Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for flow detection, flow control

Abstract

The application relates to the technical field of communication, and provides a traffic detection and traffic control method, system and device. The method comprises the following steps: performing AI anomaly detection on traffic transmitted by a network device according to an AI traffic model; and in response to detecting traffic anomaly, determining an abnormal type according to a preset statistical algorithm judgment strategy. In addition, the method can further comprise the following steps: acquiring statistical information of the traffic transmitted by the network device; automatically generating an access control strategy according to the statistical information of the traffic; and automatically performing access control on the traffic by the network device according to the access control strategy. The method can automatically, accurately and finely detect abnormal traffic conditions, and automatically, accurately and quickly process abnormal traffic.

Description

Technical Field

[0001] This application relates to the field of communication technology, specifically to methods, systems, and apparatus for traffic detection and traffic control. Background Technology

[0002] Network devices transmit traffic, and this traffic may contain anomalies, posing security risks to network devices. For example, traffic sent by a terminal that transmits its private data to other terminals without permission could lead to data leakage. Conversely, traffic sent by a terminal that attacks other terminals could cause them to malfunction. Therefore, it is necessary to perform anomaly detection on network traffic to promptly identify abnormal traffic, and to manage network traffic to prevent the spread of abnormal traffic, thus helping to ensure the security of all devices on the network. Summary of the Invention

[0003] This application provides a method, system, and apparatus for traffic detection and traffic control, which can accurately and efficiently detect and manage abnormal traffic in a network.

[0004] Firstly, a traffic detection method is provided, which includes performing AI anomaly detection on the traffic transmitted by network devices based on an artificial intelligence (AI) traffic model, and determining the anomaly type based on a preset statistical algorithm judgment strategy in response to the detected traffic anomaly.

[0005] The traffic detection method provided in this application can automatically and accurately detect anomalies in the traffic transmitted by network devices using an AI traffic model, thereby automatically and accurately identifying abnormal traffic in the network. Furthermore, based on the automated and accurate detection of abnormal traffic, it automatically determines the type of anomaly according to a preset statistical algorithm judgment strategy, enabling automated, precise, and accurate identification of the anomaly type, helping users to understand the anomaly situation in more detail and better handle anomalies.

[0006] In one possible implementation, determining the anomaly type based on a preset statistical algorithm judgment strategy includes: matching traffic anomaly events based on the statistical algorithm; and determining the anomaly type based on the matching results.

[0007] Each anomaly type can correspond to one or more anomaly events. Thus, the embodiments of this application can use statistical algorithms to statistically analyze the characteristics of the traffic transmitted by network devices to match traffic anomaly events, and then determine the corresponding anomaly type based on the matching results of the anomaly events, which can determine the anomaly type more accurately.

[0008] In another possible implementation, the abnormal events include one or more of the following: abnormally increased access frequency, abnormally increased peer access, access to high-risk ports, abnormally increased traffic volume, and abnormally decreased packet interval.

[0009] Abnormal events such as an abnormal increase in access frequency, abnormal increase in peer access, access to high-risk ports, abnormal increase in traffic volume, and abnormal decrease in packet interval can comprehensively and accurately correspond to various anomaly types. Therefore, the method provided in this application's embodiments for matching the aforementioned traffic anomaly events can help to comprehensively and accurately match anomaly types.

[0010] In another possible implementation, the anomaly type includes one or more of the following: network scanning, denial-of-service (DoS) attack, bandwidth overload, and abnormal access frequency.

[0011] Network scanning, Denial-of-Service (DoS) attacks, bandwidth overload, and abnormal access frequency cover a wide range of anomaly types. Therefore, the method provided in this application embodiment can comprehensively and accurately identify various types of traffic anomalies.

[0012] In another possible implementation, before performing AI anomaly detection on the traffic transmitted by network devices based on the AI ​​traffic model, the method further includes training an AI traffic model based on statistical information of the traffic transmitted by network devices.

[0013] Traffic statistics can indicate the characteristics of traffic transmitted by network devices. Therefore, based on these statistics, a traffic model can be accurately trained, which can then accurately detect anomalies in the traffic transmitted by network devices.

[0014] In another possible implementation, the method further includes: automatically generating access control policies based on statistical information of traffic transmitted by network devices, and automatically sending access control policies to the access control entity in the network devices in response to detecting traffic anomalies, so that the network devices can perform access control on traffic according to the access control policies.

