An AI-driven PCDN traffic anomaly detection method

Abstract

The application relates to the technical field of network flow security detection methods, and discloses an AI driving-based PCDN flow anomaly detection method, which comprises the following steps: acquiring original NetFlow data and on-off logs, and forming account association flow data; performing aggregation statistics on the account association flow data according to a time window to form flow statistical data of an account to be detected; combining baseline flow data of a similar user group to perform deviation degree representation on the flow statistical data to form behavior deviation feature data; inputting the behavior deviation feature data into a pre-trained PCDN detection model to obtain daily detection results corresponding to each detection day of the account to be detected; continuously determining the daily detection results in a continuous observation period, and marking the account to be detected as a PCDN account when the determination result meets preset conditions. Through baseline correction of the similar user group and continuous observation period determination, the accuracy and stability of PCDN account detection are improved.

Description

Technical Field

[0001] This invention relates to an AI-driven PCDN traffic anomaly detection method, belonging to the technical field of network traffic security detection methods. Background Technology

[0002] In home broadband networks, some terminal devices, when used as peer-to-peer content delivery nodes, often continuously generate abnormal uplink traffic, thus increasing the network bandwidth burden and affecting network resource scheduling and service quality. Therefore, accurately identifying PCDN accounts from operator-side traffic data has become a crucial issue in abnormal traffic management.

[0003] In existing technologies, PCDN account identification typically employs rule-based matching or domain log-based analysis. Rule-based matching relies on manually pre-defined rules, making it difficult to adapt to changing business scenarios and resulting in high maintenance costs and low detection efficiency in large-scale traffic environments. Domain log-based analysis heavily depends on log data and feature libraries, limiting its ability to identify hidden, encrypted, or unknown business scenarios. Furthermore, raw NetFlow data is usually only flow-level records and cannot directly correspond to account entities. Additionally, user traffic baselines vary across different regions, bandwidth packages, and time periods, making it prone to misjudgments if judgments are based solely on absolute traffic metrics.

[0004] Therefore, this application provides an AI-driven PCDN traffic anomaly detection method to achieve accurate mapping of raw traffic to account entities, and improve the accuracy and stability of PCDN account detection by considering the baseline differences of user groups. Summary of the Invention

[0005] The purpose of this invention is to provide an AI-driven PCDN traffic anomaly detection method to solve the problem in the prior art where raw NetFlow data is difficult to directly map to account entities, resulting in the detection results being difficult to directly apply to the actual governance objects and causing inaccurate PCDN account detection.

[0006] To solve the above-mentioned technical problems, the present invention is implemented using the following technical solution.

[0007] On one hand, this invention provides an AI-driven PCDN traffic anomaly detection method, including: Obtain raw NetFlow data and online / offline logs, and perform association processing on the raw NetFlow data that meets preset matching conditions and the corresponding online / offline logs to form account-related traffic data; The traffic data associated with the account is aggregated and statistically analyzed based on multiple time windows to form the traffic statistics data of the account to be tested; By combining baseline traffic data of similar user groups, the traffic statistics are characterized by deviation to form behavioral deviation feature data of the account to be detected, wherein the similar user groups are the user groups corresponding to the account to be detected; The behavioral deviation feature data is input into a pre-trained PCDN detection model to obtain the daily detection results of the account to be detected on each detection day; The daily detection results within the continuous observation period are continuously judged, and when the judgment result meets the preset conditions, the account to be detected is marked as a PCDN account.

[0008] Furthermore, the association processing for those meeting preset matching conditions, and the generation of account-related traffic data, includes: The candidate online / offline logs are filtered from the online / offline logs. The filtering logic includes obtaining consistent source IP addresses, source ports falling into port allocation ranges, and recording times falling between online and offline times. Determine the target online / offline logs corresponding to the original NetFlow data from the candidate online / offline logs; Write the account identifier corresponding to the target online / offline logs into the original NetFlow data to form the account-related traffic data.

[0009] Further, determining the target online / offline logs corresponding to the original NetFlow data includes: Identify whether there are multiple candidate log entries for going online or offline, and sort the candidate log entries from most recent to oldest time. Select the candidate online / offline logs with the earliest time series as the target online / offline logs; Configure an ambiguity threshold. When the time difference between candidate online / offline logs is less than the preset ambiguity threshold, mark the corresponding original NetFlow data as ambiguous traffic data and remove the ambiguous traffic data from the account-associated traffic data.

