Abnormal attack identification method and system based on traffic data analysis

Abstract

The present application relates to the technical field of data processing, and more particularly to an abnormal attack identification method and system based on traffic data analysis. The method comprises the steps of: obtaining the data packet sequence of each source IP within a preset time window; determining the time series rhythm stability index according to the packet sending time interval feature and byte length; determining the space-time topology erosion degree according to the destination IP access dispersion and destination port distribution width, and combining the rhythm stability index; dynamically correcting the erosion degree using the network real-time traffic load and erosion degree historical increment to generate the final abnormal attack judgment coefficient, and then identifying the abnormal attack source. The present application solves the problem that traditional technology is difficult to capture low-frequency slow attacks and multi-source collaborative detection, and through the space-time feature fusion and environment adaptive mechanism, the precision identification ability of hidden network attacks is significantly improved while ensuring stable operation during peak business hours.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to an anomaly attack identification method and system based on traffic data analysis. Background Technology

[0002] With the rapid development of internet technology, network attack methods are becoming increasingly complex and covert. New threats such as low-frequency, highly covert slow attacks and distributed collaborative attacks are constantly emerging, posing unprecedented challenges to the accuracy and timeliness of network security protection systems. Traditional network intrusion detection systems (IDS), as one of the core foundational devices for network security protection, generally focus their abnormal behavior identification logic on macroscopic statistical indicators such as instantaneous traffic rate and the number of data packets per unit time. For example, they set an alarm when the number of data packets per second exceeds a certain value or the instantaneous traffic rate exceeds a certain limit.

[0003] However, existing technologies have significant limitations in dealing with modern complex attacks. On the one hand, existing detection technologies mostly perform feature matching analysis on single data packets or single network connections, without considering time-series correlation characteristics. This has significant limitations in dealing with low-frequency, slow attacks launched by automated scripts. For example, low-frequency, slow attacks use timed triggering mechanisms to regulate packet sending behavior, keeping macroscopic indicators such as the traffic rate and number of data packets generated by a single node below a preset alarm threshold, thereby evading detection. On the other hand, existing technologies struggle to capture the characteristics of cross-IP, multi-port spatial coordinated attacks. For instance, attackers often perform discrete probing on a large number of IPs (such as full network scanning) or multi-port probing on the target host, exhibiting attack characteristics of port scanning or vulnerability probing. This often results in macroscopic traffic indicators being below the alarm threshold, leading to misjudgments as normal access behavior. In summary, existing technologies directly lead to the difficulty for detection systems in identifying complex attack patterns that are covert and cross-session, resulting in a persistently high false negative rate and an inability to provide reliable and effective security protection for the network environment. Summary of the Invention

[0004] To address the technical problem that existing technologies make it difficult for detection systems to identify complex attack patterns with stealth and cross-session characteristics, resulting in a persistently high false negative rate, this invention provides an anomaly attack identification method and system based on traffic data analysis.

[0005] In a first aspect, the present invention provides an abnormal attack identification method based on traffic data analysis, which adopts the following technical solution: Anomaly attack identification method based on traffic data analysis includes the following steps: Based on a preset time window, obtain the data packet sequence of each source IP address; Based on the packet sending time interval and packet byte length in the packet sequence, obtain the time series rhythm stability index for each source IP address; based on the dispersion of each source IP address's access to the destination IP address and the distribution breadth of access to the destination port, and in combination with the time series rhythm stability index, obtain the spatiotemporal topology erosion degree for each source IP address. Based on the real-time load status of the entire network traffic and the historical trend of the spatiotemporal topology erosion, the spatiotemporal topology erosion is dynamically corrected to obtain the final abnormal attack judgment coefficient for each source IP address. The final abnormal attack determination coefficient is compared with a preset determination coefficient threshold to identify the source of the abnormal attack.

