IP asset abnormity monitoring and troubleshooting method, system and equipment based on flow data

Abstract

The invention provides an IP asset abnormity monitoring and troubleshooting method, system and device based on flow data in order to solve the problems that in the prior art, event-centered real-time detection only aims at a single communication behavior, neglects behavior relevance, cannot discover multi-stage hidden threats and is high in omission ratio. The invention relates to the technical field of data communication. The method comprises the following steps: acquiring current traffic data of all IP assets, and extracting traffic data characteristics of all IP assets; respectively calculating feature abnormal risk values of the traffic data features of all IP assets in each monitoring dimension; arranging the feature anomaly risk values of all the IP assets under any monitoring dimension to obtain a monitoring risk list; comparing the monitoring risk lists, and determining a host list comprising at least one IP so as to obtain a first abnormal risk set, namely suspected abnormal IPs; and performing feature analysis on the suspected abnormal IPs to obtain a second abnormal risk set, namely identified abnormal IPs.

Description

Technical Field

[0001] This invention relates to the field of data communication technology, and in particular to a method, system and device for monitoring and investigating IP asset anomalies based on traffic data. Background Technology

[0002] IP asset anomaly detection technology is a core security technology for monitoring and analyzing the network behavior of assets with unique IP addresses (such as servers, terminal devices, network devices, etc.) in an enterprise or organization's network. It collects traffic data of IP assets (including communication volume, rate, connection objects, active periods, etc.) to identify behaviors that deviate from the normal operating baseline of the device (such as sudden large amounts of data uploads, high-frequency external communication during non-working hours, and establishing connections with unknown suspicious IPs, etc.), thereby providing early warnings of risks such as network attacks, data leaks, and device failures.

[0003] However, with the upgrading of network attack techniques and the frequent occurrence of complex attacks such as APTs, existing IP asset anomaly detection technologies have obvious shortcomings: event-centric real-time detection only targets single communication behaviors, ignores behavioral correlations, cannot detect multi-stage hidden threats, and has a high false negative rate. Summary of the Invention

[0004] To address the problems of existing event-centric real-time detection technologies that only target single communication behaviors, ignore behavioral correlations, fail to detect multi-stage hidden threats, and have a high false negative rate, this invention provides a method, system, and device for IP asset anomaly monitoring and investigation based on traffic data.

[0005] The technical solution adopted in this invention is: A method for monitoring and investigating IP asset anomalies based on traffic data, comprising the following steps: Step S100: Obtain the current traffic data of all IP assets and extract the traffic data features of all IP assets; Step S200: Calculate the characteristic anomaly risk value of the traffic data characteristics of all IP assets in each monitoring dimension; The monitoring dimensions include traffic size, traffic rate, traffic growth rate, and activity level. For any monitoring dimension, based on the traffic data characteristics of all IP assets under that monitoring dimension, a pre-built feature anomaly model for that monitoring dimension is used to calculate the corresponding feature anomaly risk value. Step S300: Arrange the characteristic anomaly risk values ​​of all IP assets under any monitoring dimension in ascending order to obtain a monitoring risk list under that monitoring dimension. Step S400: Compare the monitoring risk lists to determine a host list containing at least one IP, thereby obtaining a first abnormal risk set containing all IPs in the host list, i.e., suspected abnormal IPs; Step S500: Perform feature analysis on the suspected abnormal IPs to obtain a second abnormal risk set containing at least one of the suspected abnormal IPs, i.e., the identified abnormal IPs.

[0006] Furthermore, in step S200, the calculation process for the characteristic anomaly risk value of all IP assets under any monitoring dimension includes the following sub-steps: Step S210: Based on the traffic data characteristics of all IP assets under this monitoring dimension, delete the IP assets whose difference from the average traffic size is less than a preset first threshold from all IP assets to obtain a subset. Step S220: In this subset, IP assets whose difference from the average traffic rate is less than a preset second threshold are deleted to obtain an updated subset. Step S230: Determine whether the monitoring dimension is the traffic growth rate or the activity level, establish a feature anomaly model based on the updated subset under the monitoring dimension, and calculate the corresponding feature anomaly risk value.

