention mechanism; the prediction module 604 is used to: input the temporal feature matrix into the temporal model based on the long short-term memory network and the attention mechanism; the long short-term memory network layer in the temporal model processes the input sequence step by step, outputs the hidden state at each time step, the attention layer in the temporal model calculates the weights for the hidden state at each time step, the weighted output layer in the temporal model multiplies the hidden state at each time step with the corresponding weights and sums them to obtain a context vector that integrates key information, and the context vector outputs a risk probability value through a fully connected layer; the risk probability value output by the temporal model is obtained as the predicted probability that the traffic generated by the entity accessing the online service is abnormal traffic.

[0127] In some embodiments, the prediction module 604 is further configured to: trigger a batch processing task at preset intervals, obtain the temporal feature matrix of each entity within a preset time period from the time series database, and call the time series model for batch detection; wherein, the time series database is used to store the temporal feature matrix of the entity.

[0128] In some embodiments, such as Figure 7 As shown, the time-series-based abnormal traffic detection device may further include a generation module 705 and a sending module 706. The generation module 705 is used to: combine the predicted probability with a threshold and exemption conditions to generate a risk list. The sending module 706 is used to: send the risk list to a cache for the gateway or risk control engine to intercept and process the matched requests. Figure 7 701-704 and Figure 6 The 601-604 series have the same function and structure.

[0129] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0130] Figure 8 This is a block diagram of the time series model training apparatus provided in the embodiments of this disclosure. Figure 8 As shown, the time series model training device may include: an acquisition module 801, a feature extraction module 802, a prediction module 803, and a training module 804.

[0131] The acquisition module 801 is used to acquire training samples, which include normal traffic data as positive samples and abnormal traffic data as negative samples.

[0132] The feature extraction module 802 is used to perform sliding sampling of training samples using a sliding window with a preset window length and sliding step size, and to extract features from the data within the sampling window to obtain the temporal feature matrix of the training samples. The temporal feature matrix has a length of N and a feature dimension of M, where N is the data in the sampling window and M is an integer greater than 1.

[0133] The prediction module 803 is used to input the time series feature matrix into the time series model for prediction, and obtain the predicted probability that the training sample is abnormal traffic.

[0134] Training module 804 is used to determine the model loss value based on the predicted probability of the training samples and the true labeled value of the training samples, and to train the time series model based on the model loss value.

[0135] In some embodiments, the feature extraction module 802 is used to: for each sampling window, extract multi-dimensional behavioral features of the training samples under multiple feature categories from the data within the sampling window, as M-dimensional features independently calculated within the sampling window; and combine the M-dimensional features of N sampling windows to obtain the temporal feature matrix of the training samples.

[0136] In some embodiments, the multiple feature categories include at least: dispersion features, total quantity and ratio features, statistical features, and information entropy features; wherein, dispersion features include the number of duplicate identifiers of various types in traffic data, used to quantify the diversity of various identifiers; total quantity and ratio features include the total number of requests and the number and proportion of requests of various sub-features, used to quantify the activity and behavioral tendencies of entities; statistical features include statistical values ​​of specific sequences, used to quantify the stability and consistency of behavior; and information entropy features include request entropy, used to quantify the regularity of the request behavior of entities.

[0137] In some embodiments, the prediction module 803 is used to: extract the M-dimensional features of the first n sampling windows from the temporal feature matrix as model input according to the window number distribution; n is a positive integer less than or equal to N; and input the extracted M-dimensional features of the first n sampling windows into the temporal model for prediction.

[0138] In some embodiments, the temporal model includes at least one of the following: a temporal model based on long short-term memory networks and attention mechanisms; a Transformer model; or a long short-term memory network model.