[0006] The innovation of this invention lies in obtaining the final abnormal attack judgment coefficient of each source IP address by constructing temporal rhythm stability and spatial topology erosion. This breaks the limitation of traditional detection relying solely on traffic thresholds, effectively identifying hidden low-frequency slow attacks and multi-source collaborative attacks, while significantly reducing the false alarm rate during peak business periods and improving the security protection accuracy of the power grid and network environment.

[0007] Preferably, obtaining the time-series rhythm stability index for each source IP address includes: The sum of the byte lengths of all data packets in the data packet sequence of the k-th source IP is taken as the total number of bytes of the data packets of the k-th source IP; the ratio of the total number of bytes of the data packets to the number of data packets in the data packet sequence of the k-th source IP is taken as the average byte length of the data packets sent by the k-th source IP, denoted as . ; Obtain the mean and variance of the time intervals between data packets sent by the k-th source IP; , The time series rhythm stability index represents the k-th source IP. This represents the average time interval between data packets sent by the k-th source IP address. This represents the variance of the time interval between data packets sent by the k-th source IP address. Represents preset hyperparameters; This represents the number of packets in the packet sequence of the k-th source IP address; This represents the logarithmic function.

[0008] The time series rhythm stability index can quantitatively distinguish between regular traffic initiated by automated scripts and random characteristics of human access, enabling preliminary and accurate screening of highly deterministic abnormal machine traffic.

[0009] Preferably, obtaining the mean and variance of the time interval for the k-th source IP to send data packets includes: The mean of the time intervals between all two adjacent data packets in the data packet sequence of the k-th source IP is taken as the mean of the time intervals for sending data packets by the k-th source IP; the variance of the time intervals between all two adjacent data packets in the data packet sequence of the k-th source IP is taken as the variance of the time intervals for sending data packets by the k-th source IP.

[0010] Preferably, obtaining the spatiotemporal topology erosion degree of each source IP address includes:

[0011] In the formula, The spatiotemporal topological erosion degree of the k-th source IP; The time series rhythm stability index represents the k-th source IP. This represents the number of destination IP types for the k-th source IP. This represents the number of connections from the k-th source IP to its m-th category IP; This represents the sum of the number of connections from the k-th source IP to all IPs of its respective categories; This represents the number of unique destination ports accessed by the k-th source IP. Represents the first weighting coefficient; This represents the second weighting coefficient, used for adjustment. Weight in the overall indicators; This represents the logarithmic function with base 2.

[0012] By calculating the degree of confusion of the access destination address and the breadth of the probe to the destination port, it is possible to effectively identify the attacker's behavior of performing a full network scan or multi-port vulnerability probe, thereby distinguishing between legitimate single-point automated tasks and malicious probes with attack characteristics.

[0013] Preferably, obtaining the number of connections from the k-th source IP to its m-th category IP includes: From the flow records corresponding to all data packets in the data packet sequence of each source IP, count the number of destination IP address categories, which is the number of destination IP types for each source IP; from the flow records corresponding to all data packets in the data packet sequence of the k-th source IP, count the number of times the IP address of the m-th category appears, which is the number of connections from the k-th source IP to its m-th category IP.

[0014] Preferably, obtaining the number of unique destination ports accessed by the k-th source IP includes: From the flow records corresponding to all data packets in the data packet sequence of each source IP, count the number of destination port categories, which is used as the unique number of destination ports accessed by each source IP.

[0015] Preferably, obtaining the final abnormal attack determination coefficient for each source IP address includes: , The final abnormal attack determination coefficient represents the k-th source IP. The spatiotemporal topological erosion degree of the k-th source IP; This represents the historical spatiotemporal topological erosion degree of the k-th source IP. This represents the network's overall throughput per second at the current moment. This represents the overall traffic throughput per second under stable network conditions. represents the trend-sensitive factor, used to adjust the system's weight in responding to incremental changes in erosion; e represents the natural constant; max() represents the maximum value function.

[0016] Subsequently, by dynamically comparing the final abnormal attack determination coefficient with the threshold, the system achieved automated identification of high-risk attack sources, thereby improving the automation level of network defense.

