Detection method, device, equipment, medium and product

Abstract

The invention discloses a detection method, device and equipment, a medium and a product. The method comprises the following steps: acquiring a network equipment topological graph and a flow quintuple corresponding to a local area network; generating a plurality of network access tracks according to the network equipment topological graph and the flow quintuple; segmenting the plurality of network access tracks based on a track segmentation algorithm to obtain a plurality of track line segments; clustering the plurality of trajectory line segments by using a clustering algorithm based on density noise to obtain a plurality of trajectory clusters; obtaining a to-be-detected network access track; and if the similarity between the to-be-detected network access track and the average track of each track cluster is smaller than a similarity threshold, determining that the to-be-detected network access track is an abnormal network access track, and through the technical scheme of the invention, the accuracy of network access track detection can be improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of computer technology, and in particular to a detection method, device, equipment, medium and product. BACKGROUND

[0002] With the rapid development of Internet technology, network attack means is showing a trend of increasing complexity and concealment. Attackers often use distributed architecture and low-frequency access strategy, and hide malicious behavior in normal network traffic through carefully designed traffic camouflage technology, so as to evade the identification of traditional security detection mechanism.

[0003] The current mainstream abnormal access detection method based on signature can only identify known attack patterns, and often performs poorly when facing new or variant attacks, resulting in that the accuracy and reliability of the detection result are difficult to meet the actual security protection needs. SUMMARY

[0004] Embodiments of the present application provide a detection method, device, equipment, medium and product to improve the accuracy of network access trajectory detection.

[0005] According to an aspect of the present application, a detection method is provided, comprising:

[0006] obtaining a network device topology graph and a traffic five tuple corresponding to a local area network;

[0007] generating a plurality of network access trajectories according to the network device topology graph and the traffic five tuple;

[0008] segmenting the plurality of network access trajectories based on a trajectory segmentation algorithm to obtain a plurality of trajectory line segments;

[0009] clustering the plurality of trajectory line segments based on a density-based noise application clustering algorithm to obtain a plurality of trajectory clusters;

[0010] obtaining a network access trajectory to be detected;

[0011] if the similarity between the network access trajectory to be detected and the average trajectory of each trajectory cluster is less than a similarity threshold, determining that the network access trajectory to be detected is an abnormal network access trajectory.

[0012] According to another aspect of the present application, a detection device is provided, comprising:

[0013] a first obtaining module configured to obtain a network device topology graph and a traffic five tuple corresponding to a local area network;

[0014] a network access trajectory generation module configured to generate a plurality of network access trajectories according to the network device topology graph and the traffic five tuple;

[0015] a segmenting module configured to segment the plurality of network access trajectories based on a trajectory segmenting algorithm to obtain a plurality of trajectory segments;

[0016] a clustering module configured to cluster the plurality of trajectory segments based on a density-based clustering algorithm with noise to obtain a plurality of trajectory clusters;

[0017] a second obtaining module configured to obtain a network access trajectory to be detected;

[0018] a determining module configured to determine that the network access trajectory to be detected is an abnormal network access trajectory if similarities between the network access trajectory to be detected and average trajectories of the trajectory clusters are all less than a similarity threshold.

[0019] According to another aspect of the present application, an electronic device is provided, which comprises:

[0020] at least one processor; and

[0021] a memory connected to the at least one processor in communication; wherein

[0022] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the detection method according to any one of the embodiments of the present application.

[0023] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to perform the detection method according to any one of the embodiments of the present application when executed by the processor.

[0024] According to another aspect of the present application, a computer program product is provided, which, when executed by a processor, implements the detection method according to any one of the embodiments of the present application.

[0025] The embodiments of the present application can improve the accuracy of network access trajectory detection by obtaining a network device topology graph and a traffic five-tuple corresponding to a local area network, generating a plurality of network access trajectories according to the network device topology graph and the traffic five-tuple, segmenting the plurality of network access trajectories based on a trajectory segmenting algorithm to obtain a plurality of trajectory segments, clustering the plurality of trajectory segments based on a density-based clustering algorithm with noise to obtain a plurality of trajectory clusters, obtaining a network access trajectory to be detected, and determining that the network access trajectory to be detected is an abnormal network access trajectory if similarities between the network access trajectory to be detected and average trajectories of the trajectory clusters are all less than a similarity threshold.