[0007] Further, in step S230, if the monitoring dimension is the traffic growth rate, then the feature anomaly model is established based on the updated subset under the monitoring dimension, and the corresponding feature anomaly risk value is calculated, including the following sub-steps: In the updated subset, extract the non-growing IP assets under this monitoring dimension, and delete the non-growing IP assets from the updated subset to obtain another updated subset; Based on the traffic data characteristics of growing IP assets under this monitoring dimension, a growth curve model is obtained by using linear prediction technology. Based on the traffic data characteristics of each IP asset contained in the updated subset under this monitoring dimension, the growth curve fitting error of the IP asset is calculated by combining the growth curve model. For any IP asset, the characteristic anomaly risk value of the IP asset is calculated based on the fitting error of its growth curve and the minimum value of the fitting error of the growth curve of all IP assets in the updated subset under the monitoring dimension.

[0008] Further, in step S230, if the monitoring dimension is activity level, then the feature anomaly model is established based on the updated subset under the monitoring dimension, and the corresponding feature anomaly risk value is calculated, including the following sub-steps: In the updated subset, inactive IP assets under this monitoring dimension are extracted and deleted from the updated subset to obtain another updated subset; Based on the traffic data characteristics of active IP assets under this monitoring dimension, a maximum activity value curve model is obtained by using linear prediction technology. Based on the traffic data characteristics of each IP asset contained in the updated subset under this monitoring dimension, the curve fitting error of the IP asset is calculated by combining the maximum activity value curve model. For any IP asset, the characteristic anomaly risk value of the IP asset is calculated by taking the maximum value of the curve fitting error of the IP asset and the curve fitting error of all IP assets in the subset after the latest update under the monitoring dimension.

[0009] Further, in step S400, comparing the various monitoring risk lists to determine a list of hosts containing at least one IP address includes the following sub-steps: In each monitoring risk list, select the IP asset with the highest monitoring risk value and output a list of hosts containing that IP. Remove the IPs from the host list from all IP assets. Repeat this step until all IP assets have been selected for monitoring risk lists, resulting in several host lists containing at least one IP. These host lists containing at least one IP constitute the final host list.

[0010] Based on the same inventive concept, this invention also provides an IP asset anomaly monitoring and investigation system based on traffic data, which executes the aforementioned IP asset anomaly monitoring and investigation method based on traffic data. The system includes: The feature extraction module is used to obtain the current traffic data of all IP assets and extract the traffic data features of all IP assets. The feature calculation module is used to calculate the feature anomaly risk value of the traffic data features of all IP assets in each monitoring dimension. The monitoring dimensions include traffic size, traffic rate, traffic growth rate and activity level. For any monitoring dimension, based on the traffic data features of all IP assets under that monitoring dimension, the pre-built feature anomaly model of that monitoring dimension is used to calculate the corresponding feature anomaly risk value. The risk list sorting module is used to sort the characteristic abnormal risk values ​​of all IP assets under any monitoring dimension in ascending order to obtain a monitoring risk list under that monitoring dimension. The host list calculation module is used to compare various monitoring risk lists, determine a host list containing at least one IP, and thus obtain a first abnormal risk set containing all IPs in the host list, i.e., suspected abnormal IPs; The anomaly identification module is used to perform feature analysis on suspected abnormal IPs to obtain a second set of abnormal risks that includes at least one of the suspected abnormal IPs, i.e., identified abnormal IPs.

[0011] Furthermore, the feature calculation module includes: The first deletion unit is used to delete IP assets whose average traffic size difference is less than a preset first threshold from all IP assets based on the traffic data characteristics of all IP assets under the monitoring dimension, so as to obtain a subset. The second deletion unit is used to delete IP assets in the subset whose difference from the average traffic rate is less than a preset second threshold, so as to obtain an updated subset. The Feature Anomaly Model Unit is used to determine whether the monitoring dimension is traffic growth rate or activity level. It builds a feature anomaly model based on the updated subset under the monitoring dimension and calculates the corresponding feature anomaly risk value.