[0017] Preferably, the acquisition of the historical spatiotemporal topological erosion degree of the kth source IP includes: With a preset time window length N, the timestamp corresponding to the first data packet in the data packet sequence of the k-th source IP is recorded as the start time. The sequence of data packets of the k-th source IP collected within N minutes before the start time is used as the historical data packet sequence of the k-th source IP. Based on the historical data packet sequence of the k-th source IP, the historical spatiotemporal topology erosion of the k-th source IP is obtained using the source IP spatiotemporal topology erosion acquisition method.

[0018] Preferably, the step of obtaining the data packet sequence of each source IP address based on a preset time window includes: By deploying probe devices on network gateways or switch mirror ports, network traffic data packets are collected in real time. Standard protocol deep packet inspection technology is used to perform structured parsing of the header information of each collected data packet, extracting flow records containing source IP address, destination IP address, destination port, timestamp, and data packet size. With a preset time window length N, all data packets sent by the same source IP address up to the current time are arranged in ascending order according to the timestamps in their corresponding flow records to obtain the original data packet sequence of each source IP. The sequence of data packets collected in the N minutes before the timestamp corresponding to the last data packet in the original data packet sequence of the k-th source IP is taken as the data packet sequence of each source IP.

[0019] This provides a timely foundational dataset for subsequent multi-dimensional feature extraction.

[0020] Secondly, the present invention provides an abnormal attack identification system based on traffic data analysis, which adopts the following technical solution: An anomaly attack identification system based on traffic data analysis includes a processor and a memory. The memory stores computer program instructions, which, when executed by the processor, implement the aforementioned anomaly attack identification method based on traffic data analysis.

[0021] By adopting the above technical solution, the above-mentioned abnormal attack identification method based on traffic data analysis is generated into a computer program and stored in a memory so that it can be loaded and executed by the processor. In this way, a terminal device can be made based on the memory and the processor for convenient use.

[0022] This invention offers the following technical advantages: First, it quantifies and distinguishes between the regularity of traffic initiated by automated scripts and the randomness of human access, obtaining a time-series rhythm stability index, thus achieving preliminary and accurate screening of highly deterministic abnormal machine traffic. Next, based on the degree of disorder in the destination address and the breadth of probes to the destination port, it obtains spatial topology erosion, effectively identifying attackers' actions of performing full-network scanning or multi-port vulnerability probing, thereby distinguishing legitimate single-point automated tasks from malicious probes with attack characteristics. Finally, based on the real-time load status of the entire network traffic and the historical trend of the spatiotemporal topology erosion, it obtains the final abnormal attack judgment coefficient for each source IP address, used to determine whether the access behavior is abnormal. This breaks the limitations of traditional technologies that rely solely on traffic thresholds, effectively identifying concealed low-frequency slow attacks and multi-source collaborative attacks, while significantly reducing the false alarm rate during peak business periods and improving the accuracy of security protection for the power grid and network environment. Attached Figure Description

[0023] Figure 1 This is a flowchart of the abnormal attack identification method based on traffic data analysis in an embodiment of the present invention; Figure 2 This is a comparison image of existing technologies and the present invention under the same attack scenario; Figure 3 This is the evolution process of the core feature indicators of this invention. Detailed Implementation

[0024] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0025] This invention discloses an anomaly attack identification method based on traffic data analysis, referring to... Figure 1 This includes steps S1-S4: S1: Based on a preset time window, obtain the data packet sequence of each source IP address.

[0026] In this embodiment of the invention, probe devices deployed on network gateways or switch mirror ports collect network traffic data packets in real time. Standard protocol deep packet inspection technology is used to perform structured parsing of the header information of the collected data packets, extracting flow records containing the source IP address, destination IP address, destination port, timestamp, and data packet size (data packet byte length). Each data packet corresponds to a flow record, containing: source IP address, destination IP address, destination port, timestamp, and data packet size. The preset time window length N=2 minutes is used to sort all data packets sent by the same source IP address up to the current time in ascending order of the timestamps in their corresponding flow records to obtain the original data packet sequence of each source IP. The sequence of data packets collected in the N minutes before the timestamp corresponding to the last data packet in the original data packet sequence of the kth source IP is used as the data packet sequence of each source IP.

