Traffic detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a flow detection method and device, electronic equipment and a storage medium, and relates to the technical field of flow detection, and the method comprises the steps: obtaining the time sequence data of the bandwidth flow of a target domain name to be detected, extracting a target detection segment from the time sequence data, converting the target detection segment into a first time sequence image, and outputting the first time sequence image; then at least one second time sequence image representing a normal traffic mode is obtained, the first time sequence image and the second time sequence image are jointly input into a multi-mode large model for comparative analysis, a corresponding detection result is output, and if the detection result represents that the bandwidth traffic of the target domain name is not abnormal, the first time sequence image and / or the target detection section are / is input into the multi-mode large model for comparative analysis; the data is added into a normal flow mode data set for generating a second time sequence image, so that the limitation of single-mode analysis is effectively overcome; and meanwhile, the problem that the detection accuracy is reduced due to concept drift is effectively solved, and continuous and reliable anomaly detection in a dynamic network environment is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of flow detection, in particular to a flow detection method, a flow detection device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] In the field of Internet network operation and management, real-time monitoring and anomaly detection of domain bandwidth traffic are crucial for ensuring network performance and security. Abnormal traffic, such as traffic surge or sudden decrease caused by network attacks or device failures, if not discovered in time, may lead to service interruption or user experience degradation.

[0003] However, domain bandwidth traffic anomaly detection technology still faces many challenges in practical application. For example, based on single modal analysis, it is difficult to comprehensively and accurately capture complex abnormal patterns, resulting in insufficient detection accuracy and robustness; secondly, the network is highly dynamic, and the "normal" behavior pattern of domain bandwidth traffic is not immutable, but will evolve slowly with business development, user behavior changes and other factors. In this case, there is a lack of effective adaptive mechanism, which cannot continuously track and learn the dynamic changes of normal behavior benchmarks, thus easily leading to high false positive and false negative rates and poor adaptability. SUMMARY

[0004] The embodiments of the present application provide a flow detection method, device, electronic device and computer readable storage medium to solve or partially solve the problem of low detection accuracy, poor robustness, high false positive and false negative rates caused by relying on single modal analysis to comprehensively capture complex abnormal patterns and lacking effective adaptive mechanism to dynamically track normal behavior evolution.

[0005] The embodiments of the present application disclose a flow detection method, comprising: obtaining time series data corresponding to target domain bandwidth traffic to be detected; extracting a corresponding target detection segment from the time series data, and converting the target detection segment into a corresponding first time series image; obtaining at least one second time series image representing a normal traffic pattern, and inputting the first time series image and the second time series image into a multi-modal large model for comparison and analysis, and outputting a detection result for the target domain bandwidth traffic; if the detection result represents that the target domain bandwidth traffic is normal, adding the first time series image and / or the target detection segment to a normal traffic pattern data set used to generate the second time series image.

[0006] In some possible implementation manners, the target detection section includes flow data points, and the converting the target detection section into a corresponding first time sequence image includes: a corresponding coordinate system is constructed with time as the horizontal axis and flow values as the vertical axis; the flow data points in the target detection section are plotted and connected in the coordinate system in chronological order, to construct a corresponding line graph; coordinate axis labels and a title are added to the line graph, and the line graph is saved in a preset format of an image file, to generate the first time sequence image corresponding to the target detection section.

[0007] In some possible implementation manners, the first time sequence image and the second time sequence image are jointly input into a multimodal large model for comparison analysis, to output a detection result for the bandwidth flow of the target domain name, including: first statistical features corresponding to the target detection section are extracted; second statistical features representing the normal flow mode are obtained; the first time sequence image and the second time sequence image are jointly input into a multimodal large model for comparison analysis, to obtain a corresponding image comparison analysis result; the first statistical features and the second statistical features are jointly input into the multimodal large model for comparison analysis, to obtain a corresponding statistical comparison analysis result; flow analysis is performed by using the comparison analysis result and the statistical comparison analysis result, and based on the analysis result, a detection result for the bandwidth flow of the target domain name is output.

[0008] In some possible implementation manners, the extracting the first statistical features corresponding to the target detection section includes: a plurality of flow data points included in the target detection section are obtained; the flow data points are subjected to measurement calculation of central tendency, dispersion degree, and distribution form, a plurality of feature values obtained by the measurement calculation are output, and the feature values are taken as the corresponding first statistical features; The feature values include at least three of the following types: mean, median, standard deviation, interquartile range, maximum value, minimum value, skewness, and kurtosis.

[0009] In some possible implementation manners, the flow analysis is performed by using the comparison analysis result and the statistical comparison analysis result, and based on the analysis result, the detection result for the bandwidth flow of the target domain name is output, including: a decision prompt word template used to guide the multimodal large model to perform abnormality determination is obtained; inputting the comparison analysis result and the statistical comparison analysis result into the decision prompt word template to generate a corresponding integrated prompt word; inputting the integrated prompt word into the multi-modal large model for traffic analysis to output a detection result directly generated based on the integrated prompt word for representing whether the bandwidth traffic of the target domain name is abnormal.

[0010] In some feasible implementation manners, further comprising: obtaining historical time series data corresponding to historical domain name bandwidth traffic; obtaining a control limit for the historical time series data, and screening a time series segment in which all data points are within the control limit from the historical time series data, and integrating the time series segment into a normal traffic pattern data set.

[0011] In some feasible implementation manners, the control limit at least includes one of a moving average control upper limit, a moving average control lower limit, and a moving range control upper limit, and the obtaining of the control limit for the historical time series data comprises: calculating a moving average value sequence and a moving range sequence corresponding to the historical time series data; calculating a first average value of the moving average value sequence and a second average value of the moving range sequence; calculating the moving average control upper limit and the moving average control lower limit by using the first average value and a first preset coefficient; calculating the moving range control upper limit by using the second average value and a second preset coefficient; wherein the moving average control upper limit and the moving average control lower limit jointly constitute an allowed fluctuation interval, and the allowed fluctuation interval is used to judge whether the moving average value of the traffic data point in the time series data deviates from the normal level; and the moving range control upper limit is used to judge whether the fluctuation amplitude between adjacent traffic data points is abnormal.

[0012] The embodiment of the application further discloses a traffic detection device, comprising: a data acquisition module configured to acquire time series data corresponding to target domain name bandwidth traffic to be detected; a conversion module configured to extract a corresponding target detection segment from the time series data and convert the target detection segment into a corresponding first time series image; a comparison analysis module configured to acquire at least one second time series image representing a normal traffic pattern, and input the first time series image and the second time series image into a multi-modal large model for comparison analysis to output a detection result for the target domain name bandwidth traffic; an updating module configured to, if the detection result indicates that the target domain name bandwidth traffic is normal, add the first time sequence image and / or the target detection segment into a normal traffic pattern data set used to generate the second time sequence image.

[0013] In some possible implementation manners, the target detection segment includes traffic data points, and the converting module is specifically configured to: construct a corresponding coordinate system with time as the horizontal axis and traffic value as the vertical axis; connect the traffic data points in the target detection segment in the coordinate system in time sequence to construct a corresponding line graph; add coordinate axis labels and a title to the line graph, and save the line graph in a preset format of an image file to generate a first time sequence image corresponding to the target detection segment.

