Detection method, device, equipment and computer program product

Abstract

The invention provides a detection method, device and equipment and a computer program product. The method comprises the following steps: performing data conversion on acquired first traffic data to obtain image data corresponding to the first traffic data; inputting the image data into the convolutional neural network model to obtain a score value corresponding to the image data; and detecting abnormal traffic data in the first traffic data based on the score value. The abnormal traffic data in the traffic data can be accurately identified.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a detection method and device, equipment and computer program product. BACKGROUND

[0002] In the related art, when detecting abnormal traffic data, sufficient feature engineering needs to be performed on input data, that is, effective features need to be artificially designed and extracted. However, traffic data in a network usually has high complexity and dynamicity, and the feature engineering may be difficult to capture abnormal patterns in complex traffic. If the feature selection is improper, the model may not accurately identify abnormal traffic. SUMMARY

[0003] Embodiments of the present application provide a detection method, device, equipment and computer program product, which can accurately identify abnormal traffic data in traffic data.

[0004] The technical solution of the embodiments of the present application is as follows: The detection method provided by the embodiments of the present application comprises the following steps: performing data conversion on the obtained first traffic data to obtain image data corresponding to the first traffic data; inputting the image data into a convolutional neural network model to obtain a score value corresponding to the image data; detecting abnormal traffic data in the first traffic data based on the score value.

[0005] The detection device provided by the embodiments of the present application comprises the following units: a conversion unit, configured to perform data conversion on the obtained first traffic data to obtain image data corresponding to the first traffic data; an input unit, configured to input the image data into a convolutional neural network model to obtain a score value corresponding to the image data; a detection unit, configured to detect abnormal traffic data in the first traffic data based on the score value.

[0006] The electronic device provided by the embodiments of the present application comprises a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to execute the detection method provided by the embodiments of the present application when the computer program is run.

[0007] The computer program product provided by the embodiments of the present application comprises a computer program or computer executable instructions, and the computer program or computer executable instructions are executed by a processor to implement the detection method provided by the embodiments of the present application.

[0008] The embodiments of the present application have the following beneficial effects: By performing data conversion on the obtained first traffic data, image data is obtained, so as to take the image data as the input of the convolutional neural network model, and determine the score value corresponding to the image data by using the convolutional neural network model, thereby reducing the dependence on artificial feature engineering, and using the advantages of the convolutional neural network model in image recognition and pattern analysis to perform high-dimensional feature extraction and analysis on the traffic data, so as to obtain the corresponding score value, and detect the abnormal traffic data in the first traffic data based on the score value, which can accurately identify the abnormal traffic data in the traffic data. BRIEF DESCRIPTION OF DRAWINGS

[0009] Figure 1 A flowchart of a detection method provided by the embodiments of the present application is shown in the figure. Figure 2 A structural diagram of a detection device provided by the embodiments of the present application is shown in the figure. Figure 3 A structural diagram of an electronic device provided by the embodiments of the present application is shown in the figure. DETAILED DESCRIPTION

[0010] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be described in further detail below with reference to the accompanying drawings, and the described embodiments should not be regarded as limiting the present application. All other embodiments obtained by those skilled in the art without making creative efforts fall within the scope of protection of the present application.

[0011] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0012] In the following description, "some embodiments" are described, which describe a subset of all possible embodiments, but it can be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict. It should be pointed out that the terms "first\second" and the like involved in the embodiments of the present application are only used to distinguish similar objects and do not represent a specific order of the objects. It can be understood that "first\second" and the like can be interchanged in a specific order or sequence as allowed, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0013] There are mainly the following methods and technologies for abnormal traffic detection in SD-WAN networks.

[0014] 1. Rule-based intrusion detection system.

[0015] Traditional intrusion detection systems (IDS) typically identify abnormal traffic in a network through a predefined rule set. These rules are based on known attack patterns, specific traffic characteristics, or protocol behaviors. Once the traffic matches these rules, the IDS issues an alert. This approach is relatively simple to implement, the definition and modification of rules can be directly conducted by network administrators, and it has a high detection accuracy for known attacks. 2. Statistical-based anomaly traffic detection.

[0016] Statistical anomaly detection methods identify abnormal behavior by analyzing statistical characteristics of network traffic, such as mean, standard deviation, distribution patterns, etc. Common methods include threshold-based detection and clustering analysis. Threshold-based detection sets thresholds for certain statistical characteristics of traffic, and when actual traffic exceeds these thresholds, the system considers the traffic to be abnormal. This method is simple and easy to implement; clustering analysis classifies traffic data through unsupervised learning methods such as K-means clustering, and detects traffic clusters that are significantly different from normal traffic characteristics as anomalies.