[0027] S2: Based on the packet sending time interval and packet byte length in the packet sequence, obtain the time series rhythm stability index for each source IP address; based on the dispersion of each source IP address's access to the destination IP address and the distribution breadth of its access to the destination port, and in conjunction with the time series rhythm stability index, obtain the spatiotemporal topology erosion degree for each source IP address.

[0028] It should be noted that existing technologies for abnormal traffic detection generally focus on macroscopic statistical indicators such as instantaneous traffic rate or the number of data packets per unit time. Such methods have significant limitations in dealing with low-frequency, slow attacks launched by automated scripts. These attacks regulate packet sending behavior through timed triggering mechanisms, keeping macroscopic indicators such as the traffic rate and number of data packets generated by a single node below a preset alarm threshold, thereby evading detection. Although the attack behavior is highly disguised, the data packet sequence generated by the machine will inevitably exhibit a very high degree of determinism in the arrival time interval, which is fundamentally different from the randomness generated when humans access web pages or interact with them. Therefore, this invention introduces the ratio between the mean and variance of the data packet arrival time interval, transforming seemingly normal low-frequency traffic into identifiable machine access characteristics, and achieving preliminary screening of attack behavior. Furthermore, since automated attacks achieve their objectives by sending simple probe or request packets in batches, while the core purpose of normal users' network behavior is to obtain effective data (such as downloading files or browsing videos), the data packets they generate typically exhibit the characteristics of few packets but large payloads. Therefore, this invention further introduces the number and size of the data packets sent, combined with the ratio of the mean to the variance of the data packet arrival time interval, to obtain the time series rhythm stability index of each source IP address, providing comprehensive and reliable data support for subsequent accurate identification of abnormal attack behavior.

[0029] In this embodiment of the invention, the mean of the time intervals between all two adjacent data packets in the data packet sequence of the kth source IP is taken as the mean of the time intervals between data packets sent by the kth source IP; the variance of the time intervals between all two adjacent data packets in the data packet sequence of the kth source IP is taken as the variance of the time intervals between data packets sent by the kth source IP. The sum of the byte lengths of all data packets in the data packet sequence of the k-th source IP is taken as the total number of bytes of the data packets of the k-th source IP; the ratio of the total number of bytes of the data packets to the number of data packets in the data packet sequence of the k-th source IP is taken as the average byte length of the data packets sent by the k-th source IP. Obtain the time series rhythm stability index for each source IP: ; In the formula, The time series rhythm stability index represents the k-th source IP. This represents the average time interval between data packets sent by the k-th source IP address. This represents the variance of the time interval between data packets sent by the k-th source IP address. Representing preset hyperparameters, in this embodiment of the invention, the preset... This is used to prevent the denominator from being zero; This represents the number of packets in the packet sequence of the k-th source IP address; This represents the average byte length of the data packet sent by the k-th source IP address. This represents a logarithmic function, used to compress the dynamic range and prevent extreme values ​​from dominating the indicator; The concept of the coefficient of variation in statistics is used to measure the relative dispersion of data, and the ratio of its inverse mean to variance is used to characterize the stability of the data. In traffic analysis scenarios, the variance of the time interval between data packets sent by the k-th source IP reflects the regularity of packet sending behavior: the smaller the variance, the more fixed the time interval between data packets, the more it tends to be machine automation, and the more stable the packet sending frequency is; the larger the variance, the more random the behavior, and the more likely it is to be normal human operation. Therefore, this invention adopts Obtain time series rhythm stability indices and introduce As the denominator, The smaller the value, the more likely it is to cause A larger value results in a larger time series rhythm stability index for the k-th source IP, indicating that the behavior of that source IP is more similar to that of an automated machine; conversely, a smaller value results in a larger value for the k-th source IP. The larger the value, the better. The smaller the value, the more the source IP's behavior resembles normal human operation; Attacks typically send simple probe packets, characterized by numerous small packets; while normal user behavior (such as downloading files or browsing videos) aims to obtain data and usually involves large packet transmissions. Therefore, the smaller the average byte length of the data packets sent by the k-th source IP and the larger the number of data packets in the data packet sequence of the k-th source IP, the better. The larger the value, the more the source IP behaves like an automated machine.