[0026] It is to be understood that the embodiments described herein are merely exemplary of the application and that a person skilled in the art can devise other embodiments without departing from the scope of the present application. It is also to be understood that not all of the benefits described herein need necessarily be realized in any particular embodiment of the application. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be considered as limiting the scope. For those skilled in the art, other related drawings can also be obtained without creative labor.

[0028] Figure 1 is a flow chart of a detection method in the embodiments of the present application;

[0029] Figure 2 is a structural schematic diagram of a detection device in the embodiments of the present application;

[0030] Figure 3 is a structural schematic diagram of an electronic device in the embodiments of the present application. DETAILED DESCRIPTION

[0031] In order to make the person skilled in the art better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings of the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of the present application.

[0032] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0033] It can be understood that before using the technical solutions disclosed in the embodiments of the present disclosure, the type of personal information involved in the present disclosure, the use range, the use scenario, etc. should be informed to the user and the authorization of the user should be obtained according to relevant laws and regulations.

[0034] Embodiment one

[0035] Figure 1 A flowchart of a detection method provided for the embodiment of the present application, the embodiment can be applicable to the case of detecting abnormal network access, and the method can be executed by the detection device in the embodiment of the present application. The device can be realized in the form of software and / or hardware. As shown in the figure, the method specifically includes the following steps: Figure 1

[0036] S110, acquiring a network device topology graph and a traffic five tuple corresponding to a local area network.

[0037] In the embodiment, the traffic five tuple includes a source IP address, a destination IP address, a protocol number, a source port and a destination port.

[0038] In the embodiment, the manner of acquiring the network device topology graph corresponding to the local area network can be: acquiring an IP address range of the local area network; determining relevant information of network devices in the IP address range of the local area network, wherein the relevant information includes at least one of a network device type, an operating system type and a running service identifier; and generating the network device topology graph corresponding to the local area network according to the relevant information of the network devices in the IP address range of the local area network.

[0039] In the embodiment, the network space asset mapping can be performed by means of a network mapper nmap tool to obtain the network device topology graph corresponding to the local area network. It should be noted that the nmap tool can detect whether a target port is alive, detect a network device type, an operating system type, etc., and finally generate the network device topology graph corresponding to the local area network.

[0040] In the embodiment, the manner of acquiring the traffic five tuple can be: using a SpiderFlow network traffic probe to collect traffic data packets in the local area network in real time, analyzing the traffic data packets to obtain the traffic five tuple. For example, the traffic data can be collected by a port mirroring manner, mainly by setting a specific mirror port on a splitter of a core layer and a convergence layer switch of a network, copying the traffic transmitted by the switch to realize collection of the traffic of all user accesses to the network through the port. The embodiment of the present application collects and retains all TCP / UDP protocol traffic, extracts five tuple data information, and stores the collection result into a big data platform. The five tuple includes a source IP address, a destination IP address, a protocol number, a source port and a destination port. ​

[0041] Optionally, the network device topology graph corresponding to the local area network is acquired, comprising:

[0042] An IP address range of the local area network is acquired.

[0043] The related information of the network devices in the IP address range of the local area network is determined.

[0044] The related information comprises at least one of a network device type, an operating system type and a running service identifier.

[0045] The network device topology graph corresponding to the local area network is generated according to the related information of the network devices in the IP address range of the local area network.

[0046] In a specific example, the IP address range of the local area network is 10.32.0.0 / 24 and 10.33.0.0 / 24, and the network devices existing in the IP address range are scanned by using an nmap tool. The nmap tool does not simply send an ICMP request to detect whether a host is online, and the present application skips a Ping step by using a list scanning option or disabling a Ping option (a multi-port combined multi-protocol detection scan can also be used, for example, a plurality of ports are used to combine TCP SYN / ACK, UDP, SCTP INIT and ICMP detection to scan), so as to determine whether a certain IP address is active and the condition of the corresponding network device. At least one of the network device type, the operating system type and the running service identifier of the network devices is acquired by using the nmap tool, and the network device topology graph corresponding to the local area network is drawn based on at least one of the network device type, the operating system type and the running service identifier of the network devices acquired by using the nmap tool.