[0012] Furthermore, if the monitoring dimension is the traffic growth rate, then the feature anomaly model unit includes: The first extraction subunit is used to extract non-growing IP assets under the monitoring dimension in the updated subset, and delete the non-growing IP assets from the updated subset to obtain another updated subset; The first model fitting subunit is used to fit the growth curve model based on the traffic data characteristics of the growing IP assets under this monitoring dimension using linear prediction technology. The first gap calculation subunit is used to calculate the growth curve fitting error of the IP asset based on the traffic data characteristics of each IP asset contained in the updated subset under the monitoring dimension, combined with the growth curve model. The first anomaly risk value calculation subunit is used to calculate the characteristic anomaly risk value of any IP asset based on the growth curve fitting error of the IP asset and the minimum value of the growth curve fitting error of all IP assets in the subset after another update under the monitoring dimension.

[0013] Furthermore, if the monitoring dimension is activity level, then the feature anomaly model unit includes: The second extraction subunit is used to extract inactive IP assets under the monitoring dimension in the updated subset and delete the inactive IP assets from the updated subset to obtain another updated subset. The second model fitting subunit is used to fit the maximum activity value curve model based on the traffic data characteristics of active IP assets under this monitoring dimension using linear prediction technology. The second gap calculation subunit is used to calculate the curve fitting error of the IP asset based on the traffic data characteristics of each IP asset contained in the updated subset under the monitoring dimension, combined with the maximum activity value curve model. The second anomaly risk value calculation subunit is used to calculate the characteristic anomaly risk value of any IP asset by taking the maximum value of the curve fitting error of the IP asset and the curve fitting error of all IP assets in the subset after another update under the monitoring dimension.

[0014] A computer device includes a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to perform the aforementioned method for monitoring and investigating IP asset anomalies based on traffic data.

[0015] The beneficial effects of this invention are: The present invention provides a method, system, and device for IP asset anomaly monitoring and investigation based on traffic data. This method extracts multi-dimensional features of all IP assets, including traffic size, rate, growth rate, and activity level. It calculates and sorts the anomaly risk values ​​for each dimension, identifies suspected anomaly IPs through cross-dimensional list comparison, and then filters identified anomaly IPs through feature analysis. Its multi-dimensional monitoring covers key features missed by traditional methods, can capture associated threats, and effectively reduce the false negative rate. Simultaneously, the comprehensive evaluation of multi-dimensional risk values ​​and secondary feature analysis avoid the limitations of single-threshold detection, significantly reducing false alarms, improving detection accuracy, and efficiently identifying hidden abnormal behavior. This provides reliable support for IP asset security protection and reduces operation and maintenance costs. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart of a method for monitoring and investigating IP asset anomalies based on traffic data. Figure 2 This is a block diagram of an IP asset anomaly monitoring and investigation system based on traffic data. Detailed Implementation

[0018] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0019] The following disclosure provides many different embodiments or examples for implementing different structures of the present invention. To simplify the disclosure of the present invention, the components and arrangements of specific examples are described below. Of course, these are merely examples and are not intended to limit the present invention.

[0020] The embodiments of the invention will now be described in detail with reference to the accompanying drawings.

[0021] like Figure 1 As shown, the IP asset anomaly monitoring and troubleshooting method based on traffic data disclosed in this embodiment includes the following steps: S100: Obtain the current traffic data of all IP assets and extract the traffic data characteristics of all IP assets; S200: Calculate the feature anomaly risk value of the traffic data characteristics of all IP assets in each monitoring dimension; where the monitoring dimensions include traffic size, traffic rate, traffic growth rate and activity level; for any monitoring dimension, based on the traffic data characteristics of all IP assets under that monitoring dimension, use the pre-built feature anomaly model of that monitoring dimension to calculate the corresponding feature anomaly risk value. S300: Arrange the characteristic anomaly risk values ​​of all IP assets under any monitoring dimension in ascending order to obtain a monitoring risk list under that monitoring dimension. S400: Compare the various monitoring risk lists to determine a host list containing at least one IP, thereby obtaining a first abnormal risk set containing all IPs in the host list, i.e., suspected abnormal IPs; S500: Perform feature analysis on suspected abnormal IPs to obtain a second set of abnormal risks that includes at least one of the suspected abnormal IPs, i.e., identified abnormal IPs.