[0030] It should be noted that if an IP address sends data packets at a stable time rhythm, but the average byte length is extremely large, The value will decrease in the end The value of can prevent the misjudgment of uniform-speed large file transfer as an attack.

[0031] It should be noted that while time-series rhythm stability indicators can effectively identify automated robot behavior, in complex network environments, a single time dimension feature cannot determine whether it has malicious intent. For example, legitimate system heartbeat packets or timed synchronization tasks can also exhibit strong temporal rhythms; if these are directly blocked, a large number of false alarms will inevitably be generated, thereby disrupting normal business operation logic and affecting the stable operation and maintenance of the system. When facing this problem, existing technologies often struggle to effectively distinguish the behavioral attributes of automated nodes and cannot determine whether automated nodes are performing normal single-point communication tasks or carrying out malicious abnormal operations. From the perspective of the nature of attack behavior, the core purpose of attackers is to obtain resources of the target system or disrupt the normal operation of the system. Therefore, such attack behavior will inevitably be manifested through specific network access behavior. This means that their access behavior is not limited to a single target or a fixed port, but rather involves discrete probing of a large number of IPs (such as full network scanning) or multi-port probing of the target host. It has the attack characteristics of port scanning or vulnerability probing, which is different from the fixed access pattern of legitimate automated tasks. Therefore, only by combining the time series rhythm stability index with the spatial dimension of access behavior characteristics can we determine the attack anomaly, thereby effectively avoiding false alarms and accurately identifying the real attack behavior. Therefore, this invention needs to combine the degree of disorder in the access behavior of each source IP in the network space with the time series rhythm stability index to obtain the spatiotemporal topology erosion degree of each source IP. If a node maintains a highly stable packet sending rhythm and continues to change the destination address and try different service ports, the greater its spatiotemporal topology erosion degree, the more likely it is to be an abnormal attack behavior.

[0032] In this embodiment of the invention, the number of destination IP address categories is counted from the flow records corresponding to all data packets in the data packet sequence of each source IP, which is taken as the number of destination IP types for each source IP; the number of times the m-th category IP address appears is counted from the flow records corresponding to all data packets in the data packet sequence of the k-th source IP, which is taken as the number of connections from the k-th source IP to its m-th category IP. From the flow records corresponding to all data packets in the data packet sequence of each source IP, count the number of destination port categories, which is used as the unique number of destination ports accessed by each source IP; Obtain the spatiotemporal topology erosion degree for each source IP: ; In the formula, The spatiotemporal topological erosion degree of the k-th source IP; The time series rhythm stability index represents the k-th source IP. This represents the number of destination IP types for the k-th source IP. This represents the number of connections from the k-th source IP to its m-th category IP; This represents the sum of the number of connections from the k-th source IP to all IPs of its respective categories; This represents the number of unique destination ports accessed by the k-th source IP. Represents the first weighting coefficient; Represents the second weighting coefficient. and These are used to adjust the weights of the target IP distribution entropy and the number of unique ports in the spatial characteristics, respectively, aiming to balance the coverage of two attack types: full network scanning (horizontal scanning) and port scanning (vertical scanning), in order to adapt to different security needs; Represents the logarithmic function with base 2; In this embodiment of the invention, a preset , preset In other embodiments, implementers may pre-set according to specific implementation conditions. as well as Regarding the value, it should be noted that the first weighting coefficient is applicable for adjustment. Weight in the overall indicators; Time series rhythm stability index The larger the value, the more the behavior of the source IP is similar to that of an automated machine, and the greater the probability that the k-th source IP address will launch an abnormal attack. It is based on Shannon information entropy, a standard metric in information theory used to measure the uncertainty of random variables, and information entropy can also be used to detect scanning-type attacks; specifically, Entropy represents the degree of disorder in the access behavior of the k-th source IP in the network space. If the k-th source IP only accesses a few fixed servers, it conforms to normal user behavior and the entropy value is low. If the k-th source IP exhibits uniform and discrete probing of a large number of IPs (such as full network scanning), the entropy value is high. The number of unique destination ports accessed by the k-th source IP refers to the total number of destination ports after deduplication among all network connections initiated by the k-th source IP. This metric is used to quantify the distribution breadth of source IP access to destination ports. If the value is too large, it indicates that the k-th source IP is performing multi-port probing on the target host, exhibiting attack characteristics of port scanning or vulnerability probing. If the value is small and fixed, it conforms to the behavior pattern of normal users accessing specific services.