[0047] S120, a plurality of network access trajectories are generated according to the network device topology graph and the traffic five-tuple.

[0048] Optionally, the plurality of network access trajectories are generated according to the network device topology graph and the traffic five-tuple, comprising:

[0049] The traffic five-tuple is associated with the related information of the network devices in the IP address range of the local area network based on a destination IP address, so as to obtain a corresponding relationship between the traffic five-tuple and the related information of the network devices in the IP address range of the local area network.

[0050] The plurality of network access trajectories are generated based on the corresponding relationship between the traffic five-tuple and the related information of the network devices in the IP address range of the local area network.

[0051] In the embodiment, after the traffic five-tuple is acquired, the traffic five-tuple can be further formatted, and the formatted data is processed as follows: the traffic five-tuple is stored to a message queue; the message queue caches data and supports a mechanism of publishing and subscribing to access; the data integration layer associates the traffic five-tuple with at least one of a network device type, an operating system type and a running service identifier of a network device acquired by using an Nmap tool through a destination IP address, to obtain a corresponding relationship between the traffic five-tuple and related information of the network device in the IP address range of the local area network; and the data integration layer stores the associated data to a big data platform.

[0052] In the embodiment, based on the corresponding relationship between the traffic five-tuple and the related information of the network device in the IP address range of the local area network, the manner of generating the multiple network access trajectories can be as follows: after the traffic five-tuple is acquired, the source node and the target node are sequentially connected according to the source IP address, the target IP address and the destination port in the traffic five-tuple, to form a preliminary network access list, and the more frequent the node interaction is, the more connection lines there are.

[0053] In the embodiment, the nodes in the network access trajectory include: network devices in the local area network, and the network devices include: security devices, load devices and hosts and the like; containers and PODs running with micro services and the like.

[0054] S130, segmenting the multiple network access trajectories based on a trajectory segmentation algorithm, to obtain multiple trajectory line segments.

[0055] In the embodiment, the trajectory segmentation algorithm is to select some feature points in an original trajectory (any one of the multiple network access trajectories is taken as the original trajectory), and to approximate the original trajectory by using connection lines of the feature points. The feature points refer to points with large angle changes in the trajectory, and in the network space, refer to each node.

[0056] The embodiment of the application adopts a minimum description length algorithm (MDL) in an information compression standard to balance. The MDL is a model selection and data compression method based on information theory, and the core idea is to "describe data and a model with the shortest coding length". For a given set of instance data D, if the instance data D is to be saved, in order to save storage space, the instance data D is generally coded and compressed by using a certain model H, and then the compressed data is saved. At the same time, in order to correctly restore the instance data in the future, the model used is also saved, so the data length (bit number) to be saved is equal to the length of the instance data after coding and compression plus the data length required to save the model. The data length is called total description length. The MDL is to select a model with the minimum total description length.

[0057] MDL consists of two parts:

[0058] L(H): the length of the description of the compression model (or encoding scheme);

[0059] L(D|H): the length of the data encoded using the compression model;

[0060] The horizontal distance is not included in L(D|H) because for two closed line segments, the horizontal distance is zero.

[0061] In this embodiment, if the nodes pi and pj are feature points, MDLpar(pi, pj) represents the MDL overhead required, i.e., L(H) + L(D|H); MDLnopar(pi, pj) represents the MDL overhead when there is no feature point between the point pi and the point pj. For a given line segment, the criterion for selecting a feature point is that the MDL overhead of the point as a feature point is less than the MDL overhead of not selecting it as a feature point. The feature points are selected by sequentially checking whether each point meets the condition.

[0062] In this embodiment, some feature points are selected from the plurality of network access trajectories, and the network access trajectories are approximated using the lines connecting the feature points.

[0063] In S140, the plurality of trajectory line segments are clustered based on the density-based noise-tolerant clustering algorithm to obtain a plurality of trajectory clusters.