[0017] 3. Machine learning-based detection methods.

[0018] With the development of machine learning technology, machine learning-based anomaly detection methods have gradually been applied to software-defined wide area network (SDWAN) traffic monitoring. For example, by collecting traffic data in real time in the SDWAN network environment, manually intervening at different network nodes to generate abnormal traffic data, then preprocessing the network anomaly traffic dataset, and based on the preprocessed abnormal traffic dataset, using the XGBoost library to build a classification model and calling the corresponding interface to train, tune, and evaluate the model, the type of abnormal traffic can be identified.

[0019] However, the above methods have the following disadvantages: 1. Traditional rule-based IDS relies on known threats, and the rule library is usually based on known attack signatures or behavior patterns, making it difficult to effectively detect unknown or variant attacks. Secondly, strict matching of rules can lead to false positives, especially in complex and diverse network environments, normal traffic behavior may be mistaken for abnormal behavior. Finally, the rule library needs to be constantly updated to respond to new threats, which increases the complexity of maintenance and management.

[0020] 2、Statistical-based anomaly traffic detection methods are first of high implementation complexity, requiring analysis of a large amount of historical traffic data and construction of complex statistical models; second, limited accuracy, statistical methods are sensitive to data distribution and noise, and are easily affected by non-anomalous factors, leading to false positives or false negatives.

[0021] 3、Using machine learning XGBoost model to identify abnormal traffic in SDWAN, this method first needs to perform sufficient feature engineering on the input data, that is, to manually design and extract effective features. The traffic data in the SDWAN network usually has high complexity and dynamics, and the traditional feature engineering method may be difficult to capture the abnormal patterns in complex traffic. If the feature selection is not proper, the model may not be able to accurately identify abnormal traffic. SDWAN traffic data is usually high-dimensional and may contain a large number of features and complex patterns. Although XGBoost performs well in handling low-dimensional data, its performance may decline when faced with high-dimensional data with time-series or spatial features. At the same time, when processing large-scale SDWAN traffic data, the training time and resource consumption of the model may become very high.

[0022] Therefore, based on this, the embodiments of the present application provide a detection method, Figure 1 A flowchart of a detection method provided by the embodiments of the present application is shown in Figure Figure 1 As shown in the figure, the method comprises: S101, performing data conversion on the acquired first traffic data to obtain image data corresponding to the first traffic data.

[0023] It should be noted that the detection method is applied to a detection device, which can be exemplified as a SDWAN anomaly traffic detection and alarm device based on a convolutional neural network (CNN). The detection device at least includes a data collection model, a data preprocessing module, a traffic image conversion module, a convolutional neural network model, an anomaly detection module, and an alarm module.

[0024] It should be noted that the first traffic data can be understood as any network traffic data, which is not limited here. As an example, the first traffic data can be understood as the traffic data of the SDWAN network. The number of first traffic data can be determined according to actual conditions, which is not limited here. The image data can be understood as the gray-scale image data corresponding to the first traffic data, and the number of image data can be determined according to actual conditions, which is not limited here. The image data can be two-dimensional image data. The pixels of the image data can be determined according to actual conditions, which is not limited here. As an example, the pixels of the image data are 100x100.

[0025] It should be noted that the data conversion of the obtained first flow data to obtain the image data corresponding to the first flow data can be understood as inputting the obtained first flow data into a flow image conversion module for data conversion to obtain the image data corresponding to the first flow data. In actual application, inputting the obtained first flow data into the flow image conversion module for data conversion to obtain the image data corresponding to the first flow data can be exemplarily illustrated as converting the first flow data into image data by using an image processing library Open Source Computer Vision Library (OpenCV). Among them, in the image generation process, an image enhancement technique is introduced, including rotation, scaling, and flipping to increase sample diversity and improve the robustness of the model.

[0026] S102, inputting the image data into a convolutional neural network model to obtain a score value corresponding to the image data.