[0139] In some embodiments, the temporal model includes a temporal model based on a long short-term memory network and an attention mechanism; the prediction module 803 is used to: input the temporal feature matrix into the temporal model based on the long short-term memory network and the attention mechanism; the long short-term memory network layer in the temporal model processes the input sequence step by step, outputs the hidden state at each time step, the attention layer in the temporal model calculates the weights for the hidden state at each time step, the weighted output layer in the temporal model multiplies the hidden state at each time step with the corresponding weights and sums them to obtain a context vector that integrates key information, and the context vector outputs a risk probability value through a fully connected layer; the risk probability value output by the temporal model is obtained as the prediction probability of abnormal traffic for training samples.

[0140] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0141] According to embodiments of this disclosure, this disclosure also provides an electronic device and a readable storage medium.

[0142] like Figure 9 The diagram shown is a block diagram of an electronic device according to an embodiment of the present disclosure. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein. Exemplarily, the electronic device may be a data center device (such as a server, switch, etc.).

[0143] like Figure 9 As shown, the electronic device includes one or more processors 901, a memory 902, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components are interconnected via different buses and can be mounted on a common motherboard or otherwise as required. The processors can process instructions executed within the electronic device, including instructions stored in or on memory to display graphical information of a GUI on an external input / output device (such as a display device coupled to the interface). In other embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple electronic devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 9Take the 901 processor as an example.

[0144] The memory 902 is the non-transitory computer-readable storage medium provided in this disclosure. The memory stores instructions executable by at least one processor to cause the at least one processor to perform the time-series feature-based abnormal traffic detection method or time-series model training method provided in this disclosure. The non-transitory computer-readable storage medium of this disclosure stores computer instructions for causing a computer to perform the time-series feature-based abnormal traffic detection method or time-series model training method provided in this disclosure.

[0145] Memory 902, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the time-series feature-based abnormal traffic detection method or time-series model training method in the embodiments of this disclosure (e.g., attached...). Figure 6 The acquisition module 601, sampling module 602, feature extraction module 603, and prediction module 604 shown are attached. Figure 7 The module shown comprises an acquisition module 701, a sampling module 702, a feature extraction module 703, a prediction module 704, a generation module 705, and a sending module 706. Figure 8 The acquisition module 801, feature extraction module 802, prediction module 803, and training module 804 are shown. The processor 901 executes various server functions and data processing by running non-transient software programs, instructions, and modules stored in the memory 902, thereby implementing the abnormal traffic detection method or time-series model training method based on time-series features in the above method embodiments.

[0146] The memory 902 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device. Furthermore, the memory 902 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 902 may optionally include memory remotely located relative to the processor 901, and these remote memories can be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0147] The electronic device may also include an input device 903 and an output device 904. The processor 901, memory 902, input device 903, and output device 904 can be connected via a bus or other means. Figure 9 Taking the example of a connection between China and Israel via a bus.

[0148] Input device 903 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the electronic device, such as touch screens, keypads, mice, trackpads, touchpads, joysticks, one or more mouse buttons, trackballs, joysticks, etc. Output device 904 may include display devices, auxiliary lighting devices (e.g., LEDs), and haptic feedback devices (e.g., vibration motors). The display device may include, but is not limited to, liquid crystal displays (LCDs), light-emitting diode (LED) displays, and plasma displays. In some embodiments, the display device may be a touch screen.

[0149] Various implementations of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, application-specific integrated circuits (ASICs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transferring data and instructions to the storage system, the at least one input device, and the at least one output device.

[0150] These computational programs (also referred to as programs, software, software applications, or code) include machine instructions for a programmable processor and can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. As used herein, the terms “machine-readable medium” and “computer-readable medium” refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device (PLD)) used to provide machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term “machine-readable signal” refers to any signal used to provide machine instructions and / or data to a programmable processor.

[0151] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0152] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), the Internet, and blockchain networks.

[0153] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service ecosystem, addressing the shortcomings of traditional physical hosts and VPS (Virtual Private Server) services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0154] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0155] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for detecting abnormal traffic based on time series features, comprising: obtaining traffic data generated by an entity accessing an online service; using a sliding window with a preset window length and a sliding step to perform sliding sampling on the traffic data, and performing feature extraction on the data in the sampling window to obtain a time series feature matrix of the entity, the time series feature matrix having a length N and a feature dimension M, the N being the data in the sampling window, and the M being an integer greater than 1; using a pre-trained time series model to perform prediction on the time series feature matrix to obtain a prediction probability that the traffic generated by the entity accessing the online service is abnormal traffic.