[0064] In this embodiment, the manner of clustering the plurality of trajectory line segments based on the density-based noise-tolerant clustering algorithm to obtain a plurality of trajectory clusters can be: obtaining a target neighborhood of each trajectory line segment, and taking a trajectory line segment in the target neighborhood and having a number of trajectory line segments greater than or equal to a number threshold as a core trajectory line segment; and clustering according to the core trajectory line segment to obtain a plurality of trajectory clusters.

[0065] Optionally, the plurality of trajectory line segments are clustered based on the density-based noise-tolerant clustering algorithm to obtain a plurality of trajectory clusters, including:

[0066] Taking any trajectory line segment as a current trajectory line segment, a target neighborhood of the current trajectory line segment is obtained.

[0067] The distance between each trajectory line segment in the target neighborhood and the current trajectory line segment is less than or equal to a distance threshold.

[0068] In this embodiment, the distance between the trajectory line segment and the current trajectory line segment can be determined according to the perpendicular distance, the parallel distance, and the angle distance of the current trajectory line segment and the other trajectory line segment.

[0069] Taking the current trajectory line segment in the target neighborhood and having a number of trajectory line segments greater than or equal to a number threshold as a core trajectory line segment.

[0070] obtaining a density-connected set of the core trajectory segments.

[0071] In the embodiment, a density-connected set of the core trajectory segments: a non-empty subset C D is called a density-connected set if and only if C satisfies the following two conditions: connectivity: Lj are density-connected; maximization: If Li C and Lj is density-reachable from Li, then Lj C.

[0072] Adding the density-connected set of the core trajectory segments to the trajectory cluster to which the core trajectory segments belong, to obtain a plurality of trajectory clusters.

[0073] In the embodiment, after the trajectory segmentation, clustering is needed to be performed by the DBSCAN algorithm. The DBSCAN algorithm is a density-based clustering, and the density of the trajectory segment described above must be defined before clustering.

[0074] In the embodiment, the distance between the trajectory segment Li and the trajectory segment Lj is determined based on the following formula:

[0075] dist(Li, Lj) = w d (Li, Lj) + w d (Li, Lj) + w d (Li, Lj); where dist(Li, Lj) is the distance between the trajectory segment Li and the trajectory segment Lj, w is the weight of the vertical distance, d (Li, Lj) is the vertical distance, which is used to measure the deviation of the two trajectory segments in the vertical direction (such as the height difference of the trajectory segments), w is the weight of the parallel distance, d (Li, Lj) is the parallel distance, which is used to measure the deviation of the two trajectory segments in the parallel direction (such as the length difference or position offset of the trajectory segments), w is the weight of the angle distance, d (Li, Lj) is the angle distance, which is used to measure the difference in direction between the two trajectory segments (such as the difference in orientation of the trajectory segments).

[0076] In the embodiment, the target neighborhood of the trajectory segment can be the e-neighborhood of the trajectory segment, and the e-neighborhood of the trajectory segment can be determined based on the following formula: N (Li) = {Lj D | dist(Li, Lj) e}, where N (Li) is the e-neighborhood of the trajectory segment, N (Li) is a set of all trajectory segments Lj whose comprehensive distance dist(Li, Lj) from the trajectory segment Li is less than or equal to the distance threshold value e, and D is a data set of all trajectory segments (i.e., the full set of candidate trajectory segments).

[0077] Core trajectory segment: A trajectory segment Li (Li∈D) is called a core trajectory segment if |Nε(Li)|≥MinLns, where MinLns is a quantity threshold, and |Nε(Li)| is the number of trajectory segments in the ε-neighborhood of trajectory segment Li.

[0078] Directly density reachable trajectory segments: A trajectory segment Li∈D is directly density reachable to a trajectory segment Lj∈D if and only if Li∈Nε(Lj) and |Nε(Lj)|≥MinLns.

[0079] Density reachable trajectory segments: A trajectory segment Li∈D is density reachable to a trajectory segment Lj∈D if and only if there exists a set of trajectory segments Lj, Lj−1,..., Li+1, Li∈D and a trajectory segment Lk is directly density reachable to a trajectory segment Lk+1.