[0014] In some possible implementation manners, the comparison and analysis module is specifically configured to: extract first statistical features corresponding to the target detection segment; obtain second statistical features representing the normal traffic pattern; input the first time sequence image and the second time sequence image into a multi-modal large model for comparison and analysis to obtain a corresponding image comparison and analysis result; input the first statistical features and the second statistical features into the multi-modal large model for comparison and analysis to obtain a corresponding statistical comparison and analysis result; perform traffic analysis by using the comparison and analysis result and the statistical comparison and analysis result, and output a detection result for the target domain name bandwidth traffic based on the analysis result.

[0015] In some possible implementation manners, the comparison and analysis module is specifically configured to: obtain a plurality of traffic data points included in the target detection segment; perform measurement calculation on the traffic data points in terms of central tendency, dispersion degree, and distribution form, output a plurality of feature values obtained by the measurement calculation, and use the feature values as corresponding first statistical features; The feature values include at least three of the following types: mean, median, standard deviation, interquartile range, maximum value, minimum value, skewness, and kurtosis.

[0016] In some possible implementation manners, the comparison and analysis module is specifically configured to: obtain a decision prompt word template used to guide the multi-modal large model to perform abnormality determination; input the comparison and analysis result and the statistical comparison and analysis result into the decision prompt word template to generate a corresponding integrated prompt word. The integrated prompt word is input into the multi-modal large model for traffic analysis, and a detection result for directly representing whether the bandwidth traffic of the target domain name is abnormal is output.

[0017] In some possible implementation manners, the method further includes: a historical data acquisition module, configured to acquire historical time series data corresponding to historical domain name bandwidth traffic; a data set construction module, configured to acquire a control limit for the historical time series data, and filter out a time series segment in which all data points are within the control limit from the historical time series data, and integrate the time series segment into a normal traffic mode data set.

[0018] In some possible implementation manners, the control limit at least includes one of a moving average control upper limit, a moving average control lower limit, and a moving range control upper limit, and the data set construction module is specifically configured to: calculate a moving average value sequence and a moving range sequence corresponding to the historical time series data; calculate a first average value of the moving average value sequence and a second average value of the moving range sequence; calculate the moving average control upper limit and the moving average control lower limit by using the first average value and a first preset coefficient; calculate the moving range control upper limit by using the second average value and a second preset coefficient; The moving average control upper limit and the moving average control lower limit jointly constitute an allowed fluctuation interval, and the allowed fluctuation interval is used to determine whether a moving average value of a traffic data point in the time series data deviates from a normal level; and the moving range control upper limit is used to determine whether a fluctuation amplitude between adjacent traffic data points is abnormal.

[0019] An electronic device is also disclosed in the embodiment of the application, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory complete communication with each other through the communication bus. The memory is used to store a computer program. The processor is used to execute the program stored on the memory, and implement the method described in the embodiment of the application.

[0020] A computer readable storage medium is also disclosed in the embodiment of the application, and the computer readable storage medium stores instructions, when executed by one or more processors, causes the processor to execute the method described in the embodiment of the application.

[0021] The embodiment of the application has the following advantages: In the embodiment of the present application, in the process of detecting the flow, the time sequence data corresponding to the target domain name bandwidth flow to be detected is obtained, the corresponding target detection segment is extracted from the time sequence data, the target detection segment is converted into a corresponding first time sequence image, at least one second time sequence image representing a normal flow mode is obtained, and the first time sequence image and the second time sequence image are jointly input into a multi-modal large model for comparison and analysis, and a detection result for the target domain name bandwidth flow is output. If the detection result represents that the target domain name bandwidth flow is normal, the first time sequence image and / or the target detection segment is added to the normal flow mode data set used to generate the second time sequence image. Thus, the powerful visual understanding and comparison capability of the multi-modal large model is utilized to convert the abstract time sequence data fluctuation into intuitive image form difference for detection, effectively overcoming the limitations of single mode analysis. At the same time, by dynamically including the samples determined to be normal into the normal flow mode data set, the benchmark representing normal behavior can be self-adaptively evolved with the change of network state, effectively solving the problem of decreased detection accuracy caused by concept drift, and realizing continuous and reliable anomaly detection in a dynamic network environment. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 is a step flowchart of a flow detection method provided in the embodiment of the present application; Figure 2 is a flowchart of flow anomaly detection provided in the embodiment of the present application; Figure 3 is a structural block diagram of a flow detection device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0024] As an example, in the process of anomaly detection of domain name bandwidth flow, based on single mode analysis, it is difficult to comprehensively and accurately capture complex abnormal patterns, resulting in insufficient accuracy and robustness of detection. Secondly, the network is highly dynamic, and the "normal" behavior mode of domain name bandwidth flow is not immutable, but will slowly evolve with business development, user behavior changes and other factors. In this case, there is a lack of effective adaptive mechanism, which cannot continuously track and learn the dynamic changing normal behavior benchmark, thereby easily leading to increased false positive rate and false negative rate, and poor adaptability.

[0025] To this end, in the present application, in the process of detecting traffic, the time sequence data corresponding to the target domain name bandwidth traffic to be detected is obtained, the corresponding target detection segment is extracted from the time sequence data, the target detection segment is converted into a corresponding first time sequence image, at least one second time sequence image representing a normal traffic pattern is obtained, and the first time sequence image and the second time sequence image are jointly input into a multi-modal large model for comparison and analysis, and a detection result for the target domain name bandwidth traffic is output. If the detection result represents that the target domain name bandwidth traffic is normal, the first time sequence image and / or the target detection segment is added to the normal traffic pattern data set used to generate the second time sequence image, so that the powerful visual understanding and comparison ability of the multi-modal large model is utilized to convert the abstract time sequence data fluctuation into intuitive image form difference for detection, effectively overcoming the limitations of single modal analysis. At the same time, by dynamically including the samples determined to be normal into the normal traffic pattern data set, the benchmark representing normal behavior can be self-adaptively evolved with the change of network state, effectively solving the problem of decreased detection accuracy caused by concept drift, and realizing continuous and reliable anomaly detection in a dynamic network environment.

[0026] Referring to Figure 1 , a step flowchart of a traffic detection method provided in an embodiment of the present application is shown, which can specifically include the following steps: Step 101, obtaining time sequence data corresponding to target domain name bandwidth traffic to be detected; In an embodiment of the present application, it can run in a distributed network monitoring system, which can continuously collect the export / import bandwidth data of specified domain names from core routers, load balancers or dedicated traffic probes. The collection process can be performed at a fixed time granularity (for example, 1 point per second or 1 point per 5 minutes), forming a continuous time series.

[0027] Optionally, each data record contains at least two fields of timestamp and bandwidth value. The bandwidth value can be in units of Mbps or Gbps, etc., which is not limited by the present application.

