Network traffic anomaly identification method and related devices

Abstract

The application discloses a network traffic anomaly identification method and related equipment, and relates to the technical field of network security. The method comprises the following steps: acquiring a structured traffic feature of real-time network traffic data of a target system; determining an initial anomaly score of the structured traffic feature based on a first baseline threshold and a second baseline threshold; in response to the initial anomaly score being greater than a preset score threshold, performing influence propagation simulation on the network resource topology model based on the real-time network traffic data to obtain a predicted resource pressure value of at least one resource node; determining a target anomaly score according to the initial anomaly score and the predicted resource pressure value; and comparing the target anomaly score with a decision score threshold to determine whether the real-time network traffic data is abnormal. Through the multi-baseline anomaly score, resource topology influence simulation and decision mechanism driven by the global anomaly rate, the application can ensure processing efficiency while accurately, comprehensively and stably identifying network traffic anomalies.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method and related equipment for identifying abnormal network traffic. Background Technology

[0002] With the continuous development of information technology and network scale, network systems have been widely used in cloud computing, data centers, industrial internet, and various business support platforms. The stable and secure operation of network traffic has become a key factor in ensuring system reliability. Real-time monitoring and analysis of network traffic, and timely identification of abnormal traffic behavior, are of great significance for preventing network attacks, locating system faults, and ensuring business continuity. Therefore, network traffic anomaly identification technology has received widespread attention and application in the field of network operation and maintenance and security management.

[0003] However, existing network traffic anomaly identification technologies mostly rely on a single baseline threshold or simple statistical characteristics to judge traffic changes, typically identifying anomalies based solely on historical average levels or fixed thresholds. This approach struggles to fully consider the traffic differences of the target system under different operating conditions, especially when the system alternates between steady-state and sensitive operating modes. It is prone to misjudging normal fluctuations as anomalies or failing to adequately identify potential risks. Furthermore, most related technologies focus on analyzing the deviation of traffic characteristics themselves, lacking a comprehensive assessment of the potential internal resource pressure and cascading effects caused by abnormal traffic, leading to discrepancies between anomaly identification results and actual system risks. In other words, these technologies suffer from limited accuracy in network traffic anomaly identification, insufficient consideration of system resource impact, and poor adaptability in anomaly judgment. Summary of the Invention

[0004] The summary section of this application introduces a series of simplified concepts, which will be further explained in detail in the detailed description section. The summary section of this application is not intended to limit the key features and essential technical features of the claimed technical solution, nor is it intended to determine the scope of protection of the claimed technical solution.

[0005] The network traffic anomaly identification method and related equipment provided in this application can achieve more accurate, comprehensive and stable identification of network traffic anomalies while ensuring processing efficiency, through anomaly scoring based on multiple baseline thresholds, impact propagation simulation based on resource topology and decision-making mechanism combined with global anomaly occurrence rate.

[0006] In a first aspect, this application provides a method for identifying network traffic anomalies, comprising: acquiring structured traffic features of real-time network traffic data of a target system; determining an initial anomaly score of the structured traffic features based on a first baseline threshold and a second baseline threshold, wherein the first baseline threshold is generated based on the historical steady-state operating mode of the target system, and the second baseline threshold is generated based on the historical sensitive operating mode of the target system; responding to the initial anomaly score being greater than a preset score threshold, performing an impact propagation simulation in a network resource topology model based on the real-time network traffic data to obtain a predicted resource pressure value for at least one resource node, wherein the network resource topology model defines the pressure transmission relationship between resource nodes of the target system; determining a target anomaly score based on the initial anomaly score and the predicted resource pressure value; and comparing the target anomaly score with a decision score threshold to determine whether the real-time network traffic data is anomaly, wherein the decision score threshold is determined based on the global anomaly event occurrence rate of the target system.

[0007] In some implementations, acquiring the structured traffic features of real-time network traffic data of the target system includes: collecting raw network packet flows through probes deployed on the network links of the target system; parsing the raw network packet flows to extract metadata including protocol type, packet size, and timestamp; calculating a first-dimensional feature set and a second-dimensional feature set based on the metadata, wherein the first-dimensional feature set includes the total number of bytes and the total number of packets per unit time, and the second-dimensional feature set includes the entropy value of the protocol type distribution, the statistics of the new connection rate and the connection duration distribution; and fusing and standardizing the first-dimensional feature set and the second-dimensional feature set to generate the structured traffic features.

[0008] In some implementations, before determining the initial anomaly score of the structured traffic features based on a first baseline threshold and a second baseline threshold, the network traffic anomaly identification method further includes: acquiring a historical traffic feature dataset of the target system within a preset historical period; performing time series clustering analysis on the historical traffic feature dataset to obtain clustering analysis results; identifying periods where traffic fluctuation levels are consistently below a first fluctuation threshold based on the clustering analysis results, thus forming a historical steady-state operation mode sample set; identifying periods where traffic exhibits periodic peaks or is highly correlated with a preset business event calendar based on the clustering analysis results, thus forming a historical sensitive operation mode sample set; calculating a first preset percentile of each traffic feature value in the historical steady-state operation mode sample set as the first baseline threshold; and calculating a second preset percentile of each traffic feature value in the historical sensitive operation mode sample set as the second baseline threshold.

[0009] In some implementations, determining the initial anomaly score of the structured traffic features based on a first baseline threshold and a second baseline threshold includes: determining the current operating mode category of the target system based on the system time of the target system and a preset business mode calendar; if the operating mode category is a steady-state operating mode, comparing the structured traffic features with the first baseline threshold item by item to determine a first multidimensional deviation vector; if the operating mode category is a sensitive operating mode, comparing the structured traffic features with the second baseline threshold item by item to determine a second multidimensional deviation vector; correcting the first multidimensional deviation vector or the second multidimensional deviation vector based on the business context information of the target system to obtain a third multidimensional deviation vector, wherein the business context information includes system maintenance, application deployment, and data backup; calculating the weighted norm of the third multidimensional deviation vector to obtain a comprehensive deviation degree; and mapping the comprehensive deviation degree to a preset numerical range through a preset scoring function to obtain the initial anomaly score.

[0010] In some implementations, the step of performing impact propagation simulation in a network resource topology model based on the real-time network traffic data to obtain the predicted resource pressure value of at least one resource node includes: parsing the real-time network traffic data into an initial pressure load on one or more initial resource nodes in the network resource topology model according to the destination address, service port, and transaction type of the real-time network traffic data; using the initial pressure load as input, iteratively simulating the transmission and accumulation process of pressure from upstream nodes to downstream nodes according to the inter-node pressure transmission coefficient defined in the network resource topology model; in each iteration simulation, determining whether the accumulated pressure received by each resource node exceeds the preset processing capacity threshold of that node; when the accumulated pressure of any resource node exceeds its preset processing capacity threshold, triggering the simulation of the pressure amplification effect of the resource node on downstream nodes; when the pressure amplification effect simulation process reaches a preset stable state or reaches the maximum number of iterations, outputting the accumulated pressure value of each resource node as the predicted resource pressure value.

[0011] In some implementations, determining the target anomaly score based on the initial anomaly score and the predicted resource pressure value includes: normalizing the initial anomaly score to obtain a first normalized score; normalizing the maximum value among the predicted resource pressure values ​​of all resource nodes to obtain a second normalized score; obtaining a first preset weighting coefficient and a second preset weighting coefficient, wherein the sum of the first preset weighting coefficient and the second preset weighting coefficient is 1; multiplying the first normalized score by the first preset weighting coefficient to obtain a first weighted score; multiplying the second normalized score by the second preset weighting coefficient to obtain a second weighted score; and calculating the sum of the first weighted score and the second weighted score as the target anomaly score.