[0027] It should be noted that inputting the image data into the convolutional neural network model can be understood as inputting the image data into the convolutional neural network model through a message queue. The convolutional neural network model can be understood as a trained convolutional neural network model. The convolutional neural network model is constructed using a keras deep learning framework, and its specific architecture includes an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer. The input layer is a 100x100x1 grayscale image. The convolutional layer 1 is 32 3x3 convolutional kernels with a step of 1 and a rectified linear unit (ReLU) as the activation function. The pooling layer 1 is a 2x2 maximum pooling with a step of 2. The convolutional layer 2 is 64 3x3 convolutional kernels with a step of 1 and a ReLU as the activation function. The pooling layer 2 is a 2x2 maximum pooling with a step of 2. The convolutional layer 3 is 128 3x3 convolutional kernels with a step of 1 and a ReLU as the activation function. The fully connected layer 1 includes 128 neurons with a ReLU as the activation function. The fully connected layer 2 (output layer) has a number of neurons equal to the number of abnormal types, and uses a Sigmoid activation function to output an abnormal score. The score value can be understood as an abnormal score value output by inputting the image data into the convolutional neural network model, and the abnormal score value can also be understood as a Sigmoid value.

[0028] It should be noted that the convolutional neural network model includes a model compilation, a model training, a model performance evaluation and optimization stage, and a model architecture optimization stage. In the model compilation stage, binary_crossentropy is selected as the loss function, Adam optimizer is used, and appropriate learning rate is set to balance the convergence speed and accuracy of the model. In the model training stage, the model is trained using the cross-validation method, and the early stopping strategy is set during the training process to prevent overfitting, and the ImageDataGenerator of Keras is used for data augmentation to improve the generalization ability of the model. In the model performance evaluation and optimization stage, the accuracy, precision, recall and F1 score of the model are evaluated using test data, and the model is optimized according to the evaluation results. The goal of model optimization is to improve the performance of the model by adjusting the model architecture and hyperparameters. Grid search (Grid Search) or random search (Random Search) can be used to optimize the hyperparameters on the validation set, and model architecture optimization includes increasing or decreasing the convolutional layer, adjusting the convolution kernel size, adding regularization layers, etc.

[0029] S103, detecting abnormal traffic data in the first traffic data based on the score value.

[0030] It should be noted that detecting abnormal traffic data in the first traffic data based on the score value can be understood as inputting the score value into the anomaly detection module to detect abnormal traffic data in the first traffic data.

[0031] It should be noted that detecting abnormal traffic data in the first traffic data based on the score value can be understood as classifying the first traffic data according to the score value to obtain normal traffic data and abnormal traffic data.

[0032] The scheme of the embodiment of the application reduces the dependence on manual feature engineering by converting the obtained first traffic data into image data to input the image data into the convolutional neural network model and using the convolutional neural network model to determine the score value corresponding to the image data. The advantages of the convolutional neural network model in image recognition and pattern analysis are used to perform high-dimensional feature extraction and analysis on the traffic data to obtain the corresponding score value. The abnormal traffic data in the first traffic data is detected based on the score value, which can accurately identify the abnormal features in the traffic data.

[0033] In the embodiment of the application, the process of detecting abnormal traffic data in the first traffic data based on the score value specifically includes: finding a first target score value greater than the first value in the score value; and taking the traffic data corresponding to the first target score value as abnormal traffic data.

[0034] It should be noted that the first value can be understood as a preset threshold. The first value can be determined according to actual conditions, which is not limited herein. The first target score value can be understood as a score value greater than the preset threshold. The traffic data corresponding to the first target score value can be understood as the abnormal traffic data.

[0035] In the embodiment of the application, the method further comprises: finding a second target score value less than or equal to the first value in the score value, and taking the traffic data corresponding to the second target score value as normal traffic data in the first traffic data.

[0036] It should be noted that the second target score value can be understood as a score value less than or equal to the preset threshold. The traffic data corresponding to the second target score value can be understood as the normal traffic data in the first traffic data.

[0037] In the embodiment of the application, the method further comprises: respectively acquiring historical behavior data corresponding to the first traffic data and state data corresponding to the network where the first traffic data is located; and adjusting the first value based on the historical behavior data and the state data.

[0038] It should be noted that the first value (the preset threshold) can be dynamically adjusted. The historical behavior data can be understood as the historical behavior of the first traffic data. The state data can be understood as the current network state data, and the current network is the network where the first traffic data is located, which can be exemplified as an SDWAN network.

[0039] The scheme of the embodiment of the application can dynamically adjust the first value through the historical behavior data and the state data, and can dynamically distinguish the abnormal traffic data and the normal traffic data according to actual conditions. For example, when detecting an increase in network attack activities, the threshold can be reduced to improve sensitivity.

[0040] In the embodiment of the application, the method further comprises: in the case of detecting abnormal traffic data in the first traffic data based on the score value, outputting an alarm information; and the alarm information is used to indicate that there is abnormal traffic data in the first traffic data.