[0022] In step S100, an IP address (Internet Protocol Address, also known as an Internet address, is a unified address format provided by the IP protocol. It assigns a logical address to every network and every host on the Internet to enable interconnection with other networks and thus achieve information transmission) is an IP asset, that is, an IP address, used for traffic data monitoring of the IP asset. Specifically, the extracted traffic data features may include timestamps, IP addresses, users, services, number of bytes sent, and number of bytes received.

[0023] In step S100, current traffic data for all IP assets is acquired using data collection tools such as NetFlow (a syntax for defining the transmission of flow tuples on a network (or network device). Flow is a fine-grained description of protocols and services in network communication and interactive applications). The acquired traffic data is historical traffic data, and a traffic data model is built using this historical traffic data. The traffic data model is then segmented and statistically analyzed according to monitoring dimensions to obtain the corresponding historical traffic data characteristics.

[0024] In step S200, for any monitoring dimension, based on the traffic data characteristics of all IP assets under that monitoring dimension, a pre-built feature anomaly model for that monitoring dimension is used to calculate the corresponding feature anomaly risk value. The pre-built feature anomaly model for that monitoring dimension is trained based on historical traffic data characteristics.

[0025] In step S400, firstly, from each monitoring risk list, an IP asset with the highest monitoring risk value is selected, and a host list containing that IP is output. Then, the IP in the host list is removed from all IP assets, and the process of selecting the IP asset with the highest monitoring risk value from each monitoring risk list and outputting a host list containing that IP is repeated until all IP asset monitoring risk lists have been selected, resulting in several host lists containing at least one IP. These several host lists containing at least one IP constitute the final host list. Next, the several host lists containing at least one IP are merged to obtain the first abnormal risk set, i.e., suspected abnormal IPs.

[0026] In step S500, specifically, the feature analysis includes: using a traffic anomaly identification algorithm (such as a machine learning-based anomaly identification algorithm) to identify suspected abnormal IPs, so as to obtain a second anomaly risk set containing at least one IP among the suspected abnormal IPs, i.e., identified abnormal IPs.

[0027] Preferably, since traffic volume has unique characteristics, while traffic rate changes, traffic change growth rate (traffic growth rate), activity level, and activity value all exhibit a stable trend, traffic volume can be considered a special case. Therefore, in step S200, the calculation process for the characteristic anomaly risk value of all IP assets under any monitoring dimension includes: Step S210: Based on the traffic data characteristics of all IP assets under this monitoring dimension, delete the IP assets whose difference from the average traffic size is less than a preset first threshold from all IP assets to obtain a subset. Step S220: In this subset, IP assets whose difference from the average traffic rate is less than a preset second threshold are deleted to obtain an updated subset. Step S230: Determine whether the monitoring dimension is the traffic growth rate or the activity level, establish a feature anomaly model based on the updated subset under the monitoring dimension, and calculate the corresponding feature anomaly risk value.

[0028] If the monitoring dimension is the traffic growth rate, then a feature anomaly model is built based on the updated subset under this monitoring dimension, and the corresponding feature anomaly risk value is calculated, including: In the updated subset, extract the non-growing IP assets under this monitoring dimension, and delete the non-growing IP assets from the updated subset to obtain another updated subset; Based on the traffic data characteristics of growing IP assets under this monitoring dimension, a growth curve model is obtained by using linear prediction technology. Based on the traffic data characteristics of each IP asset contained in the updated subset under this monitoring dimension, the growth curve fitting error of the IP asset is calculated by combining the growth curve model. For any IP asset, the characteristic anomaly risk value of the IP asset is calculated based on the fitting error of its growth curve and the minimum value of the fitting error of the growth curve of all IP assets in the updated subset under the monitoring dimension.