[0028] In a specific implementation, when the system triggers an anomaly detection task (which can be a timed task or an event-triggered task, etc.), the system can query the target domain name bandwidth traffic data in a specified time range (for example, the last 1 hour) from a time sequence database (such as Prometheus, InfluxDB, etc.) or a distributed file system. These data constitute the original input of this detection, i.e. “time sequence data”.

[0029] Optionally, in order to ensure the integrity and consistency of the data, after obtaining the data, a corresponding preprocessing step can also be performed, such as processing data missing values (such as using forward filling or linear interpolation), and smoothing obvious acquisition noise (such as using simple moving average), etc., which is not limited by the present application.

[0030] Step 102, extracting a corresponding target detection segment from the time series data, and converting the target detection segment into a corresponding first time series image; After obtaining the complete time series data, the system does not process all the data at once, but can use a sliding window mechanism to extract the target detection segment that needs to be detected at present. Among them, the target detection segment can be a continuous subsequence, and its length (i.e. the window size can be n) can be a preset system parameter, for example, n can be 100 data points, etc. If each 5-minute corresponds to a data point, it is equivalent to about 8 hours of monitoring data, so as to focus on recent traffic behavior, which can make the entire detection process more timely, and at the same time, the long sequence is divided into more easily processed "detection segments", which is beneficial to reduce the amount of data processed at a time and improve the data processing efficiency.

[0031] In some possible implementation manners, the target detection segment includes traffic data points, and when the target detection segment is converted into a corresponding first time series image, a corresponding coordinate system can be first constructed with time as the horizontal axis and traffic value as the vertical axis, then the traffic data points in the target detection segment are plotted and connected in the coordinate system in chronological order to construct a corresponding line graph, then coordinate axis labels and a title are added to the line graph, and saved in a preset format image file to generate the first time series image corresponding to the target detection segment. Thus, the abstract numerical sequence is converted into a concrete two-dimensional image conforming to human visual cognitive rules, so that the fluctuation trend, periodic pattern and morphological anomaly (such as sharp peak, cliff-like drop or plateau) and other key features contained in the time series are intuitively presented, and then the transformation process provides a structured visual input for subsequent multi-modal large models, effectively activates and utilizes the powerful image understanding ability of the model obtained in the pre-training stage, so that it can capture abnormal patterns that are difficult to formalize in pure numerical analysis from the overall morphology and local features like human expert analysis of charts, greatly enriching the information dimension and feature level of the model for abnormality judgment.

[0032] In a specific implementation, the system can call a preset image service, which can be implemented based on the Python-based Matplotlib or Plotly library. Specifically, the service first creates a figure object (plt.figure) and sets its size and resolution (e.g., figsize=(10, 4), dpi=100). Subsequently, a coordinate system is established with time as the horizontal axis (time) and bandwidth flow value as the vertical axis (Bandwidth (Mbps)). Then, the n flow data points in the target detection segment are plotted in the coordinate system in their time order, and these points are connected in sequence by straight line segments to form a continuous polyline. The shape of this polyline can at least include its peak value, valley value, trend, and jitter, thereby intuitively reflecting the flow behavior in the time period. In order to enhance the readability of the image and the recognition ability of the model, the system can also add necessary labels to the polyline graph, including the labels of the horizontal and vertical coordinate axes, a descriptive title (e.g., "Domain: example.com - Bandwidth Time Series"), and grid lines to facilitate observation of fluctuation amplitude. Finally, the generated polyline graph is saved as an image file in a preset format, such as PNG (Portable Network Graphics) or JPEG (Joint Photographic Experts Group) format. The file is stored in a designated temporary directory or object storage and is assigned a unique identifier (such as UUID (Universally Unique Identifier)). This image file is the "first time series image", which encapsulates all the visual features of the target detection segment.

[0033] In step 103, at least one second time series image representing a normal flow pattern is obtained, and the first time series image and the second time series image are jointly input into a multi-modal large model for comparison analysis, and a detection result for the bandwidth flow of the target domain name is output. In the process of flow detection, in order to determine whether the target detection segment is abnormal, after converting the target detection segment into a corresponding first time series image, at least one second time series image representing a normal flow pattern can be obtained. The second time series image is used as a reliable "normal" reference for comparison. By jointly inputting the first time series image and the second time series image into a multi-modal large model for comparison analysis, a detection result for the bandwidth flow of the target domain name is output.

[0034] Optionally, the second time series image can be provided by a normal flow pattern data set, in which historical detection process time series data segments confirmed to be normal and their corresponding time series images, etc. can be stored.

[0035] In some possible implementations, the historical time-series data corresponding to the historical domain name bandwidth traffic is acquired, then the control limit for the historical time-series data is acquired, and the time-series segment in which all data points are within the control limit is filtered out from the historical time-series data, the time-series segment is integrated into the normal traffic pattern data set, so as to take the normal traffic pattern data set as the "reliable basis" in the traffic detection process.

[0036] The construction process of the normal traffic pattern data set can be performed when the system is initialized or needs to be reconstructed. Specifically, the system acquires historical time-series data in a past period of time (for example, a past month), and then processes the historical time-series data to construct a corresponding normal traffic pattern data set. The control limit can be a statistical boundary calculated based on historical data, which is used to define the fluctuation range of the bandwidth traffic of a specific domain name under a normal condition. The control limit describes the upper limit and lower limit of the traffic level and change amplitude of the domain name in a stable running state. Any traffic behavior that continuously or significantly exceeds the boundary is considered to be a non-random abnormal phenomenon that needs to be alarmed.

[0037] The control limit at least includes one of a moving average control upper limit, a moving average control lower limit, and a moving range control upper limit. The moving average control upper limit (UCL MA) and the moving average control lower limit (LCL MA) define a normal fluctuation interval of the overall level (smoothed trend) of the domain bandwidth traffic. The moving average control upper limit (UCL MA) can be an upper limit of a trend peak value that the domain bandwidth traffic can reach in a normal state. For example, if the moving average value of the traffic data is continuously or instantaneously much higher than the limit, it indicates that the domain name may be experiencing a traffic surge anomaly, such as a DDoS attack, a large number of false requests causing the bandwidth to be occupied, a hot event, a certain content suddenly becoming popular, causing normal user access far exceeding expectations, a crawler abuse, an out-of-control crawler program performing high-intensity data scraping, and the like. The moving average control lower limit (LCL MA) can be a lower limit of a trend valley value that the domain bandwidth traffic can allow in a normal state. For example, if the moving average value of the traffic data is continuously or instantaneously much lower than the limit, it indicates that the domain name may be experiencing a traffic drop anomaly, such as a service outage, server failure causing the service to be completely unavailable, a network interruption, backbone network failure or configuration error causing traffic to be unable to reach, a CDN (Content Delivery Network) failure, content distribution node failure, and the like. In addition, the moving range control upper limit (UCL MR) can define a normal maximum value of the domain bandwidth traffic change between adjacent collection points. It focuses on the "jitter" or "stability" of the traffic in a short period of time. It can be a tolerance limit of the instantaneous fluctuation intensity of the domain traffic in a normal state. If the traffic difference (moving range) between adjacent time points exceeds the limit, it indicates that the domain name may be experiencing a severe jitter anomaly, such as traffic flashing, network device port oscillation causing traffic to fluctuate between zero and normal value, route oscillation, BGP (Border Gateway Protocol) route instability causing traffic to frequently switch between multiple paths, and the like.