[0010] Furthermore, the traffic data associated with the aforementioned accounts is aggregated and statistically analyzed to form traffic statistics data for the account to be detected, including: The account-related traffic data is aggregated based on the account identifier and the detection date to form the account's daily traffic data; The daily traffic data of the account is segmented and statistically analyzed through multiple time windows to generate statistical results corresponding to each time window. The statistical results corresponding to each time window are combined to form the traffic statistics of the account to be detected.

[0011] Furthermore, generating the statistical results corresponding to each of the time windows includes: Statistically analyze the uplink traffic, downlink traffic, number of target IPs, number of concurrent connections, and session duration within each time window. Calculate the uplink-to-downlink traffic ratio based on the uplink and downlink traffic within each time window; The uplink traffic, downlink traffic, number of target IPs, number of concurrent connections, session duration, and uplink / downlink traffic ratio within each time window are output as the statistical results.

[0012] Furthermore, the behavioral deviation feature data forming the account to be detected includes: Accounts are grouped according to access region, bandwidth package type, and active time period to determine the user group to which the account to be detected belongs; Perform the same aggregation statistical processing on the historical traffic data of the same type of user group within a preset statistical period as on the account to be detected, to form the baseline traffic data corresponding to the same type of user group; The traffic statistics of the account to be detected are compared with the baseline traffic data by statistical item to obtain the deviation value. The deviation value is then normalized based on the volatility of the corresponding statistical item to form the behavioral deviation feature data.

[0013] Furthermore, the user group to which the account to be detected belongs is determined, including: Extract the access region identifier, bandwidth package type identifier, and active time period identifier corresponding to the account; Accounts are categorized based on the access area identifier, bandwidth package type identifier, and active time period identifier; The classification results are matched with the accounts to be detected to form the same user groups.

[0014] Furthermore, the behavioral deviation feature data is input into a pre-trained PCDN detection model to obtain the daily detection results for the account to be detected on each detection day, including: The behavioral deviation feature data is input into the PCDN detection model to obtain the risk score corresponding to the account to be detected; The risk score is compared with a preset detection threshold; When the risk score reaches the preset detection threshold, the test result for a positive day is output; when the risk score does not reach the preset detection threshold, the test result for a negative day is output.

[0015] Furthermore, the continuous determination of the daily detection results within the continuous observation period includes: The daily test results within the continuous observation period are arranged in chronological order of the test dates to form a test result sequence. The number of consecutive days with positive test results in the aforementioned test result sequence was counted. When the number of consecutive occurrences reaches a preset number of days, the account to be detected will be marked as a PCDN account.

[0016] Furthermore, the continuous determination of the daily detection results within the continuous observation period also includes: If the number of consecutive positive test results in the test result sequence does not reach a preset number of days, the account to be tested will be marked as an account to be observed. The daily test results for subsequent test days will be incorporated into the test result sequence. Based on the updated sequence of detection results, a persistence determination is re-executed to update the labeling results for the account to be detected.

[0017] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: 1. By correlating raw NetFlow data with online / offline logs, account-related traffic data is generated. This data is then aggregated and statistically analyzed across multiple time windows. By combining this data with baseline traffic data from similar user groups, the deviation of the traffic statistics is characterized, resulting in behavioral deviation feature data. This approach differs from relying solely on raw flow records or absolute traffic values ​​for judgment. By constructing multi-time-scale behavioral statistics at the account level and using baseline data from similar user groups to correct account behavior, the differentiation between PCDN accounts and normal high-uplink accounts is improved, reducing misjudgments caused by regional, package, and time-of-day differences. 2. Input the behavioral deviation feature data into the pre-trained PCDN detection model to obtain the daily detection results of the account to be detected on each detection day. Perform continuous judgment on the daily detection results within the continuous observation period, and only mark the account to be detected as a PCDN account when the preset conditions are met. By using the model, the abnormal behavior of the account can be automatically identified, and the continuous judgment across detection days can suppress false alarms caused by abnormal fluctuations on a single day, improve the stability and practicality of the detection results, and make the output results more suitable for direct use in account detection. Attached Figure Description

[0018] Figure 1 The diagram shown is a flowchart of the PCDN traffic anomaly detection method of the present invention. Figure 2 The following is a flowchart of the multi-time-window aggregation statistics process; Figure 3 The flowchart shown is for determining persistence. Figure 4 The diagram shown is a flowchart of the PCDN detection model training process. Figure 5The image shows the ranking of feature importance for the PCDN detection model. Detailed Implementation

[0019] This invention can be modified in many ways and has many embodiments, with specific embodiments shown in the accompanying drawings for detailed description. However, this does not mean that the invention is limited to a specific implementation; it should be understood that all modifications, equivalents, and even substitutions falling within the concept and technical scope of this invention are included in this invention. Similar reference numerals are used for similar constituent elements in the description of the drawings.