[0029] If the monitoring dimension is activity level, then a feature anomaly model is built based on the updated subset under this monitoring dimension, and the corresponding feature anomaly risk value is calculated, including: In the updated subset, inactive IP assets under this monitoring dimension are extracted and deleted from the updated subset to obtain another updated subset; since inactive IPs, i.e., those with zero activity, do not meet business requirements, they are deleted from the updated subset.

[0030] Based on the traffic data characteristics of active IP assets under this monitoring dimension, a maximum activity value curve model is obtained by using linear prediction technology. Based on the traffic data characteristics of each IP asset contained in the updated subset under this monitoring dimension, the curve fitting error of the IP asset is calculated by combining the maximum activity value curve model. For any IP asset, the characteristic anomaly risk value of the IP asset is calculated by taking the maximum value of the curve fitting error of the IP asset and the curve fitting error of all IP assets in the subset after the latest update under the monitoring dimension.

[0031] The IP asset anomaly monitoring and investigation method based on traffic data disclosed in this embodiment has the following beneficial effects: I. Multi-dimensional correlation analysis to enhance the ability to detect hidden threats This embodiment extracts four dimensions of traffic data features from all IP assets: traffic size, traffic rate, traffic growth rate, and activity level, to construct a comprehensive monitoring system that can accurately capture the core characteristics of different attack phases. For each dimension, a pre-built feature anomaly model is used to calculate the risk value. For example, the traffic growth rate dimension uses linear prediction technology to fit the growth curve, which can quickly identify abnormal traffic surges in scenarios such as data theft; the activity level dimension relies on the maximum activity value curve model to accurately capture high-frequency communication behavior during non-working hours. At the same time, the risk values ​​of each dimension are sorted to generate a monitoring list. High-risk IPs are identified through cross-dimensional comparison and are prioritized for inclusion in the suspected set of IPs that show anomalies in multiple dimensions. This effectively identifies the combined risk of traffic surges and abnormal activity, significantly improving the detection rate of multi-stage covert threats such as APTs.

[0032] II. Multi-level verification mechanism improves detection accuracy and reduces false alarms. This embodiment significantly optimizes detection accuracy through a technical design of "dynamic screening + quantitative evaluation + secondary verification". Before model construction, two threshold screening steps, S210 and S220, are used to sequentially delete IPs whose average traffic volume and average rate difference is less than a preset threshold, thus excluding devices with normal fluctuations and stable communication in advance and reducing invalid analysis objects. The risk assessment stage uses curve fitting error as the core indicator. For example, the error between the actual traffic of the IP and the predicted curve is calculated in the dimension of traffic growth rate (the larger the error, the higher the risk value). In the dimension of activity level, the risk is quantified by the ratio of the error to the maximum error of all IPs, adapting to the differences in traffic characteristics of different devices. Subsequently, step S500 performs in-depth feature analysis on suspected abnormal IPs to further eliminate abnormal signals caused by non-risk factors such as configuration changes, effectively reducing false alarms, alleviating the pressure on operation and maintenance, and ensuring the reliability of detection results.

[0033] III. The technical design is highly adaptable and covers diverse security protection scenarios. The technical solution in this embodiment boasts high adaptability and comprehensiveness, meeting the protection needs of complex network environments. Its four-dimensional traffic feature correlation analysis design covers the entire process characteristics of multi-stage attacks, eliminating reliance on single-behavior detection. The mechanism combining dynamic thresholds and curve fitting errors flexibly adapts to dynamic traffic fluctuations, eliminating the need for frequent manual parameter adjustments and adapting to IP assets with different performance and service types. Relying on a secondary verification mechanism and referencing the application effects of similar technologies, the false alarm rate can be controlled below 5%, demonstrating outstanding detection stability. Furthermore, the combination of multi-dimensional monitoring and dynamic models effectively addresses new attack methods such as high-frequency IP switching and traffic spoofing, adapting to complex scenarios such as APT attacks and proxy IP pool abuse, providing comprehensive security protection for diverse IP assets.