[0038] Based on the above control limits, UCL MA and LCL MA are responsible for the "overall level" of the quality inspection flow, ensuring that the flow as a reference is not abnormally high or low overall trend; UCL MR is responsible for the "stability degree" of the quality inspection flow, ensuring that the flow as a reference is smooth and stable, without sharp instantaneous jitter. Based on the cooperative work among the three, a historical time sequence window must meet the conditions that its moving average value does not exceed the interval [LCL MA, UCL MA] and its moving range value does not exceed UCL MR, and is then determined as "normal" flow and converted into a second time sequence image and stored in the reference data set, so that through the stereoscopic and multi-dimensional screening mechanism, the "normal flow pattern" as the model comparison reference can be fundamentally ensured to be pure and reliable. It provides a high-quality and representative normal behavior template for the subsequent multi-modal large model visual and statistical feature comparison, thereby laying a solid foundation for the high accuracy and strong robustness of the entire detection system.

[0039] The calculation process of the control limit can include: calculating a moving average value sequence and a moving range sequence corresponding to the historical time sequence data; calculating a first mean value of the moving average value sequence and a second mean value of the moving range sequence, then calculating the first mean value with a first preset coefficient to obtain a moving average control upper limit and a moving average control lower limit, and calculating the second mean value with a second preset coefficient to obtain a moving range control upper limit. Among them, the moving average control upper limit and the moving average control lower limit jointly constitute an allowed fluctuation interval, which is used to judge whether the moving average value of the flow data point in the time sequence data deviates from the normal level; the moving range control upper limit is used to judge whether the fluctuation amplitude between adjacent flow data points is abnormal.

[0040] In some examples, the construction process of the normal flow pattern data set can include: 1. Calculate the moving sequence: for the historical time sequence data, calculate the moving average (MA) sequence and the moving range (MR) sequence. Among them, the moving average value sequence can be calculated by a window (such as k=5), which is used to smooth short-term fluctuations and show long-term trends; the moving range sequence is the absolute value of the difference between adjacent data points, which is used to measure the volatility of the process.

[0041] 2. Calculate the overall mean: calculate the mean (X', first mean) of the entire moving average value sequence and the mean (R', second mean) of the moving range sequence.

[0042] 3. Determine the control limit: Moving average control limit: calculated using the first preset coefficient 2.66 (this is the coefficient in SPC, which is related to the window size k). Among them, the moving average control upper limit UCL MA = X' + 2.66 * R'; the moving average control lower limit LCL MA = X' - 2.66 * R'. These two control limits define an "allowed fluctuation interval". For any time series window, if the moving average of all its data points falls within the interval [LCL MA, UCL MA], it is considered to be stable.

[0043] Moving range control limit: calculated using the second preset coefficient 3.27. Among them, the moving range control upper limit UCL MR = 3.27 * R', which is used to judge the fluctuation amplitude. For any time series window, if the moving range value of all its data points does not exceed UCL MR, it is considered to be controlled.

[0044] 4. Screening normal time series segments: the historical data is divided into multiple time series windows with the same length n. For each window, check whether all its data points satisfy: a) the moving average is within [LCL MA, UCL MA]; b) the moving range value is within [0, UCL MR]. The time series segments that meet the conditions are judged to be "normal" and are added to the initial normal traffic pattern data set. These normal time series segments are also converted into time series images as a reserve of "second time series images", so that through a stereoscopic, multi-dimensional screening mechanism, it can fundamentally ensure that the "normal traffic pattern" as the model comparison benchmark is pure and reliable. It provides a high-quality, representative normal behavior template for subsequent multi-modal large model visual and statistical feature comparison, thereby laying a solid foundation for the high accuracy and strong robustness of the entire detection system.

[0045] In the process of comparison with the first time series image, the system can randomly select or select in time sequence from the normal traffic pattern data set k second time series images (such as k = 5, etc.) as the normal benchmark for current comparison analysis, and then input the first time series image and the second time series image into the multi-modal large model for comparison analysis, and output the corresponding detection result.

[0046] For example, after selecting the k second time-series images, the k+1 images can be input into the visual encoder of the multi-modal large model as input data. The visual encoder (e.g., a module based on the ViT (Vision Transformer) architecture) can convert each time-series image into a high-dimensional feature vector, which can be a deep abstract representation of the image content for the multi-modal large model, capturing visual features such as trends, shapes, key points (e.g., peaks, valleys, etc.) of the curve. Then, the multi-modal large model can perform a corresponding cross-attention comparison process by taking the feature vector of the first time-series image as the "query" and the feature vectors of all k second time-series images as the "key" and "value". Specifically, based on the attention mechanism, a weight distribution can be calculated to identify the similarities and differences between the first time-series image and the second time-series image in the most relevant features. For example, the multi-modal large model may find that the first time-series image has an abnormally sharp peak at a certain time point, while this feature is smooth in the corresponding position of all second time-series images, etc. Finally, based on in-depth cross-comparison, the multi-modal large model can integrate all the information from the k second time-series images and make a comprehensive decision at the output layer to output a detection result, i.e., "abnormal" or "normal", thereby realizing an end-to-end image-based anomaly detection without manually defining features by dynamically selecting representative normal benchmarks and utilizing the powerful visual encoding and cross-attention mechanism built into the multi-modal large model.

[0047] In another possible implementation, in the process of comparison analysis based on the time sequence image, a multi-modal fusion and branch analysis strategy can also be used: by extracting the first statistical features corresponding to the target detection segment, and obtaining the second statistical features representing the normal traffic pattern, then inputting the first time sequence image and the second time sequence image into a multi-modal large model for comparison analysis to obtain the corresponding image comparison analysis result, and inputting the first statistical features and the second statistical features into the multi-modal large model for comparison analysis to obtain the corresponding statistical comparison analysis result, finally using the comparison analysis result and the statistical comparison analysis result for traffic analysis, based on the analysis result, outputting the detection result for the target domain name bandwidth traffic, thereby constructing an abnormal detection mechanism of "visual form perception" and "numerical distribution insight" dual-channel fusion, which not only captures the macroscopic abnormal patterns of traffic curve in overall trend and local shape (such as spikes, steps, and flow breaks) through image comparison, but also reveals the microscopic numerical anomalies of data in central tendency, dispersion degree, and distribution form (such as mean shift, standard deviation increase, and distribution asymmetry) through statistical feature comparison. Through the analysis results of the two dimensions of vision and statistics, mutual verification and mutual complementation are achieved, the perception blind area of a single mode is effectively overcome, the recognition ability and robustness of complex, hidden or mixed type abnormalities (such as the form seems normal but the statistical distribution has deviated, or the numerical mutation but the form is not obvious due to smoothing) are significantly improved, and finally a more comprehensive, more accurate, and more reliable comprehensive diagnosis of domain name bandwidth traffic anomaly is realized.