[0012] In some implementations, before comparing the target anomaly score with a decision scoring threshold to determine whether the real-time network traffic data is abnormal, the network traffic anomaly identification method further includes: determining the current anomaly event occurrence rate of the target system based on the number of events of the real-time network traffic data determined to be abnormal within a sliding time window of a preset time length; obtaining the historical baseline anomaly event occurrence rate of the target system; determining the ratio of the current anomaly event occurrence rate to the historical baseline anomaly event occurrence rate as a system situation coefficient; and multiplying a preset basic scoring threshold by the system situation coefficient to obtain the decision scoring threshold.

[0013] Secondly, this application also provides a network traffic anomaly identification device, comprising: a feature acquisition unit, configured to acquire structured traffic features of real-time network traffic data of a target system; an initial score determination unit, configured to determine an initial anomaly score of the structured traffic features based on a first baseline threshold and a second baseline threshold, wherein the first baseline threshold is generated based on the historical steady-state operating mode of the target system, and the second baseline threshold is generated based on the historical sensitive operating mode of the target system; a pressure determination unit, configured to, in response to the initial anomaly score being greater than a preset score threshold, perform an impact propagation simulation based on the real-time network traffic data in a network resource topology model to obtain a predicted resource pressure value for at least one resource node, wherein the network resource topology model defines the pressure transmission relationship between resource nodes of the target system; a target score determination unit, configured to determine a target anomaly score based on the initial anomaly score and the predicted resource pressure value; and an anomaly determination unit, configured to compare the target anomaly score with a decision score threshold to determine whether the real-time network traffic data is anomaly, wherein the decision score threshold is determined based on the global anomaly event occurrence rate of the target system.

[0014] Thirdly, this application also provides an electronic device, including: a memory and a processor, wherein the processor is configured to implement the steps of the network traffic anomaly identification method described in the first aspect when executing a computer program stored in the memory.

[0015] Fourthly, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the network traffic anomaly identification method described in the first aspect.

[0016] Fifthly, this application also provides a computer program product, including a computer program or computer executable instructions, which, when executed by a processor, implement the steps of the network traffic anomaly identification method provided in the embodiments of this application.

[0017] In summary, this application generates a first baseline threshold and a second baseline threshold based on the target system's historical steady-state operation mode and historical sensitive operation mode, respectively, to perform initial anomaly scoring on real-time network traffic characteristics. This enables anomaly detection to distinguish between normal fluctuations and genuine anomalies under different operating states, thereby reducing the probability of false positives and false negatives. Only when the initial anomaly score exceeds a preset scoring threshold is a network resource topology model used for impact propagation simulation. This helps to ensure anomaly identification accuracy while avoiding complex simulation analysis of all traffic data, thus improving overall processing efficiency. By performing impact propagation simulation in the network resource topology model, the predicted resource pressure values ​​of resource nodes are obtained and combined with the initial anomaly... The scoring method determines the target anomaly score, ensuring that anomaly assessment considers not only the traffic characteristics themselves but also their potential impact on internal system resource pressure, thus improving the comprehensiveness and rationality of the anomaly score. The decision scoring threshold is determined based on the global anomaly event occurrence rate of the target system, allowing the final anomaly judgment to match the overall operational status and historical anomaly levels of the system, which is beneficial for maintaining stable and controllable anomaly identification results under different anomaly occurrence frequencies. By combining multi-threshold baseline modeling, resource impact simulation, and a global anomaly rate-driven decision mechanism, this method can more comprehensively and reliably identify abnormal network traffic in complex network environments, enhancing its stability and adaptability in practical applications. In summary, the network traffic anomaly identification method provided in this application, through multi-baseline threshold anomaly scoring, resource topology-based impact propagation simulation, and a decision mechanism combined with a global anomaly occurrence rate, can achieve more accurate, comprehensive, and stable identification of network traffic anomalies while ensuring processing efficiency. Attached Figure Description

[0018] Figure 1 A flowchart illustrating a method for identifying network traffic anomalies provided in an embodiment of this application;

[0019] Figure 2 This is a schematic diagram of the composition structure of a network traffic anomaly identification device provided in an embodiment of this application;

[0020] Figure 3 This is a schematic diagram of the composition structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0021] The terms used in the specification, claims, and drawings of this application, such as "first," "second," "third," "fourth," etc. (if any), are used to distinguish similar objects and not to describe a specific order or sequence. Therefore, it is to be understood that these terms can be used interchangeably where appropriate, allowing the described embodiments to be used in different orders, unless specifically required by the illustrations or description. Furthermore, the terms "is" and "has," and any variations thereof, are intended to cover, non-exclusively, all possible constituent elements. For example, a process, method, system, product, or apparatus comprising several steps or units is not necessarily limited to the steps or units explicitly listed, but may also include other steps or units not explicitly listed, or steps or units inherent to the process, method, product, or apparatus.

[0022] In this application, a "module" or "unit" refers to a computer program or part of a computer program that has a specific function and works in conjunction with other related parts to achieve a predetermined goal. These modules or units can be implemented by software, hardware (e.g., processing circuitry or memory), or a combination of both. One or more processors or memories can implement one or more modules or units. Furthermore, each module or unit can also be part of a larger module or unit.

[0023] The technical solutions of this application will be described in detail below with reference to the accompanying drawings of the embodiments. It should be noted that the described embodiments are only a part of this application, and not all embodiments. In the following description, the "some embodiments" mentioned are only a subset of all possible embodiments, which may be the same or different subsets, and different embodiments can be combined with each other without conflict.

[0024] Figure 1 This is a flowchart illustrating a method for identifying network traffic anomalies provided in an embodiment of this application. For example, see [link to example]. Figure 1 The network traffic anomaly identification method provided in this application embodiment may include the following steps 101 to 105:

[0025] Step 101: Obtain the structured traffic characteristics of the real-time network traffic data of the target system.

[0026] In some examples, the target system is various network operating platforms that require anomaly monitoring of network traffic. This range can encompass multiple types, including enterprise LAN systems, cloud computing data center systems, industrial control systems, and core network systems of telecom operators. The source is various information infrastructures with network security protection requirements in practical applications. This clearly defines the boundaries of the monitoring objects for anomaly identification, ensuring that subsequent traffic data collection and feature analysis accurately match the operational characteristics of specific application scenarios. Real-time network traffic data refers to various network transmission data generated in real time during the operation of the target system. Its real-time nature is defined as the millisecond-level acquisition response after data generation. The data scope includes all data packets transmitted between network links, network devices, and terminal nodes within the target system. The source is mainly obtained through network probes deployed on critical network links of the target system. The data type is primarily raw network packet streams, including packet data from various protocol types such as Transmission Control Protocol (TCP), Internet Protocol (IP), and User Datagram Protocol (UDP), providing raw data support for subsequent extraction of structured traffic features. Structured traffic features are a set of standardized features formed after multi-dimensional analysis, calculation and standardization of real-time network traffic data. They can be divided into two main categories: basic traffic statistics features and traffic distribution features. Basic traffic statistics features include the total number of bytes and total number of data packets per unit time, while traffic distribution features include the entropy value of protocol type distribution, statistics of new connection rate and connection duration distribution, etc.

[0027] By implementing step 101, structured traffic features of real-time network traffic data of the target system are obtained, transforming the raw, discrete network traffic data into a feature form with clear semantics and analyzability. This is beneficial for subsequent unified modeling and quantitative analysis, providing a stable and comparable input basis for anomaly identification, and improving the operability and consistency of the anomaly detection process.

[0028] Step 102: Determine the initial anomaly score of the structured traffic characteristics based on the first baseline threshold and the second baseline threshold.

[0029] The first baseline threshold is generated based on the historical steady-state operating mode of the target system, and the second baseline threshold is generated based on the historical sensitive operating mode of the target system.