[0020] The terms “first,” “second,” “A,” “B,” etc., are used to describe a wide variety of constituent elements, but these constituent elements are not limited by these terms. These terms are used to distinguish one constituent element from others. For example, without departing from the scope of the invention, a first constituent element may be named a second constituent element, and similarly, a second constituent element may be named a first constituent element. The term “and / or” includes a combination of multiple associated descriptions, or one of multiple associated descriptions.

[0021] When it is mentioned that a certain constituent element is "connected" or "linked" to other constituent elements, it can mean not only that the element is directly connected or linked to the other constituent element, but also that there are other constituent elements in between. Conversely, when it is mentioned that a certain constituent element is "directly connected" or "directly linked" to other constituent elements, there are no other constituent elements in between.

[0022] The terminology used in this application is for illustrative purposes only and is not intended to limit the scope of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. Terms such as "comprising" or "having" as used herein do not preclude the possibility of the presence or addition of features, numbers, stages, actions, constituent elements, components, or combinations thereof described in the specification.

[0023] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0024] Terms defined in common dictionaries should be interpreted as having the same meaning as in the context of the relevant technology, and should not be interpreted as having an ideal or overly formal meaning unless explicitly defined in this application.

[0025] refer to Figures 1 to 5As shown in this embodiment, an AI-driven PCDN traffic anomaly detection method is introduced. This method is executed by a traffic analysis platform deployed on the operator's side. The traffic analysis platform receives raw NetFlow data exported from network devices and online / offline logs output by the broadband access system. Combining historical traffic data and historical tag data, it performs daily detection on the accounts to be detected and outputs a list of target PCDN accounts. The inputs to the entire method are raw NetFlow data, online / offline logs, historical traffic data, and historical tag data, and the final output is the PCDN account tagging result.

[0026] Specifically, it includes: Step S101: Associate the raw NetFlow data that meets the preset matching conditions with the corresponding online / offline logs to form account-associated traffic data; Step S102: Aggregate and statistically analyze the traffic data associated with the account according to multiple time windows to form the traffic statistics data of the account to be tested; Step S103: Combine the baseline traffic data of similar user groups to characterize the deviation of traffic statistics and form behavioral deviation feature data of the account to be detected; Step S104: Input the behavioral deviation feature data into the pre-trained PCDN detection model to obtain the daily detection results of the account to be detected on each detection day; Step S105: Continuously determine the daily detection results within the continuous observation period, and mark the account to be detected as a PCDN account when the determination result meets the preset conditions.

[0027] The input data for step S101 includes raw NetFlow data and online / offline logs. The raw NetFlow data includes at least the source IP address, destination IP address, source port, destination port, protocol type, flow start time, flow end time, number of uplink bytes, number of downlink bytes, number of uplink packets, and number of downlink packets. The online / offline logs include at least the account identifier, assigned IP address, start port, end port, online time, and offline time. The output of step S101 is account-associated traffic data.

[0028] Specifically, candidate online / offline logs are filtered from the online / offline logs using source IP address, source port, and recording time as correlation constraints. During filtering, the source IP address in the original NetFlow data must match the allocated IP address in the online / offline logs, the source port in the original NetFlow data must be within the port allocation range defined by the online / offline logs, and the recording time of the corresponding original NetFlow data must be between the online and offline times. Online / offline logs that meet these filtering criteria are included in the candidate set.

[0029] The online / offline logs in the candidate set are sorted by time, and the latest online / offline log is determined as the target online / offline log for the current traffic record. The account identifier corresponding to this target online / offline log is written into the current raw NetFlow data to form account-associated traffic data. It should be noted that when there are multiple online / offline logs in the candidate set that are difficult to distinguish in time, it indicates that the current traffic record has a competing mapping relationship with multiple accounts. For such records, they are marked as ambiguous traffic data and removed from subsequent detection processes to avoid sample contamination caused by misassociation of accounts.