[0048] Among them, the first statistical features can be a series of statistical values of the target detection segment calculated by the system; and the second statistical features can be statistical quantities of the normal time sequence segment corresponding to the selected second time sequence image obtained by the system from the normal traffic pattern data set. Taking the first statistical features as an example, the system can obtain a plurality of traffic data points contained in the target detection segment, then perform measurement calculation on the traffic data points in terms of central tendency, dispersion degree, and distribution form, output a plurality of feature values obtained by the measurement calculation, and take the feature values as the corresponding first statistical features. Among them, the feature values include at least three of the following types: mean, median, standard deviation, interquartile range, maximum value, minimum value, skewness, and kurtosis.

[0049] For example, assuming that n traffic data points in the target detection segment are read, then the corresponding metric calculations in the following process are performed: ① Central tendency: calculate the arithmetic mean of all data points; take the median after sorting the data points. ② Dispersion: calculate the square root of the average squared deviation of all data points from the mean, i.e. the standard deviation; calculate the difference between the upper quartile and the lower quartile of the data, i.e. the interquartile range; identify the maximum and minimum values in the data. ③ Distribution shape: calculate the skewness that describes the asymmetry of the distribution; calculate the kurtosis that describes the thickness of the tail of the distribution. Finally, at least three characteristic values obtained by the above calculations are collected to form a numerical vector, i.e. the first statistical feature. It can be understood that the process of obtaining the second statistical feature is similar, and will not be described here.

[0050] In addition, the multimodal multi-model can be divided into two paths during inference: Image comparison analysis: input the first time series image and k second time series images into the model. The model extracts image features using its visual encoder, and analyzes the visual differences between the first image and multiple normal images in terms of trend, shape, peak pattern, etc. based on its built-in attention mechanism, and outputs a preliminary visual-based image comparison analysis result (for example, "the curve to be detected has an isolated peak at 14:00, while all normal curves are smooth at that time").

[0051] Statistical feature comparison analysis: input the first statistical feature and the second statistical feature (usually a statistical summary of multiple normal sequence features) into the model. The model processes these numerical information through its language understanding module, compares their similarities and differences in numerical distribution, and outputs a statistical comparison analysis result (for example, "the standard deviation of the detection segment is 3 times the average level of normal, and the peak value exceeds the upper limit of the normal range").

[0052] Based on the above two analysis results, the two analysis results can be fused to determine whether the target domain name bandwidth traffic is abnormal. By obtaining a decision prompt word template for guiding the multimodal large model to perform abnormality judgment, then inputting the comparison analysis result and the statistical comparison analysis result into the decision prompt word template, generating a corresponding integrated prompt word, and then inputting the integrated prompt word into the multimodal large model for traffic analysis, outputting a detection result generated directly based on the integrated prompt word for representing whether the target domain name bandwidth traffic is abnormal, thereby structuring the image and statistical two independent analysis results into a professional "abnormal analysis process" through the preset decision prompt word template, and guiding the multimodal large model to play the role of "analyst" for comprehensive reasoning, which is the intelligent fusion and decision upgrading of multimodal evidence, and improves the accuracy and reliability of the decision.

[0053] For example, for the above prompt word template, its content structure can be as follows: You are a professional network traffic analysis expert. Please make a final judgment on whether the target bandwidth traffic is abnormal based on the following visual analysis and statistical analysis reports.

[0054]

Visual Analysis Report

Statistical Analysis Report

Task Requirements

[0055] Step 104, if the detection result represents that the target domain name bandwidth traffic is normal, the first time series image and / or the target detection segment are added to the normal traffic pattern data set used to generate the second time series image.

[0056] Based on the above analysis and comparison process, if the final detection result output by the multi-modal large model is "No Abnormal", it means that the current target detection segment, although new data, is judged to be normal. In order to cope with the slow changes of network traffic that may occur with the development of business and changes in user behavior (i.e. "concept drift"), the system needs to update its understanding of "normal". That is, the system can add this new normal sample (the first time series image and / or the original data of the corresponding target detection segment, etc.) to the normal traffic pattern data set, thereby utilizing the powerful visual understanding and comparison ability of the multi-modal large model to convert abstract time series data fluctuations into intuitive image form differences for detection, effectively overcoming the limitations of single modal analysis; At the same time, by dynamically incorporating the samples judged to be normal into the normal traffic pattern data set, the benchmark representing normal behavior can be adapted to evolve with changes in network state, effectively solving the problem of decreased detection accuracy caused by concept drift, and realizing continuous and reliable anomaly detection in a dynamic network environment.

[0057] In addition, in order to prevent the data set from expanding indefinitely, a "first-in, first-out" strategy can also be adopted, that is, when a new sample is added, the oldest sample in the data set is removed to maintain a fixed size (for example, the last 1000 normal samples are retained), so that the normal traffic pattern data set can become a dynamically evolving knowledge base that ensures that the "normal benchmark" for comparison is always synchronized with the recent network environment, thereby continuously ensuring the accuracy of anomaly detection.

[0058] It should be noted that the embodiments of the present application include but are not limited to the above examples, and it can be understood that those skilled in the art can also set according to actual needs under the guidance of the idea of the embodiments of the present application, and the present application does not limit this.

[0059] In the embodiments of the present application, in the process of detecting the traffic, the time sequence data corresponding to the target domain name bandwidth traffic to be detected is obtained, the corresponding target detection segment is extracted from the time sequence data, and the target detection segment is converted into a corresponding first time sequence image. Then, at least one second time sequence image representing a normal traffic pattern is obtained, and the first time sequence image and the second time sequence image are jointly input into a multi-modal large model for comparison and analysis, and a detection result for the target domain name bandwidth traffic is output. If the detection result represents that the target domain name bandwidth traffic is normal, the first time sequence image and / or the target detection segment is added to the normal traffic pattern data set used to generate the second time sequence image. Thus, the powerful visual understanding and comparison ability of the multi-modal large model is utilized to convert the abstract time sequence data fluctuation into intuitive image form difference for detection, effectively overcoming the limitations of single modal analysis. At the same time, by dynamically including the samples determined to be normal into the normal traffic pattern data set, the benchmark representing normal behavior can be adapted to evolve with the change of network state, effectively solving the problem of decreased detection accuracy caused by concept drift, and realizing continuous and reliable anomaly detection in a dynamic network environment.

[0060] In order for those skilled in the art to better understand the technical solutions in the embodiments of the present application, the following will be exemplarily described by corresponding examples: As an example, the adaptive domain name traffic anomaly detection process by combining the multi-modal large model can include: 1.1 Select a multi-modal large model as a base model

[0061] In the embodiments of the present application, Qwen-VL-7B can be selected as a base model, which is intended to be used for anomaly detection of domain name bandwidth traffic time series without fine-tuning.