[0033] S3: Based on the real-time load status of the entire network traffic and the historical trend of the spatiotemporal topology erosion, dynamically correct the spatiotemporal topology erosion to obtain the final abnormal attack determination coefficient for each source IP address.

[0034] It should be noted that even with highly accurate spatiotemporal topology erosion measurements for identifying anomalous attack behavior, network detection systems still face practical application challenges due to background traffic fluctuations. In real-world industrial scenarios or large-scale data centers, the network environment is not static but exhibits periodic traffic fluctuations as business changes occur. During peak business periods, the overall network traffic volume, connection frequency, and port activity increase. At this time, traffic disturbances generated by normal business operations may lead to artificially inflated spatiotemporal topology erosion metrics. Therefore, when existing technologies use fixed thresholds for attack detection, they are prone to generating widespread false alarms and inappropriate blocking when hot events trigger traffic surges, severely impacting the stable operation of normal business operations.

[0035] Therefore, the sensitivity of attack behavior determination in this invention should be negatively correlated with the current network load. When the network traffic is flat, the ability to perceive abnormal erosion should be maintained or improved (maintaining the spatiotemporal topology erosion score) to capture various minute signs of penetration. However, when the network traffic surges and the environment becomes more complex, the spatiotemporal topology erosion score needs to be reduced to automatically suppress interference from background noise and ensure the accuracy of the determination results. In addition, to prevent determination delays caused by computational lag, this step also introduces the incremental change in erosion. By comparing the numerical difference between the current spatiotemporal topology erosion and the historical spatiotemporal topology erosion in real time, the growth trend of attack intensity can be accurately captured, further improving the timeliness of attack behavior identification and compensating for the determination error caused by computational lag.

[0036] In this embodiment of the invention, a preset time window length N is used. The timestamp corresponding to the first data packet in the data packet sequence of the kth source IP is recorded as the start time. The sequence of data packets of the kth source IP collected within N minutes before the start time is used as the historical data packet sequence of the kth source IP. Based on the historical data packet sequence of the kth source IP, the historical spatiotemporal topology erosion degree of each source IP is obtained using the source IP spatiotemporal topology erosion degree acquisition method. Obtain the final anomaly attack determination coefficient for each source IP: ; In the formula, The final abnormal attack determination coefficient represents the k-th source IP. The spatiotemporal topological erosion degree of the k-th source IP; This represents the historical spatiotemporal topological erosion degree of the k-th source IP. This represents the network's overall throughput per second at the current moment. This represents the overall traffic throughput per second under stable network conditions. represents the trend-sensitive factor, used to adjust the system's weight in responding to incremental changes in erosion; e represents the natural constant; max() represents the maximum value function; This represents the degree of network traffic overload, as the real-time traffic across the entire network increases. Relative to the baseline value The continuous increase A value greater than 0 indicates that the network is experiencing peak traffic, leading to this... A value less than 1 reduces the spatiotemporal topology erosion degree, preventing false alarms and improper blocking when traffic surges are triggered by hot events, which could seriously affect the stable operation of normal business. Real-time network traffic Relative to the baseline value The smaller the value, the more likely it is that... The value approaches 1, which means that when the network traffic is in a flat state, the spatiotemporal topology erosion score is maintained to capture various subtle signs of penetration. Used to capture trends in attack intensity and compensate for the lag in attack response based on single-point moment judgment. The difference reflects the increment of the change in erosion; the increment of the change in erosion The larger the value, the faster the final judgment coefficient for abnormal attacks rises. This allows the system to detect large-scale distributed attacks earlier than traditional technologies, achieving a defensive effect of blocking attacks before they reach the threshold; the increment of the erosion degree change The smaller the value, the less it affects the abnormal attack detection coefficient.