[0030] After account association is completed, the associated traffic data is aggregated and statistically processed. Specifically, the associated traffic data is collected based on the account identifier and the detection date to form daily account traffic data. This daily account traffic data represents the complete traffic set of a single account within a detection period, retaining both the account identifier and the detection date dimension, providing a unified data unit for subsequent cross-time window statistics.

[0031] The account's daily traffic data is processed using multiple time windows, including a first time window, a second time window, and a third time window. The first time window describes short-term behavioral changes, the second time window describes mid-term behavioral changes, and the third time window describes overall behavioral changes within the detected day. Based on this multi-time-window structure, the account's daily traffic data is segmented for statistical analysis to obtain traffic statistics for the same account at different time scales.

[0032] Specifically, for each time window, uplink traffic, downlink traffic, number of target IPs, number of concurrent connections, and session duration are statistically analyzed, and the uplink / downlink traffic ratio is calculated based on these metrics. Uplink and downlink traffic describe the traffic direction characteristics of the account, the number of target IPs describes the scope of the account's external interactions, the number of concurrent connections and session duration describe the account's service continuity and connection maintenance capabilities, and the uplink / downlink traffic ratio describes the account's uplink and downlink business structure within the same time window. Combining the above statistical results from each time window in chronological order yields the traffic statistics for the account on the current monitoring day.

[0033] The original stream-level data is compressed into account-level, time-structured statistical results. The statistical results retain both the account's change characteristics in a short period of time and the account's overall behavioral characteristics within the detection day, so that subsequent processing can take into account both transient and continuous anomalies.

[0034] After obtaining traffic statistics, deviation characterization processing is further performed. Compared to judging solely based on absolute traffic values, this method utilizes the concept of similar user groups to eliminate the impact of natural traffic differences between users in different regions, with different bandwidth packages, and at different times on the detection results. To this end, the access area identifier, bandwidth package type identifier, and active time period identifier of the account to be detected are extracted first, and the account is then categorized based on these identifiers to determine the similar user group corresponding to the account to be detected.

[0035] Once user groups of similar types are identified, their historical traffic data within a preset statistical period is aggregated and statistically processed in the same way as the accounts to be monitored, yielding baseline traffic data for these user groups. Because the baseline traffic data and the traffic statistics data for the accounts to be monitored share the same statistical item structure, each statistical item can be compared individually to measure the degree of deviation of the account to be monitored from the general behavioral patterns of its group.

[0036] Traffic statistics for the account under test are compared with baseline traffic data by statistical item to obtain the deviation value for each statistical item. To avoid the influence of differences in the units of measurement of different statistical items on the comparison results, the degree of fluctuation of similar user groups on each statistical item is further analyzed, and the deviation value is normalized based on the degree of fluctuation to form the deviation degree corresponding to each statistical item. The deviation degrees corresponding to each statistical item are combined to form the behavioral deviation feature data of the account under test. Through deviation degree characterization, the account under test is no longer described only by absolute traffic value, but is characterized by the degree of deviation relative to the baseline of similar user groups, thereby improving the ability to distinguish between accounts of different business types.

[0037] After the behavioral deviation feature data is generated, the model detection phase begins, which includes account identification processing for the current detection day and training and building the model before it goes live. Specifically, a training sample set is built based on historical traffic data, and the PCDN detection model is trained using this set. After training, the model is deployed in the online detection process to identify the behavioral deviation feature data corresponding to the current detection day.

[0038] During the model training phase, historical traffic data with historical tags is acquired, and account association processing, multi-time window aggregation statistical processing, and deviation characterization processing are sequentially performed on the historical traffic data to form historical behavior deviation feature data. The historical behavior deviation feature data is written into the training sample set in a structured format, wherein each sample record corresponds to a behavior deviation feature vector of an account within a detection day, and the tag of the sample record is used to characterize whether the account is a PCDN account. The training sample set is divided into a training set and a test set. The training set is used for model parameter learning, and the test set is used for model performance evaluation.