[0034] like Figure 2 As shown, based on the same inventive concept, this embodiment also provides an IP asset anomaly monitoring and troubleshooting system based on traffic data, which executes the aforementioned IP asset anomaly monitoring and troubleshooting method based on traffic data. The system includes: The feature extraction module 110 is used to obtain the current traffic data of all IP assets and extract the traffic data features of all IP assets. The feature calculation module 120 is used to calculate the feature anomaly risk value of the traffic data features of all IP assets in each monitoring dimension. The monitoring dimensions include traffic size, traffic rate, traffic growth rate and activity level. For any monitoring dimension, based on the traffic data features of all IP assets under that monitoring dimension, the pre-built feature anomaly model of that monitoring dimension is used to calculate the corresponding feature anomaly risk value. The risk list sorting module 130 is used to sort the characteristic abnormal risk values ​​of all IP assets under any monitoring dimension in ascending order to obtain a monitoring risk list under that monitoring dimension. The host list calculation module 140 is used to compare the various monitoring risk lists, determine a host list containing at least one IP, and thus obtain a first abnormal risk set containing all IPs in the host list, i.e., suspected abnormal IPs; The anomaly identification module 150 is used to perform feature analysis on suspected abnormal IPs to obtain a second set of abnormal risks that includes at least one of the suspected abnormal IPs, i.e., identified abnormal IPs.

[0035] Furthermore, the feature calculation module 120 includes: The first deletion unit is used to delete IP assets whose average traffic size difference is less than a preset first threshold from all IP assets based on the traffic data characteristics of all IP assets under the monitoring dimension, so as to obtain a subset. The second deletion unit is used to delete IP assets in the subset whose difference from the average traffic rate is less than a preset second threshold, so as to obtain an updated subset. The Feature Anomaly Model Unit is used to determine whether the monitoring dimension is traffic growth rate or activity level. It builds a feature anomaly model based on the updated subset under the monitoring dimension and calculates the corresponding feature anomaly risk value.

[0036] If the monitoring dimension is the traffic growth rate, the feature anomaly model unit includes: The first extraction subunit is used to extract non-growing IP assets under the monitoring dimension in the updated subset, and delete the non-growing IP assets from the updated subset to obtain another updated subset; The first model fitting subunit is used to fit the growth curve model based on the traffic data characteristics of the growing IP assets under this monitoring dimension using linear prediction technology. The first gap calculation subunit is used to calculate the growth curve fitting error of the IP asset based on the traffic data characteristics of each IP asset contained in the updated subset under the monitoring dimension. The first anomaly risk value calculation subunit is used to calculate the characteristic anomaly risk value of any IP asset based on the growth curve fitting error of the IP asset and the minimum value of the growth curve fitting error of all IP assets in the subset after another update under the monitoring dimension.

[0037] If the monitoring dimension is activity level, the feature anomaly model unit includes: The second extraction subunit is used to extract inactive IP assets under the monitoring dimension in the updated subset and delete the inactive IP assets from the updated subset to obtain another updated subset. The second model fitting subunit is used to fit the maximum activity value curve model based on the traffic data characteristics of active IP assets under this monitoring dimension using linear prediction technology. The second gap calculation subunit is used to calculate the curve fitting error of the IP asset based on the traffic data characteristics of each IP asset contained in the updated subset under the monitoring dimension, combined with the maximum activity value curve model. The second anomaly risk value calculation subunit is used to calculate the characteristic anomaly risk value of any IP asset by taking the maximum value of the curve fitting error of the IP asset and the curve fitting error of all IP assets in the subset after another update under the monitoring dimension.

[0038] Based on the same inventive concept, this embodiment also provides a computer device, which includes: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the aforementioned method for monitoring and investigating IP asset anomalies based on traffic data.