[0037] S4: Identify the source of the abnormal attack based on the relationship between the final abnormal attack determination coefficient and the preset determination coefficient threshold.

[0038] In this embodiment of the invention, the preset judgment coefficient threshold T1=1.5. In other embodiments, the implementer may preset the judgment coefficient threshold according to the specific implementation situation. If the final abnormal attack judgment coefficient of the kth source IP is less than or equal to the judgment coefficient threshold, the behavior of the source address is within the security fluctuation range, and only log recording is performed without triggering interception. If the final abnormal attack determination coefficient of the k-th source IP is greater than the determination coefficient threshold, the source address is launching an abnormal attack, and the system immediately marks it as a high-risk attack source.

[0039] Figure 2 This is a comparison chart of existing technologies and the present invention under the same attack scenario. Existing technologies rely solely on a single traffic statistics threshold, and when faced with low-frequency attacks, the system is completely in a state of missed detection because the attack traffic does not exceed the fixed threshold of the existing technologies. The present invention, by acquiring time series rhythm stability indicators and spatiotemporal topological erosion indicators, generates a final abnormal attack judgment coefficient that is significantly raised within the actual attack range, thus achieving accurate locking of attack behavior.

[0040] Figure 3 This is the evolution process of the core feature indicators of this invention; the figure depicts the change curves of the time series rhythm stability index and the spatiotemporal topology erosion at different stages. In the non-attack stage (normal business stage), both indicators are in a low and stable range; while in the attack stage, even if the total traffic volume does not increase significantly, the two indicators increase significantly due to the mechanized rhythmic performance of its behavior and the detection and erosion of the topology space, which proves the technical advantages of this invention in identifying complex attacks.

[0041] This invention also discloses an anomaly attack identification system based on traffic data analysis, including a processor and a memory. The memory stores computer program instructions, which, when executed by the processor, implement the anomaly attack identification method based on traffic data analysis provided by this invention.