[0062] 1.2 Data analysis and preprocessing First, a time series can be constructed from the bandwidth traffic data of a domain in the past week. The MAMR control limit calculation process can include: If a bandwidth traffic is in statistical control, it means that it does not exceed the range of normal traffic fluctuations, and the process in statistical control is considered stable and abnormal. In the present application, the stable process constitutes the benchmark of normal process behavior. The present application adopts MAMR-moving average moving range technology to draw MAMR chart for bandwidth traffic time series, and the upper and lower limits of moving average-MA and moving range-MR chart are calculated as follows: MA chart: Upper control limit

[0063] Lower control limit

[0064] MR chart: Upper control limit

[0065] Lower control limit

[0066] In the moving average moving range (MAMR) chart, 2.66 and 3.27 are often used as multipliers to estimate the control limit. Here X and R represent the moving average and moving range of the data respectively.

[0067] Moving average The calculation formula is:

[0068] Where n is the window size, and D(t) represents the value of the tth data point.

[0069] Slide the window along the time, the moving average value can be calculated at each time point, so as to obtain the moving average sequence, and the average value is .

[0070] The calculation formula of moving range is:

[0071] The above range value is composed of a new sequence, and the average value is .

[0072] The MAMR chart is drawn to improve the model's ability to accurately predict anomalies when adapting to time changes. This adaptive mechanism allows the model to update its understanding of the baseline "normal" behavior when faced with new data instances. By applying statistical process control (SPC) techniques, we calculate the upper and lower control limits of the MAMR. Time series within the control limits are preliminarily considered stable and anomaly-free and can be stored in the comparison set C. Therefore, the model maintains high transferability and has zero-sample learning ability.

[0073] The time series window picture processing process can include: converting network bandwidth traffic time series data into visual image form. Given that many abnormal fluctuations (such as sudden rises, sudden drops, or interruptions of lines) can be visually observed through images, the present application converts each time series window of length n into an independent image file using the Python programming language for storage. The multiple time series window images generated will serve as inputs for the multi-modal model to assist in accurately determining whether there is an abnormal condition in the network bandwidth traffic.

[0074] In addition, in the process of data segmentation, i.e., the segmentation of time series data into corresponding detection segments, the present application can first divide the time series into P windows according to the length n; then, according to the segmentation of the P windows into a comparison data set C and a query window Q(p): the preprocessed time series Q is segmented into a comparison data set C and multiple query windows Q(p), where p belongs to the set P, and P represents the number of segmented windows. Among them, the comparison data set C is all anomaly-free sequences, which is obtained according to the control limit calculation result of MAMR, and is used to provide a benchmark for normal behavior, while the query window Q(p) is the current time series segment to be detected.

[0075] 1.3 Extracting statistical features and constructing anomaly detection cue templates (1) Extracting statistical features When processing time series data, the extraction and transformation of statistical features are crucial preprocessing steps. For the comparison data set C and each query window Q(p), we calculate a series of key statistical features, including but not limited to mean, standard deviation, maximum, minimum, skewness, and kurtosis. These statistical features provide a comprehensive description of the data distribution, helping to reveal the central tendency, dispersion, symmetry, and tail characteristics of the data. Through comprehensive analysis of these statistical features, the model can gain a deeper understanding of the internal structure and trend of the data, providing a solid foundation for subsequent anomaly detection.

[0076] (2) Construction of anomaly detection cue templates To effectively pass these statistical features and window image information to the model, a set of structured text templates is designed to convert numerical statistical features and time series window images into the input form of multi-modal large models. These text templates not only accommodate various statistical features, but also enhance the model's understanding and interpretation of features through the combination of natural language and image information. In this way, statistical features and image information are converted into multi-modal inputs that the model can directly understand and process, thereby improving the model's ability to analyze complex data and the accuracy of anomaly detection. At the same time, before inputting the input prompt into the multi-modal large model, professional knowledge and expert rules in the domain of domain bandwidth traffic can be integrated, which can significantly enhance the reasoning ability of the model and improve the prediction accuracy. By integrating professional knowledge and experience into the model, it provides more rich semantic information, enabling the model to better understand the task background and make more accurate judgments.

[0077] For example, the final prompt word template is as follows: "According to the following background information, window time series image and statistical data, judge whether there is any anomaly in the bandwidth traffic time series.

[0078] Background information: Domain bandwidth traffic refers to the size of traffic flowing to a specific domain in the network, which is affected by many factors such as the number of visitors, file size, etc. Under normal circumstances, bandwidth traffic fluctuates little, but when attacked or malfunctioning, it may experience sudden increases or decreases, affecting network performance and user experience, so real-time monitoring and analysis are needed.

[0079] To be detected time series window image information: <This place will be placed to be detected time series window image> Normal time series window image information: <This place will be placed with the latest 5 normal time series window images> Statistical data: The following bandwidth traffic data is the statistical information of the bandwidth traffic data collected in the prediction time series window Q(p). The mean of the bandwidth traffic data in the time series window Q(p) is <value>, the median is <value>, the interquartile range is <value>, the standard deviation is <value>, the maximum value is <value>, the minimum value is <value>, the skewness is <value> and the kurtosis is <value>; The mean sequence of bandwidth traffic data in the latest week comparison data set C is <value sequence>, the median sequence is <value sequence>, the interquartile range sequence is <value sequence>, the standard deviation sequence is <value sequence>, the maximum value sequence is <value sequence>, the minimum value sequence is <value sequence>, the skewness sequence is <value sequence> and the kurtosis sequence is <value sequence>.

[0080] Please combine the traffic time series line trend information in the image with the statistical data of normal domain bandwidth traffic and the bandwidth traffic to be predicted. Judge whether there is any anomaly in the bandwidth traffic time series.

[0081] Note that both <value> and <value sequence> are values calculated according to actual conditions. 1.4 Model inference and output The constructed input prompt is sent to the multi-modal large model for inference, so that according to the output of the model, we can get the explicit anomaly detection result, that is, whether the current domain name bandwidth traffic sequence exists anomaly.

[0082] 1.5 Update and continuous monitoring of comparison data set C If the output of the model shows that there is no anomaly, then update the current query window Q(p) to the comparison data set C. In this way, C can be updated continuously with the accumulation of normal data, keeping an accurate description of normal behavior. By continuously updating the comparison data set, the accuracy of anomaly detection can be continuously improved. After completing the processing of the current query window Q(p), the present invention will move to the next query window, repeat the above steps, and perform continuous anomaly detection.

[0083] In addition, combined with specific application scenarios, refer to Figure 2 , a flowchart of traffic anomaly detection provided in an embodiment of the present invention is shown, and the specific process can include: Data parsing and preprocessing: Collect domain name bandwidth traffic data from monitoring tools and construct time series. Use data parsing technology to extract all related data.

[0084] Statistical information processing: If the bandwidth traffic is in a statistical control state, it is considered normal. The present invention uses MAMR technology to draw the MAMR graph of the time series, and calculates the upper and lower control limits of the moving average-MA and moving range-MR graph. Within the control limit range, it is considered stable and without anomaly.

[0085] Time series window picture processing: Convert network bandwidth traffic time series data into visual images. For each time series window with length n, use Python to convert it into an independent image file. The generated multiple time series window images will be used as input to the multi-modal model.