[0039] The PCDN detection model is built using the LightGBM model. Let the training sample set be... ,in, This represents the behavioral deviation feature vector corresponding to the i-th account sample. Let represent the label corresponding to the i-th account sample, n represent the total number of training samples, and i represent the index of the training sample. The LightGBM model uses an additive model approach for iterative training, and its overall prediction function is expressed as:

[0040] in, Let M represent the decision tree generated in the m-th iteration, where M represents the total number of decision trees. This represents the behavioral deviation feature vector corresponding to any account sample to be input into the model. Represents the decision tree index. Based on the additive model, the prediction result for the current account sample is converted into a risk score using the Sigmoid function, expressed as:

[0041] in, Used to characterize the probability that the current account sample belongs to a PCDN account. Represents the natural constant.

[0042] To balance classification accuracy and model complexity during training, an objective function is constructed for the LightGBM model. This objective function consists of a loss function term and a regularization term, expressed as:

[0043] in, Indicates the sample prediction loss. Let represent the regularization term for the m-th tree, used to control model complexity. In the t-th iteration, a second-order approximate expansion of the objective function yields:

[0044] in, This represents the approximate incremental objective function value corresponding to the newly added decision tree in the t-th iteration. This represents the first-order gradient of the loss function with respect to the current predicted value. This represents the decision tree generated in the t-th iteration. For the first Sample The output value, This represents the second gradient of the loss function with respect to the current predicted value. Represents the t-th tree The regularization term. Through the above second-order expansion, the model training process is transformed into training the newly added decision tree. The optimization solution process.

[0045] During the decision tree growth process, the split gain is calculated for each candidate split point, and the splitting method with the largest gain is selected to generate the next layer of nodes. The split gain is expressed as:

[0046] in, and Let represent the sum of the first-order gradient and the sum of the second-order gradient of the sample in the left child node, respectively. and Let G and H represent the sum of the first and second gradients of the samples in the right child node, respectively, and let G and H represent the sum of the first and second gradients of the samples in the parent node, respectively. Represents the regularization parameter. This represents the splitting complexity penalty term. By comparing the splitting gains corresponding to different candidate splitting points, the optimal splitting position of the current leaf node is determined.

[0047] Specifically, when the number of PCDN account samples in the training sample set is less than the number of non-PCDN account samples, sample balancing is performed on the training set before model training. Non-PCDN account samples are randomly downsampled, while PCDN account samples are upsampled to maintain a relative balance between positive and negative samples in the training set. Simultaneously, during the LightGBM model training process, class penalty weights are introduced for non-PCDN account samples to reduce the bias caused by sample imbalance on the classification boundary. After sample balancing, the binary classification target parameters, learning rate parameters, number of trees parameters, and regularization parameters of the LightGBM model are set. Key hyperparameters are then optimized using cross-validation, early stopping strategies, and grid search to obtain the trained PCDN detection model.

[0048] During the daily detection phase, the behavioral deviation feature data corresponding to the current detection day is input into the pre-trained PCDN detection model to obtain the risk score for the corresponding account. The risk score represents the strength of the PCDN behavior exhibited by the account within the current detection day. Further, this risk score is compared with a preset detection threshold; when the risk score reaches the preset detection threshold, a positive day detection result is output; when it does not reach the preset detection threshold, a negative day detection result is output. Thus, the LightGBM model completes both offline training on historical samples and online inference on current account samples, closing the model training process and the daily detection result output process within the same technical chain.

[0049] Furthermore, through a continuous judgment mechanism within a continuous observation period, a sequence of test results is established around the account to be tested, and the positive and negative test results corresponding to each test day are written into this sequence in chronological order. Then, the number of consecutive days with positive test results is counted on this sequence.

[0050] When the number of consecutive positive daily test results reaches a preset number of days, the account under test is marked as a PCDN account. If the number of consecutive positive daily test results does not reach the preset number of days, the account under test remains in an observation state, and new daily test results are continuously written on subsequent test days to update the test result sequence. As the test result sequence continues to update, the system recalculates the number of consecutive positive daily test results and updates the judgment status of the account under test accordingly. Therefore, short-term anomalies on a single day will not directly trigger the final account judgment; only when the abnormal behavior is continuous and persistent will the account be officially marked as a PCDN account.