[0015] The method provided in this application embodiment can automatically and accurately generate access control policies (policies for instructing network devices to access traffic, such as policies instructing network devices to allow / disallow traffic transmission) based on traffic statistics. Furthermore, the method provided in this application embodiment can promptly send access control policies to the access control entity when abnormal traffic transmitted by a network device is detected. This allows the network device controlling traffic access to quickly and automatically select to allow traffic (e.g., normal traffic) and block disallowed traffic (e.g., abnormal traffic) according to the access control policy. This achieves accurate and rapid handling of abnormal traffic, reducing the security risks of traffic transmitted by network devices to various devices in the network.

[0016] In another possible implementation, the traffic statistics are those of normal traffic.

[0017] Statistical information on normal traffic transmitted by network devices can indicate the characteristics of this normal traffic. Therefore, based on these characteristics, access control policies can be generated flexibly and accurately, and traffic models can be trained.

[0018] In another possible implementation, automatically generating access control policies based on traffic statistics of network devices includes: automatically generating a first access control policy based on traffic statistics, the first access control policy indicating a whitelist of traffic that the network device is allowed to transmit; or, automatically generating a second access control policy based on traffic statistics, the second access control policy indicating a blacklist of traffic that the device is not allowed to transmit.

[0019] The embodiments of this application can flexibly generate a first access control policy for indicating a whitelist of traffic that a network device is allowed to transmit, or a second access control policy for indicating a blacklist of traffic that a network device is not allowed to transmit, and the network device can flexibly perform access control on traffic according to the first access control policy or the second access control policy.

[0020] In another possible implementation, the access control policy includes an Access Control List (ACL) or a User Control List (UCL).

[0021] Both ACLs and UCLs support configuring rules to describe packet matching conditions, and ACLs and UCLs can be easily configured and applied on devices. By generating ACLs and UCLs as access control policies, network devices can conveniently and quickly control traffic access based on ACLs and UCLs.

[0022] In another possible implementation, the statistics include one or more of the following: source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic volume, and packet interval.

[0023] Source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, and packet interval are all information that can comprehensively and accurately reflect the characteristics of traffic. Therefore, based on statistical information including the aforementioned factors, access control policies can be generated and traffic models trained relatively accurately.

[0024] Secondly, a flow control method is provided. The method includes acquiring statistical information about the traffic transmitted by a network device. This statistical information includes one or more of the following: source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, and packet interval. Furthermore, it includes automatically generating an access control policy based on the traffic statistical information and automatically sending the access control policy to an access control entity in the network device, so that the network device can perform access control on the traffic according to the access control policy.

[0025] The traffic control method provided in this application can automatically and accurately generate access control policies (policies for instructing network devices to access traffic, such as policies instructing network devices to allow / disallow traffic transmission) based on traffic statistics. Furthermore, by issuing access control policies to the access control entity, network devices controlling traffic access can quickly and automatically select to allow allowed traffic (e.g., normal traffic) and block disallowed traffic (e.g., abnormal traffic) according to the access control policies. This achieves accurate and rapid handling of network traffic, reducing the security risks of traffic transmitted by network devices to various devices in the network.

[0026] In one possible implementation, the traffic statistics are those of normal traffic.

[0027] In another possible implementation, automatically generating access control policies based on traffic statistics includes: automatically generating a first access control policy based on traffic statistics, the first access control policy indicating a whitelist of traffic that the network device is allowed to transmit; or, automatically generating a second access control policy based on traffic statistics, the second access control policy indicating a blacklist of traffic that the network device is not allowed to transmit.

[0028] In another possible implementation, the access control policy includes an Access Control List (ACL) or a User Control List (UCL).

[0029] In another possible implementation, automatically sending access control policies to the access control entity in the network device includes: automatically sending access control policies to the access control entity in the network device after detecting abnormal traffic transmission in the network device.

[0030] In another possible implementation, before the network device performs access control on the traffic according to the access control policy, the method further includes: performing AI anomaly detection on the traffic transmitted by the network device according to the artificial intelligence (AI) traffic model, and determining the anomaly type according to a preset statistical algorithm judgment policy in response to the detected traffic anomaly.

[0031] In another possible implementation, determining the anomaly type based on a preset statistical algorithm judgment strategy includes: matching traffic anomaly events based on statistical algorithms; and determining the anomaly type based on the matching results.

[0032] In another possible implementation, the abnormal events include one or more of the following: abnormally increased access frequency, abnormally increased peer access, access to high-risk ports, abnormally increased traffic volume, and abnormally decreased packet interval.