[0041] It should be noted that the case of detecting abnormal traffic data in the first traffic data based on the score value can be understood as the case of identifying abnormal traffic data by the anomaly detection module. Outputting the alarm information can be understood as triggering the alarm and notifying the network administrator.

[0042] In the embodiment of the present application, the process of outputting the alarm information specifically comprises: determining an abnormal level corresponding to the abnormal traffic data based on the score value; selecting a corresponding target alarm strategy from the preset alarm strategy according to the abnormal level, and outputting the alarm information based on the target alarm strategy.

[0043] It should be noted that the abnormal level at least includes a low abnormal level and a high abnormal level. Determining the abnormal level corresponding to the abnormal traffic data based on the score value can be understood as: finding a first target score value greater than a first value from the score value, and sorting the first target score value in ascending order, and corresponding the abnormal traffic data of the score value greater than a second value in the first target score value to the high abnormal level, and corresponding the abnormal traffic data of the score value less than or equal to the second value in the first target score value to the low abnormal level.

[0044] It should be noted that the preset alarm strategy includes low-level alarm and high-level alarm. Selecting a corresponding target alarm strategy from the preset alarm strategy according to the abnormal level can be understood as: selecting a low-level alarm strategy when the abnormal level is a low abnormal level; selecting a high-level alarm strategy when the abnormal level is an alarm abnormal level. The low-level alarm strategy can be understood as notifying the administrator through an email or a console, and the high-level alarm strategy can be understood as triggering an SMS notification or a real-time pop-up warning.

[0045] In the embodiment of the present application, the method further comprises: in the case of detecting abnormal traffic data in the first traffic data based on the score value, performing a first operation on the abnormal traffic data; the first operation at least includes blocking the abnormal traffic data, adjusting the routing strategy of the network where the abnormal traffic data is located, or limiting the abnormal traffic data.

[0046] It should be noted that the case of detecting abnormal traffic data in the first traffic data based on the score value can be understood as the case of identifying abnormal traffic data by the anomaly detection module. Performing a first operation on the abnormal traffic data can be understood as automatically performing a first operation on the abnormal traffic data in the case of detecting the abnormal traffic data. The first operation at least includes blocking the abnormal traffic data, adjusting the routing strategy of the network where the abnormal traffic data is located, or limiting the abnormal traffic data. In actual application, the first operation can also be understood as blocking the abnormal traffic, adjusting the routing strategy or limiting the flow. Performing a first operation on the abnormal traffic data can be understood as performing the first operation using the Application Programming Interface (API) interface of the SDWAN controller.

[0047] In the embodiment of the present application, in the case of detecting abnormal traffic data, the abnormal traffic data can also be marked or adjusted and optimized by subsequent event analysis results, so as to improve the effectiveness of the alarm.

[0048] In the embodiment of the present application, before the acquired first traffic data is converted, the method further comprises: collecting second traffic data corresponding to the SDWAN; the second traffic data comprises normal traffic data and abnormal traffic data; performing data aggregation on the traffic data of the same flow in the second traffic data, and performing segmentation according to a preset time window to obtain the first traffic data; the traffic data of the same flow at least comprises data of the same source Internet Protocol (IP), destination IP, source port, destination port and protocol type in the second traffic data.

[0049] It should be noted that the second traffic data can be understood as the original traffic data of the SDWAN. Collecting the second traffic data of the SDWAN can be understood as collecting the second traffic data of the SDWAN through a data collection module. Collecting the second traffic data corresponding to the SDWAN can be understood as collecting the second traffic data corresponding to the SDWAN through the data collection module. In actual application, collecting the second traffic data corresponding to the SDWAN through the data collection module can be exemplarily illustrated as using a libpcap library or a similar efficient data capture library to capture data packets, and in the SDWAN environment, a data collection function provided by the SDWAN device can also be selected, or data capture can be performed through an API of the SDWAN controller. The second traffic data comprises normal traffic data and abnormal traffic data, which can be understood as that the collected second traffic data needs to cover the normal traffic data and the abnormal traffic data. The proportion of the normal traffic data and the abnormal traffic data can be determined according to actual conditions, which is not limited herein, and as an example, the proportion of the normal traffic data and the abnormal traffic data can be controlled at 1:1 through a human intervention mode.

[0050] It should be noted that in the process of performing data aggregation on the traffic data of the same flow in the second traffic data, data preprocessing of the second traffic data is further included, and the data preprocessing at least comprises data cleaning, feature extraction and data normalization. The data preprocessing also comprises data aggregation.