[0051] In summary, this embodiment forms a complete technical chain around account association, multi-time-window aggregation statistics, baseline construction of similar user groups, deviation characterization, model detection, and persistence determination. Raw NetFlow data is transformed into account-level data after account association. This account-level data is then transformed into traffic statistics after multi-time-scale statistics. The traffic statistics are then transformed into behavioral deviation feature data after group baseline correction. This behavioral deviation feature data is used for model detection to form daily detection results. These daily detection results are then used for continuous observation period determination to form the final account labeling result. The entire scheme is not simply a superposition of rules and models, but rather achieves stable identification of PCDN accounts through the combined effects of account entityization, baseline correction, and cross-day continuous determination.

[0052] Furthermore, the historical sample training phase is deployed in an offline training environment, while the live network detection phase is deployed in an online detection environment. The offline training environment is used to periodically receive historical traffic data and historical tags to update the PCDN detection model; the online detection environment is used to receive real-time raw NetFlow data and online / offline logs, and to perform account detection based on the updated model parameters.

[0053] In the offline training environment, historical traffic data is processed sequentially through account association, aggregation statistics, and deviation characterization to form historical behavior deviation feature data. This data is then combined with historical labels to train the binary classification model and output updated model parameters. These parameters are synchronized to the online detection environment, enabling the online detection environment to continuously improve its ability to identify new PCDN behavior patterns without changing the main processing flow.

[0054] In the online detection environment, live network traffic data completes account association, statistical modeling, deviation characterization, model detection, and persistence determination according to the processing link in Example 1, outputting account labeling results. This decoupled deployment of offline training and online detection ensures both the stability of live network detection and the continuous updating capability of model parameters.

[0055] In addition to access region, bandwidth package type, and active time period, the account's historical average upload / download ratio or typical access period can also be used as additional classification criteria. The classified account set still generates baseline traffic data according to a unified statistical standard and performs deviation characterization processing. Therefore, while maintaining the overall technical link unchanged, it is possible to further improve the behavioral consistency of similar user groups.

[0056] When the sample size within a similar user group is insufficient, the grouping granularity can be appropriately relaxed to maintain the statistical stability of baseline traffic data. For example, while maintaining consistency in access area and bandwidth package type, the coverage of active time periods can be expanded to ensure a sufficient number of historical samples for similar user groups. In this way, the deviation characterization process can maintain a basic basis for comparison of similar accounts while avoiding statistical distortion caused by insufficient samples.

[0057] In summary, this invention maps raw flow-level data to account-level traffic data by associating raw NetFlow data with online / offline logs, and aggregates account-related traffic data around account identifiers and detection dates, performing aggregation statistics across multiple time windows to form traffic statistics data for the account to be detected.

[0058] By combining the baseline traffic data of the same user group to which the account to be detected belongs, the traffic statistics are characterized by deviation, forming behavioral deviation feature data. This allows account behavior to be described not only by absolute traffic values, but by the degree of deviation relative to the baseline of the same user group, thereby improving the ability to distinguish PCDN accounts from normal high-uplink accounts.

[0059] During the model detection phase, a training sample set is constructed using historical traffic data, and the LightGBM model is used to train and identify behavioral deviation feature data to obtain the daily detection results of the account to be detected on each detection day. Based on the daily detection results within a continuous observation period, a continuous judgment is performed, and the account to be detected is marked as a PCDN account only when the positive daily detection results continuously meet the preset conditions.

[0060] By enhancing feature representation capabilities through account entityization, multi-timescale statistics, and group baseline correction, and suppressing false alarms caused by daily fluctuations through model recognition and cross-detection day persistence determination, high accuracy and high stability detection of PCDN accounts are achieved, making it more suitable for operator-side account governance scenarios.

[0061] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0063] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. An AI-driven PCDN traffic anomaly detection method, characterized in that, include: Obtain raw NetFlow data and online / offline logs, and perform association processing on the raw NetFlow data that meets preset matching conditions and the corresponding online / offline logs to form account-related traffic data; The traffic data associated with the account is aggregated and statistically analyzed based on multiple time windows to form the traffic statistics data of the account to be tested; Accounts are grouped according to access region, bandwidth package type, and active time period to determine the user group to which the account to be detected belongs; Perform the same aggregation statistical processing on the historical traffic data of the same type of user group within a preset statistical period as on the account to be detected, to form the baseline traffic data corresponding to the same type of user group; The traffic statistics of the account to be detected are compared with the baseline traffic data by statistical item to obtain the deviation value. The deviation value is then normalized based on the volatility of the corresponding statistical item to form the behavioral deviation feature data of the account to be detected. The behavioral deviation feature data is input into a pre-trained PCDN detection model to obtain the daily detection results of the account to be detected on each detection day; The daily detection results within the continuous observation period are continuously judged, and when the judgment result meets the preset conditions, the account to be detected is marked as a PCDN account.