[0033] In another possible implementation, the anomaly type includes one or more of the following: network scanning, denial-of-service (DoS) attack, bandwidth overload, and abnormal access frequency.

[0034] In another possible implementation, before performing AI anomaly detection on the traffic transmitted by network devices based on the AI ​​traffic model, the method further includes training an AI traffic model based on statistical information of the traffic transmitted by network devices.

[0035] The technical effects of any possible implementation of the second aspect can be referenced to the technical effects of the first aspect and its various implementations.

[0036] Thirdly, a communication system is provided, comprising a first communication entity and a second communication entity. The first communication entity is used to perform AI anomaly detection on traffic transmitted by network devices based on an artificial intelligence (AI) traffic model, obtaining anomaly detection results. The second communication entity is used to acquire the anomaly detection results from the first communication entity, and in response to the anomaly detection results indicating traffic anomaly, determines the anomaly type according to a preset statistical algorithm judgment strategy.

[0037] In one possible implementation, the second communication entity is further configured to match traffic anomaly events based on a statistical algorithm, and to determine the anomaly type based on the matching results.

[0038] In another possible implementation, the abnormal events include one or more of the following: abnormally increased access frequency, abnormally increased peer access, access to high-risk ports, abnormally increased traffic volume, and abnormally decreased packet interval.

[0039] In another possible implementation, the anomaly type includes one or more of the following: network scanning, denial-of-service (DoS) attack, bandwidth overload, and abnormal access frequency.

[0040] In another possible implementation, the system further includes a third communication entity and an access control entity. The third communication entity is used to acquire statistical information about the traffic transmitted by the network device, including one or more of the following: source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, and packet interval. Based on the traffic statistics, the third communication entity automatically generates an access control policy. The third communication entity is also used to acquire the anomaly detection result from the first communication entity, and in response to the anomaly detection result indicating abnormal traffic, automatically sends an access control policy to the access control entity in the network device. The access control entity receives the access control policy, enabling the network device to perform access control on the traffic according to the access control policy.

[0041] In another possible implementation, the traffic statistics are those of normal traffic.

[0042] In another possible implementation, the third communication entity is further configured to: automatically generate a first access control policy based on the traffic statistics, the first access control policy indicating a whitelist of traffic that the network device is allowed to transmit; or, automatically generate a second access control policy based on the traffic statistics, the second access control policy indicating a blacklist of traffic that the network device is not allowed to transmit.

[0043] In another possible implementation, the access control policy includes an Access Control List (ACL) or a User Control List (UCL).

[0044] In another possible implementation, the system further includes a fourth communication entity, which is used to acquire traffic information of the traffic transmitted by the network device and send the traffic information of the traffic transmitted by the network device to a first communication entity so that the first communication entity can perform AI anomaly detection on the traffic transmitted by the network device according to the AI ​​traffic model.

[0045] In another possible implementation, the fourth communication entity is also used to obtain statistical information on the traffic transmitted by the network device and to send the traffic statistical information to the third communication entity.

[0046] In another possible implementation, the second communication entity is further configured to receive traffic information transmitted by the network device from the first or fourth communication entity, so that the second communication entity can determine the anomaly type according to a preset statistical algorithm judgment strategy in response to the anomaly detection result indicating a traffic anomaly.

[0047] In another possible implementation, the system further includes a fifth communication entity. The fifth communication entity is used to train an AI traffic model based on statistical information of the traffic transmitted by the network device, and to send the AI ​​traffic model to the first communication entity.

[0048] Fourthly, a communication system is provided, comprising a third communication entity and an access control entity. The third communication entity is used to acquire statistical information about traffic transmitted by a network device, including one or more of the following: source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, and packet interval. The third communication entity is also used to automatically generate an access control policy based on the traffic statistical information. The third communication entity is further used to automatically send the access control policy to the access control entity in the network device. The access control entity is used to receive the access control policy, enabling the network device to perform access control on the traffic according to the access control policy.

[0049] In one possible implementation, the traffic statistics are those of normal traffic.

[0050] In another possible implementation, the third communication entity is further configured to: automatically generate a first access control policy based on the traffic statistics, the first access control policy indicating a whitelist of traffic that the network device is allowed to transmit; or, automatically generate a second access control policy based on the traffic statistics, the second access control policy indicating a blacklist of traffic that the network device is not allowed to transmit.