[0080] Density connected trajectory segments: A trajectory segment Li∈D is density connected to a trajectory segment Lj∈D if and only if there exists a trajectory segment Lk∈D such that both Li and Lj are density reachable to Lk.

[0081] Density connected set of trajectory segments: A non-empty subset C⊆D is called a density connected set if and only if C satisfies the following two conditions:

[0082] Connectivity: Lj is density connected to Li.

[0083] Maximality: If Li∈C and Lj is density reachable to Li, then Lj∈C.

[0084] The trajectory segment clustering algorithm is as follows: for a given trajectory segment set D, the algorithm outputs a clustering set, and for each trajectory segment in the input, the algorithm classifies it as a core trajectory segment or a boundary trajectory segment.

[0085] In this embodiment, the clustering process includes:

[0086] Step 4-2-1: for each unclassified trajectory segment L, calculate its ε-neighborhood to determine whether the trajectory segment is a core trajectory segment. If L is a core trajectory segment, go to step 4-2-2.

[0087] Step 4-2-2: calculate the density connected set of core trajectory segments and add it to the cluster formed by the core trajectory segment. If the newly added trajectory segment is not classified, add it to the queue Q for further expansion, as the trajectory segment may be a core trajectory segment; if the newly added trajectory segment is not a core trajectory segment, do not add it to the queue Q.

[0088] Step 4-2-3: Calculate the cardinality of each cluster (i.e., the number of trajectory segments in each cluster), and determine the thickness of the trajectory segments in each cluster according to the cardinality of each cluster. Since all connections in the system are to be reflected, not just the most common connections, all clusters are to be retained, whether dense or not.

[0089] The clustering algorithm described above can divide the trajectories into multiple clusters based on density, and the connection lines are thick in dense clusters and thin in sparse clusters.

[0090] Optionally, the method further comprises:

[0091] Obtaining the perpendicular distance, parallel distance, and angular distance between the current trajectory segment and other trajectory segments, wherein the other trajectory segments are trajectory segments other than the current trajectory segment in the plurality of trajectory segments.

[0092] Determining the distance between the current trajectory segment and the other trajectory segments according to the perpendicular distance, parallel distance, and angular distance between the current trajectory segment and the other trajectory segments.

[0093] In this embodiment, the manner of determining the distance between the current trajectory segment and the other trajectory segments according to the perpendicular distance, parallel distance, and angular distance between the current trajectory segment and the other trajectory segments can be: performing weighted summation on the perpendicular distance, parallel distance, and angular distance between the current trajectory segment and the other trajectory segments to obtain the distance between the current trajectory segment and the other trajectory segments.

[0094] Optionally, any two trajectory segments in the dense connection set of the core trajectory segment are associated by density connection, and the trajectory segments that can reach the density of the trajectory segments in the dense connection set are all contained in the dense connection set.

[0095] S150: Obtain a network access trajectory to be detected.

[0096] S160: If the similarity between the network access trajectory to be detected and the average trajectory of each trajectory cluster is less than the similarity threshold, determine that the network access trajectory to be detected is an abnormal network access trajectory.

[0097] In this embodiment, the average trajectory of each trajectory cluster can be obtained in the following manner: scan each line segment with a straight line perpendicular to the average direction of the line segments in the cluster, and each time when the straight line passes through the start point or end point of a line segment, determine whether the number of intersected line segments is not less than MinLns. If yes, calculate an average point of all intersection points and store it in a list, otherwise, ignore it. The finally generated list is the node coordinates of the average trajectory, and the average trajectory is generated according to the node coordinates of the average trajectory.

[0098] In the embodiment, if there is an average trajectory of a trajectory cluster with a similarity greater than or equal to a similarity threshold to the network access trajectory to be detected, the network access trajectory to be detected is determined as a normal network access trajectory.

[0099] In the embodiment, the average trajectory of a trajectory cluster is used to represent the overall information of the trajectories in the cluster.