2. The AI-driven PCDN traffic anomaly detection method according to claim 1, characterized in that, The process of associating the raw NetFlow data that meets preset matching conditions with the corresponding online / offline logs to form account-associated traffic data includes: Candidate online / offline logs are filtered from the online / offline logs. The filtering logic includes obtaining consistent source IP addresses, source ports falling within port allocation ranges, and recording times falling between online and offline times. Determine the target online / offline logs corresponding to the original NetFlow data from the candidate online / offline logs; Write the account identifier corresponding to the target online / offline logs into the original NetFlow data to form the account-related traffic data.

3. The AI-driven PCDN traffic anomaly detection method according to claim 2, characterized in that, Determining the target online / offline logs corresponding to the original NetFlow data includes: Identify whether there are multiple candidate log entries for going online or offline, and sort the candidate log entries from most recent to oldest time. Select the candidate online / offline logs with the earliest time series as the target online / offline logs; Configure an ambiguity threshold. When the time difference between candidate online / offline logs is less than the preset ambiguity threshold, mark the corresponding original NetFlow data as ambiguous traffic data and remove the ambiguous traffic data from the account-associated traffic data.

4. The AI-driven PCDN traffic anomaly detection method according to claim 1, characterized in that, The traffic data associated with the aforementioned accounts is aggregated and statistically analyzed to form the traffic statistics data for the account to be detected, including: The account-related traffic data is aggregated based on the account identifier and the detection date to form the account's daily traffic data; The daily traffic data of the account is segmented and statistically analyzed through multiple time windows to generate statistical results corresponding to each time window. The statistical results corresponding to each time window are combined to form the traffic statistics of the account to be detected.

5. The AI-driven PCDN traffic anomaly detection method according to claim 4, characterized in that, The generation of statistical results corresponding to each of the aforementioned time windows includes: Statistically analyze the uplink traffic, downlink traffic, number of target IPs, number of concurrent connections, and session duration within each time window. Calculate the uplink-to-downlink traffic ratio based on the uplink and downlink traffic within each time window; The uplink traffic, downlink traffic, number of target IPs, number of concurrent connections, session duration, and uplink / downlink traffic ratio within each time window are output as the statistical results.

6. The AI-driven PCDN traffic anomaly detection method according to claim 1, characterized in that, Determining the user group to which the account to be detected belongs includes: Extract the access region identifier, bandwidth package type identifier, and active time period identifier corresponding to the account; Accounts are categorized based on the access area identifier, bandwidth package type identifier, and active time period identifier; The classification results are matched with the accounts to be detected to form the same user groups.

7. The AI-driven PCDN traffic anomaly detection method according to claim 1, characterized in that, The behavioral deviation feature data is input into a pre-trained PCDN detection model to obtain the daily detection results for the account to be detected on each detection day, including: The behavioral deviation feature data is input into the PCDN detection model to obtain the risk score corresponding to the account to be detected; The risk score is compared with a preset detection threshold; When the risk score reaches the preset detection threshold, a positive day detection result is output; when the risk score does not reach the preset detection threshold, a negative day detection result is output.

8. The AI-driven PCDN traffic anomaly detection method according to claim 1, characterized in that, The continuous determination of the daily detection results within the continuous observation period includes: The daily test results within the continuous observation period are arranged in chronological order of the test dates to form a test result sequence. The number of consecutive days with positive test results in the aforementioned test result sequence was counted. When the number of consecutive occurrences reaches a preset number of days, the account to be detected will be marked as a PCDN account.

9. The AI-driven PCDN traffic anomaly detection method according to claim 8, characterized in that, The method of continuously determining the daily detection results within a continuous observation period also includes: If the number of consecutive positive test results in the test result sequence does not reach a preset number of days, the account to be tested will be marked as an account to be observed. The daily test results for subsequent test days will be incorporated into the test result sequence. Based on the updated sequence of detection results, a persistence determination is re-executed to update the labeling results for the account to be detected.

Images