[0051] It should be noted that the data preprocessing of the second traffic data can be understood as the data preprocessing of the second traffic data by the data preprocessing module. The first traffic data is the traffic data obtained by preprocessing the second traffic data. The data preprocessing at least includes data cleaning, feature extraction, data normalization, and data aggregation and windowing; data cleaning mainly removes data affecting the training results of the model, including the processing of repeated values, missing values and abnormal values. For repeated values, directly remove, for missing values and abnormal values, use the method of median filling to fill, and at the same time delete the records with more missing values and abnormal values to avoid affecting the CNN training result. Feature extraction is to extract key features from network traffic. The features include basic features, statistical features and time series features. The basic features include source IP, destination IP, source port, destination port, protocol type, etc. The statistical features include traffic size, packet number, traffic direction, and time series features include traffic change rate and periodicity. Data aggregation and windowing is to aggregate data packets of the same flow (same source IP, destination IP, source port, destination port and protocol type) to generate flow records, and to cut the data according to the preset time window to generate time series data, so as to improve the dimension and time sequence of the data. Data normalization is to normalize different features to the same numerical range to avoid inconsistent feature scales affecting the performance of the CNN model. The embodiment of the application uses Min-Max normalization to scale the numerical features to a fixed interval [0, 1].

[0052] The scheme of the embodiment of the application preprocesses the second traffic data to adapt to the input requirements of the convolutional neural network, so as to facilitate subsequent processing of the preprocessed first traffic data by the convolutional neural network.

[0053] For the convenience of understanding, the above scheme is exemplarily described. The convolutional neural network (CNN) in deep learning is introduced to identify and detect abnormal traffic in SD-WAN. CNN can automatically extract features from raw data, reducing the dependence of related technologies on manual feature engineering. Secondly, CNN has high computational efficiency when processing high-dimensional and complex data, and can quickly identify abnormal features in traffic. The existing technology usually needs a large amount of computing resources or complex rule matching, which leads to the inability to realize the timeliness of detection in a large-scale and high-speed SD-WAN environment. Finally, the embodiment of the application introduces CNN, uses its superior performance in image recognition and pattern analysis, extracts and analyzes high-dimensional features of traffic data, and further reduces the false positive rate and the false negative rate of the existing technical solutions by dynamically adjusting the abnormal score threshold.

[0054] The above CNN-based SDWAN abnormal traffic monitoring and alarming device mainly includes six modules.

[0055] 1. Data collection module.

[0056] The data collection module is responsible for capturing and processing traffic data of the SDWAN network. Packet capture can be performed using the libpcap library or similar efficient data capture libraries. In the SDWAN environment, the data collection function provided by the SDWAN device can also be selected, or data capture can be performed through the API of the SDWAN controller. The collected traffic data needs to cover normal traffic and abnormal traffic, and the proportion of abnormal traffic and normal traffic can be controlled at 1:1 through manual intervention mode, so as to serve as the input of the subsequent CNN.

[0057] 2. Data preprocessing module.

[0058] 1. The data preprocessing module is responsible for preprocessing the network traffic collected by the data collection module to adapt to the input requirements of the CNN. The preprocessing process includes data cleaning, feature extraction, data normalization, data aggregation and windowing. Data cleaning mainly removes data that affects the training results of the model, including the processing of repeated values, missing values and abnormal values. For repeated values, they are directly removed. For missing values and abnormal values, the median filling method is used to fill them, and records with many missing values and abnormal values are also deleted to avoid affecting the CNN training results. Feature extraction is to extract key features from network traffic. The features include basic features, statistical features and time series features. The basic features include source IP, destination IP, source port, destination port, protocol type, etc. The statistical features include traffic size, packet number, traffic direction, and the time series features include traffic change rate and periodicity. Data aggregation and windowing are to aggregate the data packets of the same flow (same source IP, destination IP, source port, destination port and protocol type) to generate flow records, and to cut the data according to the preset time window to generate time series data, so as to improve the dimension and time sequence of the data. Data normalization is to normalize different features to the same numerical range to avoid inconsistent feature scales affecting the performance of the CNN model. The Min-Max normalization method is used in the embodiments of the present application to scale the numerical features to a fixed interval [0, 1].

[0059] 3. Traffic image conversion module.

[0060] The task of the traffic image conversion module is to convert the network traffic data processed by the data preprocessing module into two-dimensional images suitable for CNN processing. The preprocessed multi-dimensional features are mapped to a 100x100 pixel grayscale image, with the x-axis representing the source IP, the y-axis representing the destination IP, and the pixel brightness representing the traffic size. Linear interpolation is used to fill in the blank pixels to ensure image continuity. The image processing library OpenCV is used to convert the two-dimensional matrix to a grayscale image. At the same time, image enhancement techniques are introduced during image generation, including rotation, scaling, and flipping to increase sample diversity and improve model robustness. Finally, the generated image data is sent to the CNN model for training through the message queue.