2. The method of claim 1, wherein, The feature extraction on the data in the sampling window to obtain the time series feature matrix of the entity comprises: For each sampling window, multi-dimensional behavior features of the entity under multiple feature categories are extracted from the data in the sampling window as M-dimensional features independently calculated in the sampling window; The M-dimensional features of the N sampling windows are combined to obtain the time series feature matrix of the entity.

3. The method of claim 2, wherein, The multiple feature categories at least include: dispersion feature, total amount and ratio feature, statistical feature, and information entropy feature; wherein The dispersion feature includes the number of unique types of identifiers in the traffic data, for quantifying the diversity of the types of identifiers; The total amount and ratio feature includes the total request amount and the request amount and proportion of each sub-feature, for quantifying the activity and behavior tendency of the entity; The statistical feature includes statistical values of specific sequences, for quantifying the stability and consistency of behavior; The information entropy feature includes request entropy, for quantifying the regularity of the request behavior of the entity.

4. The method of claim 1, wherein, The prediction on the time series feature matrix using the pre-trained time series model comprises: According to the window number distribution, M-dimensional features of the first n sampling windows are intercepted from the time series feature matrix as model input; the n is a positive integer less than or equal to the N; The M-dimensional features of the first n sampling windows are input into the time series model for prediction.

5. The method of claim 1, wherein, The time series model at least includes any one of the following: a time series model based on long short-term memory network and attention mechanism; a Transformer model; a long short-term memory network model.

6. The method of claim 5, wherein, The time series model includes the time series model based on long short-term memory network and attention mechanism; The prediction on the time series feature matrix using the pre-trained time series model to obtain the prediction probability that the traffic generated by the entity accessing the online service is abnormal traffic comprises: The time series feature matrix is input into the time series model based on long short-term memory network and attention mechanism; a long short-term memory network layer in the time series model processes the input sequence step by step, outputs the hidden state of each time step, an attention layer in the time series model calculates the weight for the hidden state of each time step, a weighted output layer in the time series model multiplies the hidden state of each time step by the corresponding weight and sums them up to obtain a context vector that fuses key information, and the context vector outputs a risk probability value through a fully connected layer. Obtain the risk probability value of the time series model output as a predicted probability that the traffic generated by the entity accessing the online service is abnormal traffic.

7. The method of claim 1, further comprising: triggering a batch task every preset time, obtaining the time series feature matrix of each entity within the preset time from the time series database, and calling the time series model for batch detection; wherein the time series database is used to store the time series feature matrix of the entity.

8. The method of any one of claims 1-7, further comprising: combining the predicted probability with a threshold value and an exemption condition to generate a risk list; sending the risk list to the cache for interception and processing of the hit request by the gateway or the risk control engine.

9. A method of training a temporal model, wherein, The time series model is used to implement the time series feature-based abnormal traffic detection method of any one of claims 1 to 8, and the training method comprises: obtaining training samples, the training samples including normal traffic data as positive samples and abnormal traffic data as negative samples; using a sliding window with a preset window length and a sliding step to perform sliding sampling on the training samples, and performing feature extraction on the data in the sampling window to obtain a time series feature matrix of the training samples, the time series feature matrix having a length N and a feature dimension M, the N being the data in the sampling window, and the M being an integer greater than 1; inputting the time series feature matrix into a time series model for prediction to obtain a predicted probability that the training sample is abnormal traffic; determining a model loss value based on the training sample predicted probability and the true label value of the training sample, and training the time series model according to the model loss value.