[0030] In some examples, the historical steady-state operating mode refers to the operating state of the target system where traffic fluctuations are within a stable range and there is no special business operation interference within a preset historical period. This includes non-peak business periods, regular operating periods without system maintenance or application releases, and is derived from the historical traffic feature dataset accumulated within the preset historical period of the target system over the past 90 days. This provides a stable sample basis without abnormal interference for the generation of the first baseline threshold, ensuring the benchmark and reliability of the baseline threshold. The historically sensitive operating mode refers to the operating state where the target system's traffic exhibits periodic peaks or is highly correlated with specific business events. This includes e-commerce platform promotional activities, enterprise monthly data backup periods, government system centralized business processing periods, and financial system settlement peak periods, etc. The source is also the historical traffic feature dataset within the preset historical period. This provides a sample basis that adapts to normal business fluctuations for the generation of the second baseline threshold, avoiding misjudging reasonable business peaks as abnormal traffic. The first baseline threshold is the benchmark value of traffic characteristics in each dimension calculated based on a historical steady-state operation mode sample set. It originates from the first preset percentile of the corresponding feature values ​​in the historical steady-state operation mode sample set, typically selected as the 95th percentile to filter out extreme normal fluctuations. This serves as the core basis for judging whether the real-time structured traffic characteristics deviate from the benchmark when the target system is in a steady-state operation mode. The second baseline threshold is the benchmark value of traffic characteristics in each dimension calculated based on a historical sensitive operation mode sample set. It originates from the second preset percentile of the corresponding feature values ​​in the historical sensitive operation mode sample set, typically selected as the 99th percentile to adapt to the traffic fluctuation range during peak business periods. This serves as the judgment standard for measuring the degree of deviation of real-time structured traffic characteristics when the target system is in a sensitive operation mode. The initial anomaly score is the quantitative result of the degree to which the structured traffic characteristics deviate from the corresponding baseline threshold. It can be set from 0 to 100 points, with higher scores indicating a higher degree of anomaly. This score can initially characterize the anomaly level of real-time traffic and provide basic data support for the subsequent calculation of the target anomaly score.

[0031] By implementing step 102, based on the first baseline threshold and the second baseline threshold derived from the historical steady-state operation mode and the historical sensitive operation mode respectively, the structured traffic characteristics are initially anomaly scored, so that the anomaly assessment can take into account the normal behavior boundary of the system under different operating conditions, which can enhance the ability to characterize the degree of anomaly and reduce the risk of misjudgment or omission due to a single baseline.

[0032] Step 103: In response to the initial anomaly score being greater than the preset score threshold, an impact propagation simulation is performed in the network resource topology model based on real-time network traffic data to obtain the predicted resource pressure value of at least one resource node.

[0033] Among them, the network resource topology model defines the pressure transmission relationship between resource nodes of the target system.

[0034] In some examples, a preset scoring threshold is used to determine whether a resource impact assessment is needed. This threshold is typically set based on historical anomaly data of the target system, for example, 60 points. It can be an empirical value configured by the target system's network security administrators based on risk control needs, or an optimal threshold trained using historical data. This threshold can filter out initial abnormal traffic with potential resource impact risks, avoiding over-processing of minor abnormal traffic to save system resources. Real-time network traffic data uses the target system network link transmission data collected in step 101. This data includes various protocol message data and originates from network probes (NPs) deployed on critical links of the target system. It provides raw input data for impact propagation simulation, supporting accurate calculation of initial stress load. The Network Resource Topology Model (NRTM) is a structured model depicting the resource nodes of the target system and the stress transmission relationships between nodes. It is a directed graph model where nodes correspond to various resource components of the target system, and edges correspond to stress transmission paths and strengths between nodes. The stress transmission relationships between resource nodes are determined based on the target system's network topology, resource hardware parameters, and business data flow. The source is a network topology discovery tool (NetworkTopology). The Discovery Tool (NTDT) scans the network topology data of the target system and combines it with the configuration information of the target system's servers, switches, routers, and other resources to construct a model that accurately reconstructs the transmission path and diffusion patterns of pressure caused by abnormal traffic among the target system's resource nodes. Resource nodes are the core units constituting the target system's network resource topology model, encompassing all network resources with data processing or transmission capabilities, such as application servers, database servers, core switches, routers, firewalls, and storage devices. These nodes can be categorized into computing resource nodes, network transmission resource nodes, and storage resource nodes. They can withstand and transmit the pressure load brought by abnormal traffic and are the core objects of the impact propagation simulation. The predicted resource pressure value is a quantified value of the expected pressure state of each resource node under the influence of abnormal traffic, obtained through simulation. Types include resource load indicators such as CPU utilization, memory usage, bandwidth usage, and disk I / O utilization. This quantifies the potential impact of real-time abnormal traffic on the target system's hardware resources, providing core data for the subsequent calculation of the target anomaly score, focusing on the resource impact dimension.The pressure transmission relationship defined in the network resource topology model is the law of pressure transmission between different resource nodes. It is a directed correlation relationship with a transmission coefficient. The transmission coefficient ranges from 0 to 1. The larger the value, the more significant the impact of the upstream node's pressure on the downstream node. It can be calculated based on the historical resource load data and service dependencies of the target system. For example, the transmission coefficient between the server and the switch can be determined by analyzing the bandwidth usage correlation data between the two. This ensures that the impact propagation simulation results can truly reflect the actual resource pressure transmission characteristics of the target system.

[0035] By implementing step 103, impact propagation simulation is only performed in the network resource topology model when the initial anomaly score exceeds the preset score threshold. This allows the analysis to focus on traffic situations with potential risks, ensuring the depth of anomaly analysis while reducing unnecessary computational overhead. At the same time, by modeling the pressure transmission relationship between resource nodes, the potential impact of abnormal traffic on system resources can be predicted, improving the system correlation of anomaly identification.

[0036] Step 104: Determine the target anomaly score based on the initial anomaly score and the predicted resource pressure value.

[0037] In some examples, the target anomaly score is a comprehensive quantitative result of the degree of traffic anomaly and the degree of resource impact. The higher the score, the higher the comprehensive anomaly risk of real-time network traffic. It can be the result of normalization and weighted fusion of the initial anomaly score and the predicted resource pressure value. It can provide a comprehensive and accurate core basis for subsequent anomaly judgment, ensuring that anomaly identification not only focuses on the deviation of the traffic itself, but also takes into account the risk of system resource carrying capacity. Normalization is a preprocessing method that maps indicators with different dimensions and different numerical ranges to a unified numerical range. Here, min-max normalization (MMN) is used, which can eliminate the difference in dimensions between the initial anomaly score and the predicted resource pressure value, ensuring that the two can be weighted and fused for calculation.

[0038] By implementing step 104, the target anomaly score is determined by combining the initial anomaly score with the predicted resource pressure value. This allows the anomaly assessment to not only reflect the deviation of the network traffic characteristics themselves, but also to reflect their potential pressure impact on the system resource operation status, thereby improving the comprehensiveness, rationality, and practical reference value of the anomaly score.

[0039] Step 105: Compare the target anomaly score with the decision score threshold to determine whether the real-time network traffic data is abnormal.

[0040] The decision scoring threshold is determined based on the global anomaly event occurrence rate of the target system.

[0041] In some examples, the decision scoring threshold is a dynamically adjusted judgment critical value based on the global anomaly event occurrence rate of the target system. It is a continuous score of the same dimension as the target anomaly score, derived from the product of a preset base scoring threshold and a system status coefficient. This can replace a fixed threshold to adapt to the judgment needs under different anomaly states of the system, improving the flexibility and accuracy of anomaly judgment. The global anomaly event occurrence rate is the frequency of anomaly traffic events occurring in the target system within a specific time range, typically ranging from 0% to 100%. It is derived from the comparison calculation results of anomaly event statistics within a sliding time window and historical benchmark data, reflecting the current overall anomaly state of the target system and providing a core basis for the dynamic adjustment of the decision scoring threshold.