[0061] 4. Convolutional neural network model.

[0062] The convolutional neural network (CNN) model is the core part of the present application for analyzing and detecting abnormal network traffic. This module processes traffic images, extracts features, and identifies potential abnormal traffic patterns. The image data received from the traffic image conversion module needs to be divided into training and test sets. The present application uses the Keras deep learning framework to build a CNN model. The designed CNN architecture includes an input layer, convolutional layers, pooling layers, fully connected layers, and an output layer, as follows.

[0063] Input layer: 100x100x1 grayscale image.

[0064] Convolutional layer 1: 32 3x3 convolutional kernels, step 1, activation function ReLU.

[0065] Pooling layer 1: 2x2 max pooling, step 2.

[0066] Convolutional layer 2: 64 3x3 convolutional kernels, step 1, activation function ReLU.

[0067] Pooling layer 2: 2x2 max pooling, step 2.

[0068] Convolutional layer 3: 128 3x3 convolutional kernels, step 1, activation function ReLU.

[0069] Fully connected layer 1: contains 128 neurons, activation function ReLU.

[0070] Fully connected layer 2 (output layer): number of neurons equal to the number of abnormal types, uses Sigmoid activation function to output abnormal score.

[0071] The model compilation phase selects binary_crossentropy as the loss function, uses the Adam optimizer, and sets an appropriate learning rate to balance the convergence speed and accuracy of the model. The model training phase uses cross-validation to train the model, sets an early stopping strategy during training to prevent overfitting, and uses Keras' ImageDataGenerator for data augmentation to improve the model's generalization ability. The model performance evaluation and optimization phase evaluates the model's accuracy, precision, recall, and F1 score using test data, and optimizes the model based on the evaluation results. The goal of model optimization is to improve the performance of the model by adjusting the model architecture and hyperparameters. Grid Search or Random Search can be used to optimize hyperparameters on the validation set, and model architecture optimization includes increasing or decreasing convolutional layers, adjusting convolution kernel size, adding regularization layers, etc.

[0072] 5. Anomaly detection module.

[0073] The anomaly detection module receives the output of the CNN model and classifies the traffic based on the pre-set threshold. Generally, traffic below the threshold is considered normal, while traffic above the threshold is marked as abnormal. In addition, the module also supports fine-grained classification of traffic samples to identify different types of anomalies. This module includes anomaly scoring and classification.

[0074] Anomaly scoring: The Sigmoid value output by the CNN model represents the anomaly probability of the traffic sample. By setting a threshold, traffic samples are divided into normal and abnormal. If there are multiple types of attacks, consider the probability of different types of attacks output by the multi-classification model, and set different thresholds according to actual needs.

[0075] Dynamic threshold adjustment: The threshold can be dynamically adjusted according to the historical behavior of the traffic and the current network state. For example, when detecting an increase in network attack activity, the threshold can be lowered to increase sensitivity.

[0076] Classification optimization: Combine the context information of the traffic (such as the historical behavior of the source IP, whether the destination is a high-risk area, etc.) to optimize the classification strategy of abnormal traffic. Bayesian inference or fuzzy logic methods can be introduced in the classification module to comprehensively evaluate abnormal traffic.

[0077] 6. Alarm module.

[0078] When the anomaly detection module identifies abnormal traffic, the alarm module will trigger an alarm according to the preset strategy to inform the network administrator. The alarm mode can include email, SMS, console pop-up window, etc. Different levels of alarms are triggered according to the level of the anomaly score. Low-level alarms can notify the administrator through email or console, and high-level alarms can trigger SMS notification or real-time pop-up window warning. In addition, the alarm module contains timely response to abnormal traffic alarms, which can take automatic response measures such as blocking suspicious traffic, adjusting routing strategy or limiting flow according to the anomaly score of the traffic, which can be realized by dynamically adjusting the API interface of the SD-WAN controller to ensure a quick response when an anomaly is detected. At the same time, a feedback mechanism is introduced, which continuously adjusts and optimizes the alarm strategy through manual labeling by the network administrator or subsequent event analysis results, so as to improve the effectiveness of the alarm.