10. The method of claim 9, wherein, The feature extraction on the data in the sampling window to obtain the time series feature matrix of the training sample comprises: for each sampling window, extracting multi-dimensional behavior features of the training sample under multiple feature categories from the data in the sampling window as M-dimensional features independently calculated in the sampling window; combining the M-dimensional features of the N sampling windows to obtain the time series feature matrix of the training sample.

11. The method of claim 10, wherein, The multiple feature categories at least include: dispersion feature, total amount and ratio feature, statistical feature, and information entropy feature; wherein the dispersion feature includes the number of de-duplication of each type of identifier in the traffic data, for quantifying the diversity of the types of identifiers; the total amount and ratio feature includes the total request amount and the request amount and proportion of each sub-feature, for quantifying the activity and behavior tendency of the entity; the statistical feature includes the statistical value of a specific sequence, for quantifying the stability and consistency of the behavior; the information entropy feature includes request entropy, for quantifying the regularity of the request behavior of the entity.

12. The method of claim 9, wherein, The inputting of the time series feature matrix into the time series model for prediction comprises: according to the window number distribution, extracting the M-dimensional features of the first n sampling windows from the time series feature matrix as model input; the n being a positive integer less than or equal to the N; inputting the extracted M-dimensional features of the first n sampling windows into the time series model for prediction.

13. The method of any one of claims 9 to 12, wherein, The time sequence model comprises the time sequence model based on the long short-term memory network and the attention mechanism.

14. The method of claim 13, wherein, The time sequence model comprises the time sequence model based on the long short-term memory network and the attention mechanism. The time sequence model comprises the time sequence model based on the long short-term memory network and the attention mechanism. The time sequence model comprises the time sequence model based on the long short-term memory network and the attention mechanism. The time sequence model comprises the time sequence model based on the long short-term memory network and the attention mechanism. The time sequence model comprises the time sequence model based on the long short-term memory network and the attention mechanism.

15. An abnormal traffic detection device based on time sequence features, comprising: An acquisition module configured to acquire traffic data generated by an entity accessing an online service; A sampling module configured to sample the traffic data by using a sliding window with a preset window length and a sliding step; A feature extraction module configured to extract features of data in the sampling window to obtain a time sequence feature matrix of the entity, the time sequence feature matrix having a length of N and a feature dimension of M, the N being data of the sampling window, and the M being an integer greater than 1; 16. A timing model training apparatus, wherein, A prediction module configured to predict the time sequence feature matrix by using a pre-trained time sequence model to obtain a prediction probability of the traffic generated by the entity accessing the online service being abnormal traffic. The time sequence model is used to implement the abnormal traffic detection method based on time sequence features as claimed in any one of claims 1 to 8, and the device comprises: An acquisition module configured to acquire training samples, the training samples comprising normal traffic data as positive samples and abnormal traffic data as negative samples; A feature extraction module configured to sample the training samples by using a sliding window with a preset window length and a sliding step, and extract features of data in the sampling window to obtain a time sequence feature matrix of the training samples, the time sequence feature matrix having a length of N and a feature dimension of M, the N being data of the sampling window, and the M being an integer greater than 1; A prediction module configured to input the time sequence feature matrix into a time sequence model to obtain a prediction probability of the training samples being abnormal traffic; A training module configured to determine a model loss value based on the prediction probability of the training samples and a true label value of the training samples, and train the time sequence model according to the model loss value.

17. An abnormal traffic detection system based on time sequence features, comprising a gateway and an abnormal traffic detection device, wherein The gateway is configured to send traffic data generated by an entity accessing an online service to the abnormal traffic detection device. The abnormal traffic detection device is configured to perform the time sequence feature-based abnormal traffic detection method of any one of claims 1 to 8. 18.An electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 8, 9 to 14.

19. A non-transitory computer readable storage medium having stored thereon computer instructions, wherein, The computer instructions are for causing the computer to perform the method of any one of claims 1 to 8, 9 to 14.

20. A computer program product comprising a computer program, wherein, The computer program, when executed by a processor, implements the steps of the method of any one of claims 1 to 8, 9 to 14.

Images