[0042] By implementing step 105, the target anomaly score is compared with the decision score threshold determined based on the global anomaly event occurrence rate of the target system. This allows the final anomaly judgment to be adapted to the overall historical anomaly level of the system, which helps to maintain a stable and controllable judgment standard under different anomaly occurrence frequencies and improves the reliability and practicality of anomaly identification results.

[0043] In summary, this embodiment generates a first baseline threshold and a second baseline threshold based on the target system's historical steady-state operating mode and historical sensitive operating mode, respectively, to perform initial anomaly scoring on real-time network traffic characteristics. This enables anomaly detection to distinguish between normal fluctuations and genuine anomalies under different operating states, thereby reducing the probability of false positives and false negatives. Only when the initial anomaly score exceeds a preset scoring threshold is a network resource topology model used for impact propagation simulation. This helps to ensure anomaly identification accuracy while avoiding complex simulation analysis of all traffic data, thus improving overall processing efficiency. By performing impact propagation simulation in the network resource topology model, the predicted resource pressure value of resource nodes is obtained, and combined with the initial anomaly... The method uses a consistent scoring system to determine the target anomaly score, ensuring that anomaly assessment considers not only the traffic characteristics themselves but also their potential impact on internal system resource pressure, thus improving the comprehensiveness and rationality of the anomaly score. The decision scoring threshold is determined based on the global anomaly event occurrence rate of the target system, allowing the final anomaly judgment to match the overall operational status and historical anomaly levels of the system, which is beneficial for maintaining stable and controllable anomaly identification results under different anomaly occurrence frequencies. By combining multi-threshold baseline modeling, resource impact simulation, and a global anomaly rate-driven decision mechanism, this method can more comprehensively and reliably identify abnormal network traffic in complex network environments, enhancing its stability and adaptability in practical applications. In summary, the network traffic anomaly identification method provided in this application, through multi-baseline threshold anomaly scoring, resource topology-based impact propagation simulation, and a decision mechanism combined with a global anomaly occurrence rate, can achieve more accurate, comprehensive, and stable identification of network traffic anomalies while ensuring processing efficiency.

[0044] In some embodiments, step 101 may include: collecting raw network packet streams using probes deployed on the network links of the target system; parsing the raw network packet streams to extract metadata including protocol type, packet size, and timestamp; calculating a first-dimensional feature set and a second-dimensional feature set based on the aforementioned metadata, wherein the first-dimensional feature set includes the total number of bytes and the total number of packets per unit time, and the second-dimensional feature set includes the entropy value of the protocol type distribution, the statistics of the new connection rate and the connection duration distribution; and fusing and standardizing the first-dimensional feature set and the second-dimensional feature set to generate structured traffic features.

[0045] In some examples, probes are core hardware or software components for collecting raw network packet streams. They can be categorized into hardware probes and software probes. Hardware probes have independent processing chips and storage modules, suitable for high-bandwidth, high-volume target system network links. Software probes can be deployed in general-purpose servers or network devices, adaptable to small-to-medium traffic scenarios. Their deployment scope must cover the core network links of the target system, including traffic aggregation nodes such as core switch egress links, critical business server access links, and data center egress links. They can collect raw data from network transmissions in the target system in real-time, in full, or according to preset rules. Raw network packet streams are unprocessed raw data carriers transmitted between various network nodes within the target system. They encompass all packet types conforming to network transmission standards, including Transmission Control Protocol (TCP) messages, User Datagram Protocol (UDP) messages, Internet Control Message Protocol (ICP) messages, and Address Resolution Protocol (ARP) messages. Their source is the real-time data transmission process of each network link in the target system, providing a complete raw data foundation for subsequent metadata extraction. Metadata is the extraction of core information from the original network packet flow. It includes key fields such as protocol type, packet size, timestamp, source internet protocol address, destination internet protocol address, source port number, and destination port number. It originates from the parsing results of the original network packet flow and serves as core data support for subsequent traffic feature calculations, simplifying the data source complexity of feature calculations. The first-dimensional feature set is a set of statistical features reflecting the basic transmission scale of traffic, including the total number of bytes per unit time, the total number of packets, and the average packet size. It originates from statistical calculations based on metadata and can intuitively represent changes in real-time traffic volume. The second-dimensional feature set is a set of features characterizing traffic behavior patterns, including entropy values ​​of protocol type distribution, new connection rates, and statistics (maximum, minimum, average, and variance) of connection duration distribution. It originates from deep calculations based on metadata and can capture abnormal traffic behavior patterns, compensating for the limitations of basic statistical features. Structured traffic features are a set of standardized features after fusion and standardization. They are derived from the fusion and standardization of the first-dimensional feature set and the second-dimensional feature set. They can eliminate redundancy and dimensional differences in the original data and provide standardized input for subsequent baseline comparison and anomaly scoring.

[0046] In the specific implementation process, the raw network packet flow is first collected. The appropriate probe type is selected based on the target system's network bandwidth and business requirements. For high-traffic scenarios such as cloud computing data centers, hardware probes are deployed on the mirror ports of core switches. For low-to-medium traffic scenarios such as enterprise internal LANs, software probes are deployed on border routers. The probes capture the raw network packet flow in real time according to preset collection rules (full collection or sampling based on 5-tuples), with the collection period set to milliseconds to ensure data real-time performance. Subsequently, the raw network packet flow is parsed using deep packet inspection. Inspection (DPI) technology parses the network protocol stack layer by layer, first parsing the data link layer header to obtain physical address information, then parsing the network layer header to extract the Internet Protocol address and protocol type, next parsing the transport layer header to obtain the port number and packet size, and finally extracting application layer information while recording the timestamp of each packet. This yields metadata containing key information such as protocol type, packet size, and timestamp. Based on this metadata, feature calculations are performed, setting a unit time window of 1 second. The total number of bytes and the total number of packets within this window are counted to form the first dimension of the feature set. The entropy value of the protocol type distribution is calculated (a larger entropy value indicates a more balanced protocol distribution; a sudden change in entropy value may indicate anomalies), and the entropy value is statistically analyzed unit time... The number of newly established connections within a given time frame is used to obtain the new connection rate. The duration of all network connections within a preset time frame is extracted, and their maximum, minimum, average, and variance are calculated as statistics of the connection duration distribution, forming the second-dimensional feature set. Finally, feature fusion and standardization are performed. The first-dimensional feature set and the second-dimensional feature set are concatenated in a preset order to form an initial feature vector. The min-max normalization method is used to map each feature value in the initial feature vector to a value range of 0 to 1. The normalization formula is: normalized value = (original feature value - feature minimum value) / (feature maximum value - feature minimum value). The feature minimum and maximum values ​​are derived from the historical traffic feature statistics within a preset historical period of the target system. After processing, structured traffic features are generated.

[0047] Through the implementation of the above embodiments, the original network packet flow is analyzed and features are constructed in multiple dimensions. The traffic scale features and behavioral distribution features are combined to form structured traffic features. This enables network traffic anomaly identification to simultaneously capture multiple security risk manifestations such as traffic surges, protocol distribution anomalies, and connection behavior anomalies. This provides a more comprehensive and fine-grained input basis for subsequent anomaly scoring, which is conducive to improving the accuracy and robustness of anomaly identification.

[0048] In some embodiments, prior to step 102, the aforementioned network traffic anomaly identification method may further include: acquiring a historical traffic feature dataset of the target system within a preset historical period; performing time series clustering analysis on the historical traffic feature dataset to obtain clustering analysis results; based on the clustering analysis results, identifying periods where traffic fluctuation levels are consistently below a first fluctuation threshold, constituting a historical steady-state operation mode sample set; based on the clustering analysis results, identifying periods where traffic exhibits periodic peaks or is highly correlated with a preset business event calendar, constituting a historical sensitive operation mode sample set; calculating a first preset percentile of each traffic feature value in the historical steady-state operation mode sample set as a first baseline threshold; and calculating a second preset percentile of each traffic feature value in the historical sensitive operation mode sample set as a second baseline threshold.