[0086] Data segmentation: Divide the time series into P windows according to the length n. Then divide the P windows into a comparison data set C and a query window Q(p). The windows inside the comparison data set C are stable and without anomaly, and the query window Q(p) is the current time series segment to be detected.

[0087] Extract statistical features and construct anomaly detection prompt word templates: For the comparison data set C and each query window Q(p), calculate key statistical features, including mean, standard deviation, maximum, minimum, median, interquartile range, skewness, and kurtosis.

[0088] Abnormality detection prompt word template construction: design a structured text template to convert statistical features and time window images into the input form of a multi-modal large model. Before sending the input prompt into the multi-modal large model, integrate domain name bandwidth traffic field expertise and expert rules to enhance the model's reasoning ability and prediction accuracy.

[0089] Model reasoning and output: send the constructed input prompt into the multi-modal large model for reasoning to obtain a clear result of whether the current domain name bandwidth traffic sequence has an anomaly.

[0090] Compare the update of data set C with continuous monitoring: if the model's output indicates that no anomaly exists, update the current query window Q(p) to the comparison data set C. After completing the processing of the current query window Q(p), move to the next query window and repeat the above steps for continuous anomaly detection.

[0091] Through the above scheme, efficient and accurate domain name bandwidth traffic time series anomaly detection is achieved, greatly saving manual cost and improving audit accuracy. Finally, the audit result is returned to the user.

[0092] Through the above process, the embodiments of the present application have at least the following technical effects compared with the prior art: Multi-modal data fusion improves detection accuracy: by converting time series data into images and combining with statistical features to form multi-modal input, it is more effective than single modal detection and can more comprehensively capture abnormal information, thereby improving the accuracy and robustness of anomaly detection. For example, visual data can provide shape and appearance features of time series lines, while statistical features can reflect data distribution and change trend. The combination of the two enables the model to understand data from different angles and improve detection effect.

[0093] Utilize the excellent performance of multi-modal large model: select Qwen-VL-7B as the base model, which can be directly applied to anomaly detection without fine-tuning. The model performs well on multi-modal tasks and can handle text and image inputs simultaneously, providing rich semantic information. This enables the model to not only rely on numerical features of data when detecting anomalies, but also use visual features of images to enhance understanding and recognition of abnormal patterns, thereby improving detection accuracy and reliability.

[0094] Dynamic updating comparison dataset enhances adaptability: by dynamically updating the comparison dataset C, it is continuously optimized with the accumulation of normal data, and always accurately describes normal behavior. After processing each query window, if there is no anomaly, the window data is added to C. This method enables the model to adapt to gradual changes in data distribution, effectively addressing the concept drift problem and maintaining an accurate description of normal behavior, thereby continuously providing reliable anomaly detection results in dynamic environments.

[0095] It should be noted that for the method embodiments, in order to simply describe, they are all expressed as a series of action combinations, but those skilled in the art should know that the embodiments of the present application are not limited by the order of the described actions, because according to the embodiments of the present application, certain steps can be performed in other order or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily necessary for the embodiments of the present application.

[0096] Referring to Figure 3 , a structural block diagram of a flow detection device provided in an embodiment of the present application is shown, which can specifically include the following modules: The data acquisition module 301 is configured to acquire time series data corresponding to the target domain name bandwidth flow to be detected; The conversion module 302 is configured to extract a corresponding target detection segment from the time series data, and convert the target detection segment into a corresponding first time series image; The comparison and analysis module 303 is configured to acquire at least one second time series image representing a normal flow pattern, and input the first time series image and the second time series image into a multi-modal large model for comparison and analysis, and output a detection result for the target domain name bandwidth flow; The update module 304 is configured to, if the detection result represents that the target domain name bandwidth flow is normal, add the first time series image and / or the target detection segment to a normal flow pattern dataset used to generate the second time series image.

[0097] In some possible implementation manners, the target detection segment includes flow data points, and the conversion module is specifically configured to: build a corresponding coordinate system with time as the horizontal axis and flow value as the vertical axis; connect the flow data points in the target detection segment in the coordinate system according to time sequence to build a corresponding line graph; add coordinate axis labels and a title to the line graph, and save it in a preset format image file to generate the first time series image corresponding to the target detection segment.

[0098] In some possible implementation manners, the comparison and analysis module is specifically configured to: extracting a first statistical feature corresponding to the target detection segment; obtaining a second statistical feature representing the normal traffic pattern; inputting the first time sequence image and the second time sequence image into a multi-modal large model for comparison analysis, to obtain a corresponding image comparison analysis result; inputting the first statistical feature and the second statistical feature into the multi-modal large model for comparison analysis, to obtain a corresponding statistical comparison analysis result; performing traffic analysis on the comparison analysis result and the statistical comparison analysis result, and outputting a detection result for the target domain name bandwidth traffic based on the analysis result.

[0099] In some possible implementation manners, the comparison analysis module is specifically configured to: obtain a plurality of traffic data points contained in the target detection segment; perform measurement calculation on the traffic data points in terms of central tendency, dispersion degree, and distribution form, output a plurality of feature values obtained by the measurement calculation, and take the feature values as corresponding first statistical features; The feature values include at least three of the following types: mean, median, standard deviation, interquartile range, maximum value, minimum value, skewness, and kurtosis.

[0100] In some possible implementation manners, the comparison analysis module is specifically configured to: obtain a decision prompt word template for guiding the multi-modal large model to perform abnormality judgment; input the comparison analysis result and the statistical comparison analysis result into the decision prompt word template, to generate a corresponding integrated prompt word; input the integrated prompt word into the multi-modal large model for traffic analysis, and output a detection result for representing whether the target domain name bandwidth traffic is abnormal, which is directly generated based on the integrated prompt word.

[0101] In some possible implementation manners, the method further includes: a historical data obtaining module configured to obtain historical time sequence data corresponding to historical domain name bandwidth traffic; a data set constructing module configured to obtain a control limit for the historical time sequence data, and filter, from the historical time sequence data, a time sequence segment in which all data points are within the control limit, and integrate the time sequence segment into a normal traffic pattern data set.

[0102] In some possible implementation manners, the control limit includes at least one of a moving average control upper limit, a moving average control lower limit, and a moving range control upper limit, and the data set constructing module is specifically configured to: Calculate a moving average sequence and a moving range sequence corresponding to the historical time series data; Calculate a first mean value of the moving average sequence and a second mean value of the moving range sequence; Calculate the first mean value and a first preset coefficient to obtain a moving average control upper limit and a moving average control lower limit; Calculate the second mean value and a second preset coefficient to obtain a moving range control upper limit; The moving average control upper limit and the moving average control lower limit jointly constitute an allowed fluctuation range, which is used to determine whether the moving average value of a flow data point in the time series data deviates from a normal level, and the moving range control upper limit is used to determine whether the fluctuation amplitude between adjacent flow data points is abnormal.

[0103] For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts refer to the part of the method embodiment.

[0104] In addition, the embodiment of the present application also provides an electronic device, which comprises a processor, a memory, a computer program stored on the memory and executable on the processor, and the computer program implements each process of the flow detection method embodiment of the above-mentioned method embodiment when executed by the processor, and achieves the same technical effect. To avoid repetition, it will not be repeated here.