[0042] The system also includes other components well-known to those skilled in the art, such as communication buses and communication interfaces, the setup and functions of which are known in the art and will not be described in detail here. In this invention, the aforementioned memory can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0043] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for identifying abnormal attacks based on traffic data analysis, characterized by, include: Based on a preset time window, obtain the data packet sequence of each source IP address; Based on the packet transmission time interval and packet byte length in the packet sequence, obtain the time series rhythm stability index for each source IP address, including: The sum of the byte lengths of all data packets in the data packet sequence of the k-th source IP is taken as the total number of bytes in the data packets of the k-th source IP; the ratio of the total number of bytes in the data packets to the number of data packets in the data packet sequence of the k-th source IP is taken as the average byte length of the data packets sent by the k-th source IP, denoted as . ; Obtain the mean and variance of the time intervals between data packets sent by the k-th source IP; , The time series rhythm stability index represents the k-th source IP. This represents the average time interval between data packets sent by the k-th source IP address. This represents the variance of the time interval between data packets sent by the k-th source IP address. Represents preset hyperparameters; This represents the number of packets in the packet sequence of the k-th source IP address; Represents the logarithmic function; Based on the dispersion of access to the destination IP address and the breadth of access to the destination port from each source IP address, combined with the time series rhythm stability index, the spatiotemporal topological erosion degree of each source IP address is obtained. Based on the real-time load status of the entire network traffic and the historical trend of the spatiotemporal topology erosion, the spatiotemporal topology erosion is dynamically corrected to obtain the final abnormal attack judgment coefficient for each source IP address. The final abnormal attack determination coefficient is compared with the preset determination coefficient threshold to identify the source of the abnormal attack. The process of obtaining the final abnormal attack determination coefficient for each source IP address includes: , The final abnormal attack determination coefficient represents the k-th source IP. The spatiotemporal topological erosion degree of the k-th source IP; This represents the historical spatiotemporal topological erosion degree of the k-th source IP. This represents the network's overall throughput per second at the current moment. This represents the overall network throughput per second under stable network conditions. represents the trend-sensitive factor, used to adjust the system's weight in responding to incremental changes in erosion; e represents the natural constant; max() represents the maximum value function. 2.The method of claim 1, wherein, The process of obtaining the mean and variance of the time interval for the data packets sent by the k-th source IP includes: The mean of the time intervals between all two adjacent data packets in the data packet sequence of the k-th source IP is taken as the mean of the time intervals for sending data packets by the k-th source IP; the variance of the time intervals between all two adjacent data packets in the data packet sequence of the k-th source IP is taken as the variance of the time intervals for sending data packets by the k-th source IP. 3.The method of claim 1, wherein, The process of obtaining the spatiotemporal topology erosion degree for each source IP address includes: In the formula, The spatiotemporal topological erosion degree of the k-th source IP; The time series rhythm stability index represents the k-th source IP. This represents the number of destination IP types for the k-th source IP. This represents the number of connections from the k-th source IP to its m-th category IP; This represents the sum of the number of connections from the k-th source IP to all IPs of its respective categories; This represents the number of unique destination ports accessed by the k-th source IP. Represents the first weighting coefficient; This represents the second weighting coefficient, used for adjustment. Weight in the overall indicators; This represents the logarithmic function with base 2. 4.The method of claim 3, wherein, The acquisition of the number of connections from the k-th source IP to its m-th category IP includes: From the flow records corresponding to all data packets in the data packet sequence of each source IP, count the number of destination IP address categories, which is the number of destination IP types for each source IP; from the flow records corresponding to all data packets in the data packet sequence of the k-th source IP, count the number of times the IP address of the m-th category appears, which is the number of connections from the k-th source IP to its m-th category IP. 5.The method of claim 3, wherein, The determination of the number of unique destination ports accessed by the kth source IP includes: From the flow records corresponding to all data packets in the data packet sequence of each source IP, count the number of destination port categories, which is used as the unique number of destination ports accessed by each source IP. 6.The method of identifying abnormal attack based on traffic data analysis according to claim 1, characterized in that, The acquisition of the historical spatiotemporal topology erosion degree of the kth source IP includes: With a preset time window length N, the timestamp corresponding to the first data packet in the data packet sequence of the k-th source IP is recorded as the start time. The sequence of data packets of the k-th source IP collected within N minutes before the start time is used as the historical data packet sequence of the k-th source IP. Based on the historical data packet sequence of the k-th source IP, the historical spatiotemporal topology erosion of the k-th source IP is obtained using the source IP spatiotemporal topology erosion acquisition method. 7.The method of claim 1, wherein, The step of obtaining the data packet sequence of each source IP address based on a preset time window includes: By deploying probe devices on network gateways or switch mirror ports, network traffic data packets are collected in real time. Standard protocol deep packet inspection technology is used to perform structured parsing of the header information of each collected data packet, extracting flow records containing source IP address, destination IP address, destination port, timestamp, and data packet size. With a preset time window length N, all data packets sent by the same source IP address up to the current time are arranged in ascending order according to the timestamps in their corresponding flow records to obtain the original data packet sequence of each source IP. The sequence of data packets collected in the N minutes before the timestamp corresponding to the last data packet in the original data packet sequence of the k-th source IP is taken as the data packet sequence of each source IP.

8. An abnormal attack identification system based on traffic data analysis, characterized by, include: A processor and a memory, wherein the memory stores computer program instructions that, when executed by the processor, implement the abnormal attack identification method based on traffic data analysis according to any one of claims 1-7.

Images