[0049] In some examples, the historical traffic feature dataset within a preset historical period serves as the foundational dataset for mining the target system's operating patterns and generating baseline thresholds. Its data scope covers all structured traffic features accumulated by the target system within the preset time period. The preset historical period is typically set to the last 90 days to ensure data representativeness and timeliness. The data originates from the historical records of structured traffic features stored after processing in step 101 during the target system's past operations. Each data entry contains the first and second dimensions of traffic features corresponding to the time window, providing sufficient historical samples to support subsequent operating pattern identification and baseline calculation. Time Series Clustering Analysis (TSCA) is a data analysis method that groups traffic feature patterns based on data similarity along the time dimension. Commonly used core algorithms include K-Means Clustering Algorithm (K-MCA) and Density-Based Spatial Clustering of Applications with... Noise, DBSCAN, and other algorithms can automatically identify operating modes with similar fluctuation patterns from historical traffic characteristic data, replacing the traditional method of manual pattern division to improve accuracy. Cluster analysis results are the output of time series cluster analysis, containing a collection of multiple clusters, each cluster corresponding to a time period with similar traffic characteristics. This clarifies the temporal distribution of different operating modes in historical traffic data, providing a classification basis for the construction of subsequent sample sets. The first fluctuation threshold is the core criterion for defining steady-state operating modes; it is a percentage value, typically set at 5%, derived from an empirical value calibrated based on the historical normal operating traffic fluctuations of the target system, and can filter out periods of stable traffic fluctuations. The system constructs a historical steady-state operation mode sample set. This sample set consists of structured traffic features corresponding to periods when traffic fluctuation levels are consistently below the first fluctuation threshold. It is a set of classified historical feature samples that can provide a sample foundation with stable fluctuations and no abnormal interference for the generation of the first baseline threshold. The historical sensitive operation mode sample set consists of structured traffic features corresponding to periods when traffic exhibits periodic peaks or is highly correlated with the preset business event calendar. It is also a set of classified historical feature samples. The preset business event calendar contains time records of preset business activities such as e-commerce promotions, data backups, and system maintenance. It can provide sample support that adapts to normal business fluctuations for the generation of the second baseline threshold.The first and second preset percentiles are statistical parameters used to calculate the baseline threshold. Typically, the first preset percentile is selected as the 95th percentile and the second preset percentile as the 99th percentile. These are derived from statistical standards set based on the distribution characteristics of historical samples, filtering out extreme normal fluctuations in historical samples and ensuring that the generated baseline threshold covers the vast majority of normal operating scenarios. The first and second baseline thresholds are respectively the baseline values ​​of traffic characteristics for each dimension calculated based on two types of sample sets. They are quantified thresholds corresponding to various indicators of structured traffic characteristics and can serve as the core comparison standard for judging whether real-time traffic characteristics are abnormal in step 102, adapting to both steady-state and sensitive operating modes.

[0050] Through the implementation of the above embodiments, time series clustering analysis is performed on historical traffic characteristics, automatically distinguishing and constructing a steady-state operation mode sample set and a sensitive operation mode sample set. This enables the generation of baseline thresholds to truly reflect the traffic characteristics of the target system at different business stages, avoids the bias caused by a single historical statistical baseline, improves the rationality of anomaly scoring from the source, and can alleviate the problem of misjudgment caused by business periodic changes.

[0051] In some embodiments, step 102 may include: determining the current operating mode category of the target system based on the system time of the target system and a preset business mode calendar; if the operating mode category is a steady-state operating mode, comparing the structured traffic features with a first baseline threshold item by item to determine a first multidimensional deviation vector; if the operating mode category is a sensitive operating mode, comparing the structured traffic features with a second baseline threshold item by item to determine a second multidimensional deviation vector; correcting the first or second multidimensional deviation vector based on the business context information of the target system to obtain a third multidimensional deviation vector, wherein the business context information may include system maintenance, application release, and data backup; calculating the weighted norm of the third multidimensional deviation vector to obtain a comprehensive deviation degree; mapping the comprehensive deviation degree to a preset numerical range through a preset scoring function to obtain an initial anomaly score.

[0052] In some examples, the system time is the real-time time information recorded by the target system's built-in clock module. It originates from the target system's hardware clock or the standard time synchronized by the Network Time Protocol (NTP), providing a time reference for the current moment and a basis for determining the operating mode category. The preset business mode calendar is a structured document recording the time ranges corresponding to various business operating modes of the target system. It originates from information configured by the target system administrator based on business planning and historical operating patterns. It includes regular business periods (such as off-peak hours on weekdays) corresponding to steady-state operating modes and special business periods (such as promotional or backup periods) corresponding to sensitive operating modes. It is a time-mode mapping table that can be linked with the system time to achieve accurate determination of the operating mode category. The operating mode category is a classification of the target system's current operating state, divided into steady-state operating modes and sensitive operating modes. It originates from the comparison results between the system time and the preset business mode calendar, determining the baseline threshold type suitable for subsequent structured traffic feature comparisons. The first multidimensional deviation vector is a quantified vector of the deviation degree of structured traffic features after item-by-item comparison with the first baseline threshold under steady-state operating modes. The second multidimensional deviation vector is... The deviation quantization vector, compared with the second baseline threshold under sensitive operating mode, is a numerical vector of the same type as the structured traffic feature dimensions. It originates from the deviation calculation results between the features and the corresponding baseline thresholds, and can initially quantify the deviation level of traffic features in each dimension. Business context information is auxiliary information reflecting the current business operation status of the target system, including information related to normal business operations such as system maintenance plans, application release schedules, and data backup cycles. It originates from the target system's operation and maintenance management logs or preset business plan documents, and can correct the multi-dimensional deviation vector, eliminating the interference of traffic fluctuations caused by normal business operations on the deviation quantization results. The third multi-dimensional deviation vector is the deviation quantization vector corrected by business context information. It is a numerical vector of the same dimension as the first two types of deviation vectors, originating from the correction results of the first or second multi-dimensional deviation vector, and can provide accurate deviation data after excluding normal interference. Weighted norm calculation is a method for calculating the vector magnitude considering the importance weights of each feature dimension, and can use the weighted L2 norm (Weighted L2 norm). L2Norm calculation can transform a multi-dimensional deviation vector into a single comprehensive deviation value. The comprehensive deviation is a quantification of the overall deviation of traffic characteristics in each dimension. It is a non-negative continuous value and can serve as the core input for the initial anomaly score mapping. The preset scoring function is a mapping function that transforms the comprehensive deviation into a score within a fixed numerical range. The commonly used function is the Sigmoid Function (SF). The preset numerical range is usually from 0 to 100 points. It is a non-linear mapping function that can transform the abstract deviation into an intuitive anomaly score.The initial anomaly score is a preliminary quantitative result of the degree of traffic anomaly, a continuous score from 0 to 100. A higher score indicates a higher degree of anomaly. The score is derived from the mapping result of the comprehensive deviation degree through a preset scoring function, and can provide a basis for triggering judgments in subsequent impact propagation simulations.

[0053] By implementing the above embodiments, the current operating mode of the system is dynamically determined by combining the business mode calendar, and business context information is introduced to correct the traffic deviation vector. This enables the initial anomaly score to distinguish between business-driven traffic changes and potential security anomalies, avoiding interference from legitimate operations such as maintenance and release on the anomaly identification results. This further improves the accuracy and interpretability of anomaly identification in real network security scenarios.