[0100] In the embodiment, first, massive network access traffic is captured and restored, and the capture result is converted into traffic five-tuple and stored into a big data platform; nodes are connected in sequence according to IP address jump order and time in network request; network access trajectories are segmented based on minimum description length algorithm, and feature points and segments are found to serve as input for grouping; DBSCAN algorithm based on line segment clustering is used to cluster and merge grouped line segments, and trajectory line segments are divided into multiple trajectory clusters based on density; average trajectories of the trajectory clusters are obtained, and network access trajectory detection is performed based on the average trajectories of the trajectory clusters.

[0101] The technical scheme of the embodiment, by obtaining network device topology graph and traffic five-tuple corresponding to a local area network, generating multiple network access trajectories according to the network device topology graph and the traffic five-tuple, segmenting the multiple network access trajectories based on a trajectory segmentation algorithm to obtain multiple trajectory line segments, clustering the multiple trajectory line segments based on a density-based noise application clustering algorithm to obtain multiple trajectory clusters, obtaining a network access trajectory to be detected, and determining the network access trajectory to be detected as an abnormal network access trajectory if the similarity between the network access trajectory to be detected and the average trajectory of each trajectory cluster is less than a similarity threshold, the accuracy of network access trajectory detection can be improved.

[0102] Embodiment Two

[0103] Figure 2 A structural schematic diagram of a detection device provided for the embodiment of the application. The embodiment can be applied to the detection condition, and the device can be realized in the form of software and / or hardware, and can be integrated in any device providing detection function, such as a computer. Figure 2 As shown in the figure, the detection device specifically includes a first obtaining module 210, a network access trajectory generating module 220, a segmenting module 230, a clustering module 240, a second obtaining module 250, and a determining module 260.

[0104] The first obtaining module is configured to obtain network device topology graph and traffic five-tuple corresponding to a local area network.

[0105] The network access trajectory generating module is configured to generate multiple network access trajectories according to the network device topology graph and the traffic five-tuple.

[0106] The segmentation module is configured to segment the plurality of network access trajectories based on a trajectory segmentation algorithm to obtain a plurality of trajectory segments.

[0107] The clustering module is configured to cluster the plurality of trajectory segments based on a density-based noise-tolerant clustering algorithm to obtain a plurality of trajectory clusters.

[0108] The second acquisition module is configured to acquire a to-be-detected network access trajectory.

[0109] The determination module is configured to determine that the to-be-detected network access trajectory is an abnormal network access trajectory if the similarity between the to-be-detected network access trajectory and the average trajectory of each trajectory cluster is less than the similarity threshold.

[0110] The product can execute the method provided by any embodiment of the application, and has the corresponding function modules and beneficial effects of the execution method.

[0111] Embodiment three

[0112] Figure 3 A structural schematic diagram of an electronic device 10 that can be used to implement embodiments of the application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the applications described and / or claimed in this document.

[0113] As shown in Figure 3 The electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11, wherein the memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0114] A plurality of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0115] The processor 11 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the detection method.

[0116] In some embodiments, the detection method can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded onto the RAM 13 and executed by the processor 11, one or more steps of the detection method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the detection method by any other appropriate means, such as by means of firmware.

[0117] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0118] Computer programs for implementing the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer program, when executed, enables the functions / acts specified in the flowcharts and / or block diagrams to be implemented. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a standalone software package and partially on a remote machine or entirely on a remote machine or server.

[0119] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0120] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0121] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), blockchain networks, and the Internet.

[0122] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, and solves the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0123] It should be understood that the various forms of flow shown above can be re-ordered, added to, or deleted from without departing from the scope of the present application. For example, the steps recited in the present application can be executed in parallel, in series, or in a different order, and the present application is not limited herein as long as the desired results of the technical solutions of the present application can be achieved.

[0124] The embodiments of the present application further provide a computer program product, comprising a computer program, wherein the computer program is executed by a processor to implement the detection method according to any one of the embodiments of the present application.

[0125] Computer program products can be written in any one of a number of programming languages, including object oriented languages such as Java, Smalltalk, C++, or conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0126] The specific embodiments discussed above do not constrain the scope of the present application. Those skilled in the art will readily understand that various modifications, combinations, sub-combinations, and alternatives of the specific embodiments discussed above can be made based on design requirements and other factors in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present application should be included in the scope of the present application.