[0079] Compared with the existing network traffic anomaly detection method relying on manual feature extraction, the scheme of the embodiment of the present application uses CNN in deep learning to extract features, which can automatically learn high-level abstract features from raw network traffic data. Through multi-layer convolution and pooling operation, CNN can capture complex traffic patterns and correlations, improving the automation and accuracy of feature extraction.

[0080] Compared with the related art, the scheme of the embodiment of the present application can automatically adjust and update model parameters through continuous learning and self-adaptive mechanism, maintain sensitivity and detection ability to new threats and traffic patterns, and solve the problem of frequent manual intervention and adjustment when facing changing network traffic and emerging threats in SDWAN environment.

[0081] The scheme of the embodiment of the present application is more suitable for processing high-dimensional and complex pattern data, and can better capture complex patterns in traffic data through hierarchical feature extraction, and has better performance.

[0082] Correspondingly, the embodiment of the present application also provides a detection device, Figure 2 A structural schematic diagram of a detection device provided by the embodiment of the present application is shown in Figure 2 As shown in the figure, the detection device 200 comprises: A conversion unit 201 is configured to perform data conversion on the acquired first traffic data to obtain image data corresponding to the first traffic data; An input unit 202 is configured to input the image data into a convolutional neural network model to obtain a score value corresponding to the image data; A detection unit 203 is configured to detect abnormal traffic data in the first traffic data based on the score value.

[0083] Optionally, the detection unit 203 is further configured to: find a first target score value greater than the first value in the score values; and take the flow data corresponding to the first target score value as the abnormal flow data.

[0084] Optionally, the detection apparatus 200 further includes an adjustment unit configured to: acquire historical behavior data corresponding to the first flow data and state data corresponding to a network in which the first flow data is located; and adjust the first value based on the historical behavior data and the state data.

[0085] Optionally, the detection apparatus 200 further includes an output unit configured to: output an alarm information in a case where the abnormal flow data in the first flow data is detected based on the score values; and the alarm information is used to indicate that the abnormal flow data exists in the first flow data.

[0086] Optionally, the output unit is further configured to: determine an abnormal level corresponding to the abnormal flow data based on the score values; select a target alarm strategy corresponding to the abnormal level from a preset alarm strategy; and output the alarm information based on the target alarm strategy.

[0087] Optionally, the detection apparatus 200 further includes an execution unit configured to: perform a first operation on the abnormal flow data in a case where the abnormal flow data in the first flow data is detected based on the score values; and the first operation at least includes blocking the abnormal flow data, adjusting a routing strategy of a network in which the abnormal flow data is located, or limiting the abnormal flow data.

[0088] Optionally, before the acquired first flow data is subjected to data conversion, the detection apparatus 200 further includes a collection unit and a data preprocessing unit. The collection unit is configured to collect second flow data corresponding to a software-defined wide area network (SDWAN); and the second flow data includes normal flow data and abnormal flow data. The data preprocessing unit is configured to: perform data aggregation on flow data of a same flow in the second flow data; and divide the flow data according to a preset time window to obtain the first flow data; and the flow data of the same flow at least includes data of a same source IP, a same destination IP, a same source port, a same destination port, and a same protocol type in the second flow data.

[0089] Embodiments of the present application also provide an electronic device, Figure 3 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 3. Figure 3 As shown in FIG. 3, the electronic device 300 includes a processor 301 and a memory 303, and optionally, the electronic device 300 can further include a communication bus 302.

[0090] In the process of the specific embodiment, the processor 301 can be at least one of an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing image processing device (DSPD), a programmable logic image processing device (PLD), a field programmable gate array (FPGA), a CPU, a controller, a microcontroller, and a microprocessor. It can be understood that, for different devices, the electronic device for implementing the function of the processor can also be other, and the embodiment is not limited specifically.

[0091] In the embodiment of the present application, the communication bus 302 is used to realize the connection and communication between the processor 301 and the memory 303; when the processor 301 executes the running program stored in the memory 303, the following detection method is realized: perform data conversion on the obtained first traffic data to obtain image data corresponding to the first traffic data; input the image data into a convolutional neural network model to obtain a score value corresponding to the image data; detect abnormal traffic data in the first traffic data based on the score value.

[0092] Further, the processor 301 is further configured to find a first target score value greater than a first value in the score value; and take the traffic data corresponding to the first target score value as the abnormal traffic data.

[0093] Further, the processor 301 is further configured to obtain historical behavior data corresponding to the first traffic data and state data corresponding to a network in which the first traffic data is located; and adjust the first value based on the historical behavior data and the state data.