[0054] In some embodiments, the aforementioned simulation of influence propagation based on real-time network traffic data in a network resource topology model to obtain the predicted resource pressure value of at least one resource node may include: parsing the real-time network traffic data into an initial pressure load on one or more initial resource nodes in the network resource topology model according to the destination address, service port, and transaction type of the real-time network traffic data; using the initial pressure load as input, iteratively simulating the transmission and accumulation process of pressure from upstream nodes to downstream nodes according to the pressure transmission coefficient between nodes defined in the network resource topology model; in each iteration simulation, determining whether the accumulated pressure received by each resource node exceeds the preset processing capacity threshold of that node; when the accumulated pressure of any resource node exceeds its preset processing capacity threshold, triggering the simulation of the pressure amplification effect of the resource node on downstream nodes; when the pressure amplification effect simulation process reaches a preset stable state or reaches the maximum number of iterations, outputting the accumulated pressure value of each resource node as the predicted resource pressure value.

[0055] In some examples, the destination address is the network location information of the target resource node in the real-time network traffic data. It is an Internet Protocol Address (IPA) derived from the parsing results of the real-time network traffic data. This allows for precise location of the initial resource node corresponding to the traffic, providing a target basis for the allocation of initial load pressure. The service port is an identifier that distinguishes different network services on the target resource node. It is a 16-bit integer port number, also derived from the parsing results of the real-time network traffic data. This further clarifies the specific service type corresponding to the traffic, ensuring that the initial load pressure calculation is aligned with service characteristics. The transaction type is a classification of the business operations carried by the real-time network traffic. Types include data query, file transfer, and business submission. This type is derived from the parsing of application layer information based on the traffic packets. It can refine the initial load pressure calculation by combining the service type. The quantification standard for stress load; the initial stress load is the quantified value of the load generated by real-time network traffic data on the initial resource nodes, and is a resource utilization-related indicator (such as CPU utilization and bandwidth utilization). It originates from the correlation calculation based on traffic parameters and service types, and can provide initial input data for impact propagation simulation; the network resource topology model is a structured model that characterizes the resource nodes of the target system and the relationships between nodes. It is a directed graph model, where nodes correspond to resource components such as application servers and switches, and edges correspond to the connections between nodes. It is constructed based on the scanning results of network topology discovery tools and resource configuration information, and can reconstruct the transmission path of stress within the system; the stress transmission coefficient is a characterization of... The parameter for the intensity of pressure transmission between resource nodes is a value between 0 and 1. A larger value indicates a more significant transmission impact. It is derived from training results based on historical resource load correlation data, enabling precise quantification of pressure transmission patterns. Iterative simulation simulates the pressure transmission and accumulation process through iterative numerical calculations, dynamically recreating the pressure diffusion process between resource nodes. The preset processing capacity threshold represents the maximum load limit that a resource node can stably handle, representing the peak resource utilization rate (e.g., 100% CPU utilization and 10 gigabits per second bandwidth). It is derived from the resource node's hardware parameter specifications or system configuration information and serves as a core standard for determining whether a resource node is overloaded. Pressure amplification effect... The first parameter represents the aggravated pressure on downstream nodes after resource node overload, serving as a load amplification simulation mechanism capable of recreating the cascading pressure increase caused by overload. The second parameter represents the state where the pressure changes at each node tend to level off during the pressure transmission process, serving as a threshold criterion for judging the pressure change amount and determining reasonable conditions for stopping the simulation. The third parameter represents the maximum number of iterations, a positive integer parameter derived from empirical values ​​set based on the system resource scale, ensuring simulation efficiency. The fourth parameter represents the expected load values ​​of each resource node obtained from the simulation, serving as a quantitative indicator of resource occupancy, derived from the simulation results of the pressure transmission and accumulation process, and capable of quantifying the potential impact of abnormal traffic on system resources.

[0056] In the specific implementation process, firstly, real-time network traffic data is analyzed to extract destination addresses, service ports, and transaction types. Using a pre-defined address-node mapping table, the destination addresses are matched with resource nodes in the network resource topology model to determine one or more initial resource nodes. Then, a pre-defined load quantization mapping table is queried based on the service port and transaction type. For example, for port 80 corresponding to Web services and data query transactions, the data packet rate and byte rate of real-time traffic are converted into initial load on the initial resource nodes based on the correlation formula between the number of requests per unit time and CPU utilization. For example, 1000 query requests per second corresponds to an initial load of 20% CPU utilization. Next, the initial load is input into the network resource topology model, and the pre-defined inter-node pressure transmission coefficients in the model are called. An iterative calculation method is used to simulate pressure transmission. Assuming the transmission between initial resource node A and downstream node B... With a coefficient of 0.7, and an initial pressure of 20% for node A, node B will accumulate 14% pressure in the first iteration. During each iteration, the accumulated pressure value of each resource node is calculated in real time and compared with the preset processing capacity threshold of that node. If the preset processing capacity threshold of a certain application server's CPU is 80%, and the current accumulated pressure reaches 85%, a pressure amplification effect simulation is triggered, multiplying the excess 5% pressure by a preset amplification coefficient of 1.5 and transmitting it to downstream nodes. During the continuous iterative simulation, the pressure change of each node is monitored in real time. When the pressure change in two consecutive iterations is less than the preset fluctuation threshold of 0.5%, a preset stable state is determined to have been reached. If a stable state has not been reached but the number of iterations has reached the maximum number of iterations (50), the iteration is forcibly stopped. Finally, the final accumulated pressure value of each resource node participating in the simulation is output, which is the predicted resource pressure value of each resource node, completing the entire process of the impact propagation simulation.

[0057] Through the implementation of the above embodiments, the transmission and amplification process of traffic pressure between resource nodes is simulated in the network resource topology model, so that the cascading impact of abnormal traffic on servers, links and service nodes can be quantitatively evaluated. This effectively makes up for the shortcomings of the existing technology that only focuses on the traffic itself and ignores the system resource carrying capacity, and can provide a basis for abnormal risk assessment that is closer to the actual system operating status.

[0058] In some embodiments, step 104 may include: normalizing the initial anomaly score to obtain a first normalized score; normalizing the maximum value among the predicted resource pressure values ​​of all resource nodes to obtain a second normalized score; obtaining a first preset weight coefficient and a second preset weight coefficient, wherein the sum of the first preset weight coefficient and the second preset weight coefficient is 1; multiplying the first normalized score by the first preset weight coefficient to obtain a first weighted score; multiplying the second normalized score by the second preset weight coefficient to obtain a second weighted score; and calculating the sum of the first weighted score and the second weighted score as the target anomaly score.

[0059] In some examples, normalization is a core data preprocessing method to eliminate differences in the dimensions of indicators across different dimensions. Here, min-max normalization is used, a linear normalization algorithm that maps the initial anomaly score and the predicted resource pressure value to a unified numerical range, providing a foundation for subsequent weighted fusion. The initial anomaly score uses the traffic anomaly degree quantification result generated in step 102, which is a continuous score from 0 to 100. It originates from the mapping result of the comprehensive deviation degree through a preset scoring function, providing raw quantitative data on the anomaly level of the traffic itself. The first normalized score is the standardized result of the initial anomaly score after normalization, a continuous value from 0 to 1. It originates from the result of the initial anomaly score calculated using the min-max normalization formula, eliminating the influence of the initial anomaly score's magnitude and allowing it to be fused with resource pressure-related indicators. The predicted resource pressure value is the load quantification value of each resource node obtained through influence propagation simulation in step 103. The types include CPU utilization, memory usage, bandwidth usage, etc., originating from the simulation output of the network resource topology model. The maximum value is selected as the core indicator because it best reflects the extreme resource impact of abnormal traffic on the target system. The first normalized score provides key quantitative data on the resource impact dimension; the second normalized score is the standardized result of normalizing the maximum predicted resource pressure value, a continuous value from 0 to 1, derived from the calculation of the maximum predicted resource pressure value using the minimum-maximum normalization formula, achieving a unified dimension of resource impact and traffic anomaly; the first and second preset weighting coefficients are parameters that adjust the proportion of the two types of normalized scores in the comprehensive evaluation, both being values ​​from 0 to 1, with their sum fixed at 1, derived from settings based on the target system's business requirements and resource importance. The empirical values ​​or optimized values ​​trained on historical anomaly data enable the target anomaly score to adapt to the risk assessment focus of different scenarios. The first weighted score and the second weighted score are the product of the two types of normalized scores and the corresponding weight coefficients, respectively. They are continuous values ​​from 0 to 1, which can realize the weighted consideration of different assessment dimensions. The target anomaly score is the sum of the two types of weighted scores. It is a continuous score from 0 to 1 or 0 to 100. It comes from the weighted fusion calculation results and can comprehensively represent the degree of traffic anomaly and the degree of resource impact, providing a comprehensive and accurate core quantitative basis for subsequent anomaly judgment.