Claims

1. A method of detection, characterized in that, The method comprises the following steps: obtaining a network device topology graph and a traffic five-tuple corresponding to a local area network; generating a plurality of network access trajectories according to the network device topology graph and the traffic five-tuple; segmenting the plurality of network access trajectories based on a trajectory segmentation algorithm to obtain a plurality of trajectory line segments; clustering the plurality of trajectory line segments based on a density-based clustering algorithm with noise to obtain a plurality of trajectory clusters; obtaining a network access trajectory to be detected; if the similarity between the network access trajectory to be detected and the average trajectory of each trajectory cluster is less than a similarity threshold, determining that the network access trajectory to be detected is an abnormal network access trajectory.

2. The method of claim 1, wherein, The method comprises the following steps: obtaining a network device topology graph corresponding to a local area network, comprising: obtaining an IP address range of the local area network; determining the relevant information of the network devices within the IP address range of the local area network, wherein the relevant information comprises at least one of the network device type, the operating system type, and the running service identifier; 3. The method of claim 1, wherein, generating the network device topology graph corresponding to the local area network according to the relevant information of the network devices within the IP address range of the local area network. The method comprises the following steps: generating a plurality of network access trajectories according to the network device topology graph and the traffic five-tuple, comprising:

4. The method of claim 1, wherein, associating the traffic five-tuple with the relevant information of the network devices within the IP address range of the local area network based on the destination IP address to obtain a correspondence between the traffic five-tuple and the relevant information of the network devices within the IP address range of the local area network; generating a plurality of network access trajectories based on the correspondence between the traffic five-tuple and the relevant information of the network devices within the IP address range of the local area network. The method comprises the following steps: clustering the plurality of trajectory line segments based on a density-based clustering algorithm with noise to obtain a plurality of trajectory clusters, comprising: taking any trajectory line segment as a current trajectory line segment, and obtaining a target neighborhood of the current trajectory line segment, wherein the distance between each trajectory line segment in the target neighborhood and the current trajectory line segment is less than or equal to a distance threshold; 5. The method of claim 4, wherein, taking the current trajectory line segment with a number of trajectory line segments in the target neighborhood greater than or equal to a number threshold as a core trajectory line segment; obtaining a density connection set of the core trajectory line segment; adding the density connection set of the core trajectory line segment to the trajectory cluster to which the core trajectory line segment belongs to obtain a plurality of trajectory clusters.

6. The method of claim 4, wherein, The method further comprises the following steps:

7. A detection device, characterized in that obtaining the perpendicular distance, parallel distance, and angle distance between the current trajectory line segment and other trajectory line segments, wherein the other trajectory line segments are the trajectory line segments other than the current trajectory line segment; determining the distance between the current trajectory line segment and the other trajectory line segments according to the perpendicular distance, parallel distance, and angle distance between the current trajectory line segment and the other trajectory line segments. Any two trajectory line segments in the density connection set of the core trajectory line segment are connected by density connection, and the trajectory line segments density reachable to the density connection set are contained in the density connection set. The method comprises the following steps: a first obtaining module for obtaining a network device topology graph and a traffic five-tuple corresponding to a local area network; a network access trajectory generation module for generating a plurality of network access trajectories according to the network device topology graph and the traffic five-tuple; a segmentation module for segmenting the plurality of network access trajectories based on a trajectory segmentation algorithm to obtain a plurality of trajectory line segments; The clustering module is configured to cluster the plurality of trajectory segments based on a density-based clustering algorithm with noise to obtain a plurality of trajectory clusters. The second obtaining module is configured to obtain a to-be-detected network access trajectory. The determining module is configured to determine that the to-be-detected network access trajectory is an abnormal network access trajectory if similarities between the to-be-detected network access trajectory and average trajectories of the trajectory clusters are all less than a similarity threshold.

8. An electronic device, comprising: The electronic device includes: at least one processor; and a memory connected with the at least one processor in communication; wherein The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the detection method of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing a processor to execute the detection method of any one of claims 1-6 when executed.

10. A computer program product, characterised in that, The computer program product includes a computer program that, when executed by a processor, implements the detection method according to any one of claims 1-6.

Images