[0094] Further, the processor 301 is further configured to output an alarm information in a case where the abnormal traffic data in the first traffic data is detected based on the score value; and the alarm information is used to indicate that there is abnormal traffic data in the first traffic data.

[0095] Further, the processor 301 is further configured to determine an abnormality level corresponding to the abnormal traffic data based on the score value, select a target alarm strategy corresponding to the abnormality level from a preset alarm strategy, and output the alarm information based on the target alarm strategy.

[0096] Further, the processor 301 is further configured to perform a first operation on the abnormal traffic data if the abnormal traffic data is detected in the first traffic data based on the score value, wherein the first operation at least includes blocking the abnormal traffic data, adjusting a routing strategy of a network where the abnormal traffic data is located, or limiting the abnormal traffic data.

[0097] Further, before the first traffic data is acquired and data-converted, the processor 301 is further configured to acquire second traffic data corresponding to the SDWAN, wherein the second traffic data includes normal traffic data and abnormal traffic data, data of a same flow in the second traffic data is aggregated and divided according to a preset time window to obtain the first traffic data, and the data of the same flow at least includes data of a same source IP, a same destination IP, a same source port, a same destination port, and a same protocol type in the second traffic data.

[0098] The embodiment of the present application provides a storage medium having a computer program stored thereon, the computer readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors, and the computer program implements the detection method.

[0099] Based on the above embodiment, the embodiment of the present application provides a computer program product, including a computer program, the computer program can be executed by one or more processors, and the computer program implements the detection method.

[0100] It should be noted that, in this document, the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusions, so that processes, methods, articles, or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or include elements inherent to such processes, methods, articles, or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article, or device including the element.

[0101] Those skilled in the art can clearly understand the above-mentioned embodiment method can be realized by means of software and the necessary general hardware platform, of course, can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present disclosure essentially or say the part of the related art that contributes to the part can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for causing an image display device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the method described in various embodiments of the present disclosure.

[0102] The above merely describes preferred embodiments of the present application, but is not intended to limit the scope of protection of the present application.

Claims

1. A detection method, characterized in that, The method includes: The acquired first traffic data is converted to obtain the image data corresponding to the first traffic data. The image data is input into a convolutional neural network model to obtain the score value corresponding to the image data; Abnormal traffic data in the first traffic data is detected based on the score value.

2. The method according to claim 1, characterized in that, The step of detecting abnormal traffic data in the first traffic data based on the scoring value includes: Find the first target score value that is greater than the first value among the score values; The traffic data corresponding to the first target score value is used as the abnormal traffic data.

3. The method according to claim 2, characterized in that, The method further includes: The historical behavior data corresponding to the first traffic data and the status data corresponding to the network where the first traffic data is located are obtained respectively. The first value is adjusted based on the historical behavior data and the state data.

4. The method according to claim 1, characterized in that, The method further includes: If abnormal traffic data is detected in the first traffic data based on the score value, an alarm message is output; the alarm message is used to indicate that abnormal traffic data exists in the first traffic data.

5. The method according to claim 4, characterized in that, The output alarm information includes: The anomaly level corresponding to the abnormal traffic data is determined based on the scoring value; Based on the anomaly level, a corresponding target alarm strategy is selected from the preset alarm strategies, and the alarm information is output based on the target alarm strategy.

6. The method according to claim 1, characterized in that, The method further includes: If abnormal traffic data is detected in the first traffic data based on the score value, a first operation is performed on the abnormal traffic data; the first operation includes at least blocking the abnormal traffic data, adjusting the routing policy of the network where the abnormal traffic data is located, or restricting the abnormal traffic data.

7. The method according to claim 1, characterized in that, Before performing data conversion on the acquired first traffic data, the process also includes: Collect second traffic data corresponding to Software Defined Wide Area Network (SDWAN); the second traffic data includes normal traffic data and abnormal traffic data. The traffic data of the same level in the second traffic data is aggregated and divided according to a preset time window to obtain the first traffic data; the traffic data of the same level includes at least the data of the same source Internet Protocol IP, destination IP, source port, destination port and protocol type in the second traffic data.

8. A detection device, characterized in that, The device includes: A conversion unit is used to convert the acquired first traffic data to obtain image data corresponding to the first traffic data. An input unit is used to input the image data into a convolutional neural network model to obtain a score value corresponding to the image data; The detection unit is used to detect abnormal traffic data in the first traffic data based on the score value.

9. An electronic device, characterized in that, include: The processor and the memory used to store computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 7.

10. A computer program product comprising a computer program or computer-executable instructions, characterized in that, When the computer program or computer-executable instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images