[0060] Through the implementation of the above embodiments, the initial anomaly score and the predicted resource pressure value are normalized and weighted to form a unified target anomaly score. This makes the anomaly judgment reflect both the degree of anomaly in traffic behavior and the system resource risks it may cause. It can achieve a more balanced and reasonable risk ranking and alarm decision-making in various anomaly scenarios.

[0061] In some embodiments, prior to step 105, the aforementioned network traffic anomaly identification method may further include: determining the current anomaly event rate of the target system based on the number of events of real-time network traffic data identified as anomalies within a sliding time window of a preset time length; obtaining the historical baseline anomaly event rate of the target system; determining the ratio of the current anomaly event rate to the historical baseline anomaly event rate as the system situation coefficient; and multiplying a preset basic scoring threshold by the system situation coefficient to obtain a decision scoring threshold.

[0062] In some examples, the Sliding Time Window (STW) is a time interval used to dynamically count the number of abnormal events. It is a fixed-length window that can be continuously slidable. The preset time length can be set from 3 to 10 minutes according to the target system's business response requirements. It originates from the system's configured time parameters and can limit the statistical range of the current abnormal event occurrence rate, ensuring that the statistical results can reflect the recent abnormal situation of the system in real time. The current abnormal event occurrence rate is the proportion of abnormal traffic events to total traffic events within the sliding time window of the target system. It is a percentage value, ranging from 0% to 100%. It is derived from the ratio of the number of real-time network traffic data events initially judged as abnormal within the window to the total number of traffic events within the window. It can intuitively represent the current frequency of abnormal events in the system and provide a core basis for the dynamic adjustment of decision scoring thresholds. The historical baseline abnormal event occurrence rate is the baseline value of the abnormal event occurrence rate under normal operating conditions of the target system. It is a percentage value, derived from the average of the abnormal event occurrence rates calculated within each sliding time window of the same length during the past 30 to 90 days of normal system operation (without large-scale abnormalities or special faults). This can be used as a benchmark for... To measure the current abnormal situation and ensure the rationality of the system situation coefficient calculation, the system situation coefficient is the ratio of the current abnormal event occurrence rate to the historical baseline abnormal event occurrence rate. It is a positive number greater than 0. When the current occurrence rate is higher than the historical baseline, the coefficient is greater than 1; when it is lower than the historical baseline, the coefficient is less than 1. It is derived from the division of the two and can quantify the degree of deviation of the current abnormal situation from the normal state, enabling adaptive adjustment of the decision scoring threshold. The preset basic scoring threshold is the benchmark critical value for abnormal judgment. It is a score of the same dimension as the target abnormal score (usually 0 to 100 points). It is derived from the empirical value calibrated based on the historical false positive rate and false negative rate of the target system's abnormal events, or the optimized value obtained by training through historical abnormal data. It can provide a basic reference standard for the calculation of the decision scoring threshold. The decision scoring threshold is a dynamic judgment critical value adapted to the real-time abnormal situation of the system. It is a score of the same dimension as the target abnormal score and is derived from the product of the preset basic scoring threshold and the system situation coefficient. It can replace the fixed threshold, allowing the abnormal judgment standard to be flexibly adjusted with changes in the abnormal situation of the system, improving the adaptability and accuracy of abnormal judgment.

[0063] By implementing the above embodiments, the current anomaly occurrence rate based on a sliding time window is introduced, and the decision scoring threshold is dynamically adjusted in combination with the historical benchmark anomaly occurrence rate. This enables the anomaly judgment criteria to be adaptively adjusted with changes in the overall network security situation, avoiding excessive alarms or missed reports during periods of high or low anomaly occurrence. This improves the stability and adaptability of the anomaly identification mechanism in complex network security environments.

[0064] Furthermore, as an implementation of the aforementioned method embodiments, this application also provides a network traffic anomaly identification device for implementing the aforementioned method embodiments. This device embodiment corresponds to the aforementioned method embodiments. For ease of reading, this network traffic anomaly identification device embodiment will not repeat the details of the aforementioned method embodiments one by one, but it should be understood that the device in this application embodiment can correspondingly implement all the contents of the aforementioned method embodiments. For example... Figure 2 As shown, the network traffic anomaly identification device 20 includes: a feature acquisition unit 201, an initial score determination unit 202, a pressure determination unit 203, a target score determination unit 204, and an anomaly determination unit 205. The feature acquisition unit 201 is used to acquire structured traffic features of real-time network traffic data of the target system; the initial score determination unit 202 is used to determine an initial anomaly score of the structured traffic features based on a first baseline threshold and a second baseline threshold, wherein the first baseline threshold is generated based on the historical steady-state operating mode of the target system, and the second baseline threshold is generated based on the historical sensitive operating mode of the target system; the pressure determination unit 205... 03 is used to respond to an initial anomaly score exceeding a preset score threshold by performing an impact propagation simulation based on real-time network traffic data in a network resource topology model to obtain a predicted resource pressure value for at least one resource node. The network resource topology model defines the pressure transmission relationship between resource nodes of the target system. Target score determination unit 204 is used to determine a target anomaly score based on the initial anomaly score and the predicted resource pressure value. Anomaly determination unit 205 is used to compare the target anomaly score with a decision score threshold to determine whether the real-time network traffic data is abnormal. The decision score threshold is determined based on the global anomaly event occurrence rate of the target system.

[0065] This application also provides a computer-readable storage medium storing computer-executable instructions or computer programs, which, when executed by a processor, will cause the processor to perform any step of the network traffic anomaly identification method provided in this application.

[0066] In some embodiments, the computer-readable storage medium may be a random access memory (RAM), a read-only memory (ROM), flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); or it may be a variety of devices that include one or any combination of the above-mentioned memories.

[0067] In some embodiments, computer-executable instructions may take the form of programs, software, software modules, scripts, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as stand-alone programs or as modules, components, subroutines, or other units suitable for use in a computing environment.

[0068] In some embodiments, computer-executable instructions may, but do not necessarily, correspond to files in a file system, and may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple co-located files (e.g., files that store one or more modules, subroutines, or code sections).

[0069] In some embodiments, computer-executable instructions may be deployed to execute on an electronic device, or on multiple electronic devices located at one location, or on multiple electronic devices distributed across multiple locations and interconnected via a communication network.

[0070] like Figure 3 As shown, this application also provides an electronic device 30, including a memory 310, a processor 320, and a computer program 311 stored in the memory 310 and executable on the processor. When the processor 320 executes the computer program 311, it implements any step of the above-described network traffic anomaly identification method.

[0071] This application also provides a computer program product comprising a computer program or computer-executable instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer program or computer-executable instructions from the computer-readable storage medium and executes the computer program or computer-executable instructions, causing the electronic device to perform any step of the network traffic anomaly identification method described above.