Claims

1. A method for monitoring and investigating IP asset anomalies based on traffic data, characterized in that, Including the following steps: Step S100: Obtain the current traffic data of all IP assets and extract the traffic data features of all IP assets; Step S200: Calculate the characteristic anomaly risk value of the traffic data characteristics of all IP assets in each monitoring dimension; The monitoring dimensions include traffic size, traffic rate, traffic growth rate, and activity level. For any monitoring dimension, based on the traffic data characteristics of all IP assets under that monitoring dimension, a pre-built feature anomaly model for that monitoring dimension is used to calculate the corresponding feature anomaly risk value. Step S300: Arrange the characteristic anomaly risk values ​​of all IP assets under any monitoring dimension in ascending order to obtain a monitoring risk list under that monitoring dimension. Step S400: Compare the monitoring risk lists to determine a host list containing at least one IP, thereby obtaining a first abnormal risk set containing all IPs in the host list, i.e., suspected abnormal IPs; Step S500: Perform feature analysis on the suspected abnormal IPs to obtain a second abnormal risk set containing at least one of the suspected abnormal IPs, i.e., the identified abnormal IPs.

2. The method for monitoring and investigating IP asset anomalies based on traffic data according to claim 1, characterized in that, In step S200, the calculation process of the characteristic anomaly risk value of the traffic data characteristics of all IP assets in each monitoring dimension includes the following sub-steps: Step S210: Based on the traffic data characteristics of all IP assets under this monitoring dimension, delete the IP assets whose difference from the average traffic size is less than a preset first threshold from all IP assets to obtain a subset. Step S220: In this subset, IP assets whose difference from the average traffic rate is less than a preset second threshold are deleted to obtain an updated subset. Step S230: Determine whether the monitoring dimension is the traffic growth rate or the activity level, establish a feature anomaly model based on the updated subset under the monitoring dimension, and calculate the corresponding feature anomaly risk value.

3. The method for monitoring and investigating IP asset anomalies based on traffic data according to claim 2, characterized in that, In step S230, if the monitoring dimension is the traffic growth rate, then the feature anomaly model is established based on the updated subset under the monitoring dimension, and the corresponding feature anomaly risk value is calculated, including the following sub-steps: In the updated subset, extract the non-growing IP assets under this monitoring dimension, and delete the non-growing IP assets from the updated subset to obtain another updated subset; Based on the traffic data characteristics of growing IP assets under this monitoring dimension, a growth curve model is obtained by using linear prediction technology. Based on the traffic data characteristics of each IP asset contained in the updated subset under this monitoring dimension, the growth curve fitting error of the IP asset is calculated by combining the growth curve model. For any IP asset, the characteristic anomaly risk value of the IP asset is calculated based on the fitting error of its growth curve and the minimum value of the fitting error of the growth curve of all IP assets in the updated subset under the monitoring dimension.

4. The method for monitoring and investigating IP asset anomalies based on traffic data according to claim 2, characterized in that, In step S230, if the monitoring dimension is activity level, then the feature anomaly model is established based on the updated subset under the monitoring dimension, and the corresponding feature anomaly risk value is calculated, including the following sub-steps: In the updated subset, inactive IP assets under this monitoring dimension are extracted and deleted from the updated subset to obtain another updated subset; Based on the traffic data characteristics of active IP assets under this monitoring dimension, a maximum activity value curve model is obtained by using linear prediction technology. Based on the traffic data characteristics of each IP asset contained in the updated subset under this monitoring dimension, the curve fitting error of the IP asset is calculated by combining the maximum activity value curve model. For any IP asset, the characteristic anomaly risk value of the IP asset is calculated by taking the maximum value of the curve fitting error of the IP asset and the curve fitting error of all IP assets in the subset after the latest update under the monitoring dimension.

5. The method for monitoring and investigating IP asset anomalies based on traffic data according to any one of claims 1-4, characterized in that, In step S400, comparing the various monitoring risk lists to determine a list of hosts containing at least one IP address includes the following sub-steps: In each monitoring risk list, select the IP asset with the highest monitoring risk value and output a list of hosts containing that IP. Remove the IPs from the host list from all IP assets. Repeat this step until all IP assets have been selected for monitoring risk lists, resulting in several host lists containing at least one IP. These host lists containing at least one IP constitute the final host list.