[0105] The embodiment of the present application also provides a computer readable storage medium, and the computer readable storage medium stores a computer program, and the computer program implements each process of the flow detection method embodiment of the above-mentioned method embodiment when executed by the processor, and achieves the same technical effect. To avoid repetition, it will not be repeated here. The computer readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0106] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same and similar parts of each embodiment can be referred to.

[0107] Those skilled in the art will appreciate that embodiments of the present application can be provided as methods, apparatus, or computer program products. Accordingly, embodiments of the present application can be embodied in the form of entire hardware embodiments, entire software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present application can be embodied in the form of computer program products embodied on one or more computer-usable storage media (including, but not limited to, disk memory, CD-ROMs, optical memory, EEPROM, Flash, eMMC, and the like) having computer usable program code embodied thereon.

[0108] Embodiments of the present application are described with reference to the flowchart illustrations and / or block diagrams of the methods, terminal devices (systems), and computer program products according to embodiments of the present application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing device, or other programmable data processing terminal devices to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal devices, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams.

[0109] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing terminal device to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams.

[0110] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device to cause a series of operational steps to be performed on the computer or other programmable terminal device to produce a computer implemented process such that the instructions which execute on the computer or other programmable terminal device provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams.

[0111] While preferred embodiments of the present application have been described, those skilled in the art will appreciate that additional modifications and changes can be made to these embodiments without departing from the true spirit and scope of the present application. Accordingly, the appended claims are intended to cover all such modifications and changes as fall within the true spirit and scope of the present application.

[0112] Finally, it is to be understood that the phraseology or terminology such as "first" and "second" etc. used herein is merely intended to differentiate one entity or operation from another entity or operation, without necessarily requiring or implying any actual such relationship or order between such entities or operations. Moreover, the terms "comprising", "including", or any other closure, are intended to cover the non-exclusive inclusion such that a process, method, article, or apparatus that comprises a list of elements does not include those elements alone but can include other elements not expressly listed or even include elements inherent in such process, method, article, or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or apparatus including the element.

[0113] The above describes in detail the flow detection method and flow detection device provided by the present application. The principles and implementation modes of the present application are described by using specific examples. The above description of the examples is only used to help understand the method of the present application and its core idea. Meanwhile, for those skilled in the art, the specific implementation modes and application ranges can be changed according to the idea of the present application. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A method of detecting flow, characterized by, The method comprises the following steps: acquiring time series data corresponding to target domain name bandwidth flow to be detected; extracting a corresponding target detection segment from the time series data and converting the target detection segment into a corresponding first time series image; acquiring at least one second time series image representing a normal flow pattern, and inputting the first time series image and the second time series image into a multimodal large model for comparative analysis to output a detection result for the target domain name bandwidth flow; if the detection result indicates that the target domain name bandwidth flow is normal, adding the first time series image and / or the target detection segment to a normal flow pattern data set used to generate the second time series image.

2. The method of claim 1, wherein, The target detection segment includes flow data points, and the conversion of the target detection segment into a corresponding first time series image comprises the following steps: building a corresponding coordinate system with time as the horizontal axis and flow value as the vertical axis; connecting the flow data points in the target detection segment in the coordinate system in chronological order to build a corresponding line graph; adding coordinate axis labels and a title to the line graph and saving it in a preset format image file to generate the first time series image corresponding to the target detection segment.

3. The method of claim 1, wherein, The inputting of the first time series image and the second time series image into the multimodal large model for comparative analysis to output the detection result for the target domain name bandwidth flow comprises the following steps: extracting first statistical features corresponding to the target detection segment; acquiring second statistical features representing the normal flow pattern; inputting the first time series image and the second time series image into the multimodal large model for comparative analysis to obtain corresponding image comparative analysis results; inputting the first statistical features and the second statistical features into the multimodal large model for comparative analysis to obtain corresponding statistical comparative analysis results; performing flow analysis on the comparative analysis results and the statistical comparative analysis results, and outputting the detection result for the target domain name bandwidth flow based on the analysis results.

4. The method of claim 3, wherein, The extraction of the first statistical features corresponding to the target detection segment comprises the following steps: acquiring a plurality of flow data points included in the target detection segment; performing measurement calculation on the flow data points in terms of central tendency, dispersion degree and distribution form, outputting a plurality of feature values obtained by the measurement calculation, and taking the feature values as corresponding first statistical features; wherein the feature values include at least three of the following types: mean, median, standard deviation, interquartile range, maximum value, minimum value, skewness and kurtosis.

5. The method according to claim 3 or 4, characterized in that, The flow analysis on the comparative analysis results and the statistical comparative analysis results, and the outputting of the detection result for the target domain name bandwidth flow based on the analysis results, comprise the following steps: acquiring a decision prompt word template for guiding the multimodal large model to perform abnormality judgment; inputting the comparative analysis results and the statistical comparative analysis results into the decision prompt word template to generate a corresponding integrated prompt word; inputting the integrated prompt word into the multimodal large model for flow analysis to output a detection result directly generated based on the integrated prompt word for indicating whether the target domain name bandwidth flow is abnormal.

6. The method of claim 1, wherein, Also comprising: obtain historical time series data corresponding to historical domain name bandwidth traffic; obtain control limits for the historical time series data, and filter out time series segments with all data points within the control limits from the historical time series data, and integrate the time series segments into a normal traffic pattern data set.

7. The method of claim 6, wherein, The control limits include at least one of a moving average control upper limit, a moving average control lower limit, and a moving range control upper limit, and the obtaining of the control limits for the historical time series data comprises: calculating a moving average value sequence and a moving range sequence corresponding to the historical time series data; calculating a first average value of the moving average value sequence and a second average value of the moving range sequence; calculating the moving average control upper limit and the moving average control lower limit using the first average value and a first preset coefficient; calculating the moving range control upper limit using the second average value and a second preset coefficient; The moving average control upper limit and the moving average control lower limit together form an allowed fluctuation interval, which is used to determine whether the moving average value of the traffic data point in the time series data deviates from the normal level; and the moving range control upper limit is used to determine whether the fluctuation amplitude between adjacent traffic data points is abnormal.

8. A flow rate detecting device characterized by comprising: Comprising: a data acquisition module configured to acquire time series data corresponding to target domain name bandwidth traffic to be detected; a conversion module configured to extract a corresponding target detection segment from the time series data and convert the target detection segment into a corresponding first time series image; a comparison and analysis module configured to acquire at least one second time series image representing a normal traffic pattern, and input the first time series image and the second time series image into a multi-modal large model for comparison and analysis, and output a detection result for the target domain name bandwidth traffic; an update module configured to add the first time series image and / or the target detection segment to a normal traffic pattern data set used to generate the second time series image if the detection result indicates that the target domain name bandwidth traffic is normal.

9. An electronic device, comprising: comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory is used to store computer programs; the processor is used to execute the programs stored on the memory to implement the method of any one of claims 1-7.

10. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method of any one of claims 1-7.

Images