[0072] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for identifying network traffic anomalies, characterized in that, include: Obtain the structured traffic characteristics of real-time network traffic data of the target system; An initial anomaly score for the structured traffic characteristics is determined based on a first baseline threshold and a second baseline threshold, wherein the first baseline threshold is generated based on the historical steady-state operating mode of the target system, and the second baseline threshold is generated based on the historical sensitive operating mode of the target system. In response to the initial anomaly score being greater than a preset score threshold, an impact propagation simulation is performed in the network resource topology model based on the real-time network traffic data to obtain the predicted resource pressure value of at least one resource node, wherein the network resource topology model defines the pressure transmission relationship between resource nodes of the target system. The target anomaly score is determined based on the initial anomaly score and the predicted resource pressure value; The target anomaly score is compared with a decision scoring threshold to determine whether the real-time network traffic data is abnormal, wherein the decision scoring threshold is determined based on the global anomaly event occurrence rate of the target system; The step of performing impact propagation simulation in the network resource topology model based on the real-time network traffic data to obtain the predicted resource pressure value of at least one resource node includes: Based on the destination address, service port, and transaction type of the real-time network traffic data, the real-time network traffic data is parsed into the initial pressure load on one or more initial resource nodes in the network resource topology model; Using the initial pressure load as input, and based on the inter-node pressure transmission coefficient defined in the network resource topology model, the transmission and accumulation process of pressure from upstream nodes to downstream nodes is iteratively simulated. In each iteration of the simulation, it is determined whether the cumulative pressure received by each resource node exceeds the preset processing capacity threshold of that node; When the accumulated pressure on any resource node exceeds its preset processing capacity threshold, the simulation of the pressure amplification effect of the resource node on downstream nodes is triggered. When the pressure amplification effect simulation process reaches a preset stable state or the maximum number of iterations, the cumulative pressure value of each resource node is output as the predicted resource pressure value.

2. The network traffic anomaly identification method according to claim 1, characterized in that, The structured traffic characteristics for acquiring real-time network traffic data of the target system include: Raw network packet flows are collected by probes deployed on the network links of the target system; The original network packet stream is parsed to extract metadata including protocol type, packet size, and timestamp; Based on the metadata, a first-dimensional feature set and a second-dimensional feature set are calculated. The first-dimensional feature set includes the total number of bytes and the total number of data packets per unit time. The second-dimensional feature set includes the entropy value of the protocol type distribution and the statistics of the new connection rate and connection duration distribution. The first dimension feature set and the second dimension feature set are fused and standardized to generate the structured traffic features.

3. The network traffic anomaly identification method according to claim 1, characterized in that, Before determining the initial anomaly score of the structured traffic features based on a first baseline threshold and a second baseline threshold, the network traffic anomaly identification method further includes: Obtain the historical traffic feature dataset of the target system within a preset historical period; Time series clustering analysis was performed on the historical traffic feature dataset to obtain the clustering analysis results; Based on the cluster analysis results, periods in which the flow fluctuation level was consistently below the first fluctuation threshold were identified, forming a historical steady-state operation mode sample set; Based on the clustering analysis results, time periods in which traffic exhibits periodic peaks or is highly correlated with a preset business event calendar are identified, forming a sample set of historically sensitive operating modes; Calculate the first preset percentile of each flow characteristic value in the historical steady-state operation mode sample set, and use it as the first baseline threshold. Calculate the second preset percentile of each traffic characteristic value in the historical sensitive operation mode sample set, and use it as the second baseline threshold.

4. The network traffic anomaly identification method according to claim 1, characterized in that, The initial anomaly score for the structured traffic features, determined based on a first baseline threshold and a second baseline threshold, includes: Based on the system time of the target system and the preset business mode calendar, determine the current operating mode category of the target system; If the operating mode category is a steady-state operating mode, then the structured traffic features are compared with the first baseline threshold item by item to determine the first multidimensional deviation vector; If the operating mode category is a sensitive operating mode, then the structured traffic features are compared with the second baseline threshold item by item to determine the second multidimensional deviation vector; Based on the business context information of the target system, the first multidimensional deviation vector or the second multidimensional deviation vector is corrected to obtain a third multidimensional deviation vector, wherein the business context information includes system maintenance, application release and data backup; The weighted norm of the third multidimensional deviation vector is calculated to obtain the comprehensive deviation degree; The overall deviation is mapped to a preset numerical range using a preset scoring function to obtain the initial anomaly score.

5. The network traffic anomaly identification method according to claim 1, characterized in that, The step of determining the target anomaly score based on the initial anomaly score and the predicted resource pressure value includes: The initial anomaly score is normalized to obtain a first normalized score; The maximum value among the predicted resource pressure values ​​of all resource nodes is normalized to obtain a second normalized score. Obtain a first preset weight coefficient and a second preset weight coefficient, wherein the sum of the first preset weight coefficient and the second preset weight coefficient is 1; Multiply the first normalized score by the first preset weight coefficient to obtain the first weighted score; Multiply the second normalized score by the second preset weight coefficient to obtain the second weighted score; The sum of the first weighted score and the second weighted score is calculated as the target anomaly score.

6. The network traffic anomaly identification method according to claim 1, characterized in that, Before comparing the target anomaly score with a decision score threshold to determine whether the real-time network traffic data is abnormal, the network traffic anomaly identification method further includes: The current abnormal event occurrence rate of the target system is determined based on the number of events of the real-time network traffic data that are identified as abnormal within a sliding time window of a preset time length. Obtain the historical baseline anomaly event occurrence rate of the target system; The ratio of the current abnormal event occurrence rate to the historical baseline abnormal event occurrence rate is determined as the system situation coefficient; The decision scoring threshold is obtained by multiplying the preset basic scoring threshold by the system situation coefficient.

7. A network traffic anomaly identification device, characterized in that, include: The feature acquisition unit is used to acquire structured traffic features of real-time network traffic data of the target system. An initial scoring determination unit is used to determine an initial anomaly score of the structured traffic characteristics based on a first baseline threshold and a second baseline threshold, wherein the first baseline threshold is generated based on the historical steady-state operating mode of the target system, and the second baseline threshold is generated based on the historical sensitive operating mode of the target system; The pressure determination unit is used to respond to the initial anomaly score being greater than a preset score threshold by performing an impact propagation simulation in a network resource topology model based on the real-time network traffic data to obtain a predicted resource pressure value for at least one resource node, wherein the network resource topology model defines the pressure transmission relationship between resource nodes of the target system. The target score determination unit is used to determine the target anomaly score based on the initial anomaly score and the predicted resource pressure value; An anomaly determination unit is used to compare the target anomaly score with a decision scoring threshold to determine whether the real-time network traffic data is abnormal, wherein the decision scoring threshold is determined based on the global anomaly event occurrence rate of the target system; The pressure determination unit is further configured to parse the real-time network traffic data into an initial pressure load on one or more initial resource nodes in the network resource topology model based on the destination address, service port, and transaction type of the real-time network traffic data; using the initial pressure load as input, iteratively simulate the transmission and accumulation process of pressure from upstream nodes to downstream nodes according to the inter-node pressure transmission coefficient defined in the network resource topology model; in each iteration simulation, determine whether the accumulated pressure received by each resource node exceeds the preset processing capacity threshold of that node; when the accumulated pressure of any resource node exceeds its preset processing capacity threshold, trigger the simulation of the pressure amplification effect of the resource node on downstream nodes; when the pressure amplification effect simulation process reaches a preset stable state or reaches the maximum number of iterations, output the accumulated pressure value of each resource node as the predicted resource pressure value.

8. An electronic device, comprising: A memory and a processor, characterized in that the processor, when executing a computer program stored in the memory, implements the steps of the network traffic anomaly identification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the network traffic anomaly identification method as described in any one of claims 1 to 6.

Images