[0051] In another possible implementation, the access control policy includes an Access Control List (ACL) or a User Control List (UCL). In yet another possible implementation, the system further includes a first communication entity. This first communication entity performs AI anomaly detection on the traffic transmitted by the network device based on an artificial intelligence (AI) traffic model, and obtains anomaly detection results.

[0052] In another possible implementation, the third communication entity is also used to obtain the anomaly detection result from the first communication entity, and in response to the anomaly detection result being a traffic anomaly, automatically send an access control policy to the access control entity in the network device.

[0053] In another possible implementation, the system further includes a second communication entity. The second communication entity is used to acquire the anomaly detection result from the first communication entity, and in response to the anomaly detection result indicating abnormal traffic, determines the anomaly type according to a preset statistical algorithm judgment strategy.

[0054] In one possible implementation, the second communication entity is further configured to match traffic anomaly events based on a statistical algorithm, and to determine the anomaly type based on the matching results.

[0055] In another possible implementation, the abnormal events include one or more of the following: abnormally increased access frequency, abnormally increased peer access, access to high-risk ports, abnormally increased traffic volume, and abnormally decreased packet interval.

[0056] In another possible implementation, the anomaly type includes one or more of the following: network scanning, denial-of-service (DoS) attack, bandwidth overload, and abnormal access frequency.

[0057] In another possible implementation, the system further includes a fourth communication entity, which is used to acquire traffic information of the traffic transmitted by the network device and send the traffic information of the traffic transmitted by the network device to a first communication entity so that the first communication entity can perform AI anomaly detection on the traffic transmitted by the network device according to the AI ​​traffic model.

[0058] In another possible implementation, the fourth communication entity is also used to obtain statistical information on the traffic transmitted by the network device and to send the traffic statistical information to the third communication entity.

[0059] In another possible implementation, the second communication entity is further configured to receive traffic information transmitted by the network device from the first or fourth communication entity, so that the second communication entity can determine the anomaly type according to a preset statistical algorithm judgment strategy in response to the anomaly detection result indicating a traffic anomaly.

[0060] In another possible implementation, the system further includes a fifth communication entity. The fifth communication entity is used to train an AI traffic model based on statistical information of the traffic transmitted by the network device, and to send the AI ​​traffic model to the first communication entity.

[0061] Fifthly, a communication system is provided, comprising one or more processors and one or more memories; the one or more processors are configured to execute instructions stored in the one or more memories to cause the one or more processors to perform a flow detection method as described in the first aspect or any possible implementation thereof; or a flow control method as described in the second aspect or any possible implementation thereof.

[0062] A sixth aspect provides a computer program product including instructions that, when executed on one or more processors, implement the flow detection method as described in the first aspect or any possible implementation thereof; or the flow control method as described in the second aspect or any possible implementation thereof.

[0063] A seventh aspect provides a computer-readable storage medium including computer program instructions that, when executed by one or more processors, perform a flow detection method as described in the first aspect or any possible implementation thereof; or a flow control method as described in the second aspect or any possible implementation thereof.

[0064] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods.

[0065] The following description includes more specific details about the implementation methods provided for the above aspects. Attached Figure Description

[0066] Figure 1 A schematic diagram of the communication system provided in the embodiments of this application;

[0067] Figure 2 A flowchart illustrating the traffic detection method provided in this application embodiment;

[0068] Figure 3 A schematic diagram of the display interface provided in an embodiment of this application;

[0069] Figure 4 A flowchart illustrating the flow control method provided in an embodiment of this application;

[0070] Figure 5 A schematic diagram illustrating access control of the first traffic transmitted by the device according to ACL, provided for an embodiment of this application;

[0071] Figure 6 A schematic diagram illustrating access control of the first traffic transmitted by the device according to UCL, provided for an embodiment of this application;

[0072] Figure 7 A schematic diagram illustrating the implementation of the traffic detection method and traffic control method provided in the embodiments of this application in a communication system;

[0073] Figure 8 A schematic diagram of the communication entity provided in the embodiments of this application;

[0074] Figure 9 Schematic diagram of the communication device provided in the embodiments of this application Figure 1;

[0075] Figure 10 Schematic diagram of the communication device provided in the embodiments of this application Figure 2 ;

[0076] Figure 11 This is a schematic diagram of the communication system provided in an embodiment of this application. Detailed Implementation

[0077] Network traffic refers to the flow of data transmitted between devices on a network. This traffic can contain data and / or information that needs to be transmitted. The transmission of traffic between devices enables various services such as data transmission and task processing. The following is a brief introduction to network traffic.