6. A system for monitoring and investigating IP asset anomalies based on traffic data, characterized in that, The method for monitoring and investigating IP asset anomalies based on traffic data as described in any one of claims 1-5 includes: The feature extraction module is used to obtain the current traffic data of all IP assets and extract the traffic data features of all IP assets. The feature calculation module is used to calculate the feature anomaly risk value of the traffic data characteristics of all IP assets in each monitoring dimension. The monitoring dimensions include traffic size, traffic rate, traffic growth rate, and activity level. For any monitoring dimension, based on the traffic data characteristics of all IP assets under that monitoring dimension, a pre-built feature anomaly model for that monitoring dimension is used to calculate the corresponding feature anomaly risk value. The risk list sorting module is used to sort the feature anomaly risk values ​​of all IP assets under any monitoring dimension in ascending order to obtain a monitoring risk list for that monitoring dimension. The host list calculation module is used to compare various monitoring risk lists, determine a host list containing at least one IP, and thus obtain a first abnormal risk set containing all IPs in the host list, i.e., suspected abnormal IPs; The anomaly identification module is used to perform feature analysis on suspected abnormal IPs to obtain a second set of abnormal risks that includes at least one of the suspected abnormal IPs, i.e., identified abnormal IPs.

7. The IP asset anomaly monitoring and investigation system based on traffic data according to claim 6, characterized in that, The feature calculation module includes: The first deletion unit is used to delete IP assets whose average traffic size difference is less than a preset first threshold from all IP assets based on the traffic data characteristics of all IP assets under the monitoring dimension, so as to obtain a subset. The second deletion unit is used to delete IP assets in the subset whose difference from the average traffic rate is less than a preset second threshold, so as to obtain an updated subset. The Feature Anomaly Model Unit is used to determine whether the monitoring dimension is traffic growth rate or activity level. It builds a feature anomaly model based on the updated subset under the monitoring dimension and calculates the corresponding feature anomaly risk value.

8. The IP asset anomaly monitoring and investigation system based on traffic data according to claim 7, characterized in that, If the monitoring dimension is the traffic growth rate, then the feature anomaly model unit includes: The first extraction subunit is used to extract non-growing IP assets under the monitoring dimension in the updated subset, and delete the non-growing IP assets from the updated subset to obtain another updated subset; The first model fitting subunit is used to fit the growth curve model based on the traffic data characteristics of the growing IP assets under this monitoring dimension using linear prediction technology. The first gap calculation subunit is used to calculate the growth curve fitting error of the IP asset based on the traffic data characteristics of each IP asset contained in the updated subset under the monitoring dimension, combined with the growth curve model. The first anomaly risk value calculation subunit is used to calculate the characteristic anomaly risk value of any IP asset based on the growth curve fitting error of the IP asset and the minimum value of the growth curve fitting error of all IP assets in the subset after another update under the monitoring dimension.

9. The IP asset anomaly monitoring and investigation system based on traffic data according to claim 7, characterized in that, If the monitoring dimension is activity level, then the feature anomaly model unit includes: The second extraction subunit is used to extract inactive IP assets under the monitoring dimension in the updated subset and delete the inactive IP assets from the updated subset to obtain another updated subset. The second model fitting subunit is used to fit the maximum activity value curve model based on the traffic data characteristics of active IP assets under this monitoring dimension using linear prediction technology. The second gap calculation subunit is used to calculate the curve fitting error of the IP asset based on the traffic data characteristics of each IP asset contained in the updated subset under the monitoring dimension, combined with the maximum activity value curve model. The second anomaly risk value calculation subunit is used to calculate the characteristic anomaly risk value of any IP asset by taking the maximum value of the curve fitting error of the IP asset and the curve fitting error of all IP assets in the subset after another update under the monitoring dimension.

10. A computer device, characterized in that, include: The system includes a memory and a processor, which are interconnected and communicate with each other. The memory stores computer instructions, and the processor executes these computer instructions to perform the IP asset anomaly monitoring and troubleshooting method based on traffic data as described in any one of claims 1-5.

Images