[0078] Network traffic can be transmitted in various feasible data formats, such as messages. Furthermore, network traffic can be transmitted between devices via transport layer protocols. The data transmitted by network traffic can be of various types, such as one or more of the following: image data, text data, and audio data.

[0079] In addition to the data and / or information to be transmitted, network traffic also carries related information. This information may include the source Internet Protocol (IP) address, the destination IP address, the transport layer protocol, the source port, and the destination port.

[0080] The source IP address of the traffic indicates the IP address of the source device that sent the traffic.

[0081] The destination IP address of traffic indicates the IP address of the device to which the traffic is intended to be transmitted.

[0082] The transport layer protocol of traffic indicates the transport layer protocol used for traffic transmission. For example, it could be Transmission Control Protocol (TCP), User Datagram Protocol (UDP), etc.

[0083] The source port of the traffic indicates the port used by the source device to send the traffic.

[0084] The destination port of the traffic indicates the port used by the destination device to receive the traffic.

[0085] The five pieces of information in the aforementioned traffic—source IP address, destination IP address, transport layer protocol, source port, and destination port—can be referred to as a quintuple.

[0086] As an example, a five-tuple for a traffic entry can be represented as "192.168.1.1, 9000, TCP, 121.14.88.76, 80". This means that the device with IP address 192.168.1.1 sends this traffic to the device with IP address 121.14.88.76 and port 80 via port 9000 using the TCP protocol.

[0087] Network traffic can be categorized into different types based on its intended use. For example, network traffic can include web traffic, email traffic, file transfer traffic, video traffic, etc.

[0088] Network traffic may be abnormal due to equipment malfunctions, viruses, or other reasons. Abnormal traffic can pose security risks to devices on the network. For example, traffic sent by a terminal that transmits its private data to other terminals without permission could lead to data leakage. Alternatively, traffic sent by a terminal that attacks other terminals could cause those terminals to malfunction.

[0089] Therefore, it is necessary to detect network traffic anomalies in a timely manner, and also to manage network traffic to prevent the spread of abnormal traffic, thereby helping to ensure the security of various devices in the network.

[0090] For devices in a network, the traffic they transmit under normal circumstances can have certain characteristics. For example, the source and destination IP addresses of the traffic transmitted by the device are fixed under normal circumstances; the size of the traffic transmitted under normal circumstances is within a reasonable range; and the number of traffic transmitted per unit time under normal circumstances is within a reasonable range. If the traffic transmitted by the device deviates from normal characteristics, or deviates from normal characteristics to a certain extent, the traffic may be abnormal traffic.

[0091] In some implementations, traffic information of normal traffic transmitted by devices in the network over a period of time can be collected. This traffic information indicates the characteristics of normal device traffic. Furthermore, preset rules or baselines can be established manually based on this traffic information. The preset rules may include one or more abnormal traffic matching rules, such as traffic exceeding 20M / s or the number of traffic packets transmitted per unit time exceeding 50, etc. Traffic matching the preset rules is considered abnormal. The baseline may include various indicators, such as the number of traffic packets transmitted per unit time, traffic size, and packet interval. Traffic deviating from any indicator in the baseline by more than a deviation threshold is considered abnormal (the deviation threshold can be set according to requirements, such as 10%). Thus, for real-time traffic transmitted by devices, real-time traffic information can be collected and matched with preset rules or compared with the baseline to determine whether the real-time traffic is abnormal.

[0092] However, manually set preset rules or baselines are determined based on human experience, resulting in low accuracy and a high likelihood of false positives or missed false negatives for abnormal traffic. Furthermore, manually setting preset rules or baselines requires configuring numerous parameters, making the process labor-intensive and complex. Additionally, manually set preset rules or baselines, through simple rule matching, can only identify abnormal traffic in simple cases and are insufficient for identifying abnormal traffic in complex situations.

[0093] In some implementations, additional security software can be run to handle abnormal traffic (e.g., running security software to perform vulnerability scanning, antivirus, and blocking operations to handle abnormal traffic). However, this method requires the integration and operation of additional security software, which is costly and has a long response time. It is difficult to quickly respond to and handle abnormal traffic, and it cannot handle abnormal traffic if no available security software is available, thus limiting its applicability.

[0094] In some implementations, when abnormal traffic is detected from a device on the network, the device's network port can be shut down. This disconnects the device from the network, preventing it from transmitting traffic and thus avoiding security risks to other devices. However, this approach can be excessive, causing all devices to be unable to transmit traffic, disrupting normal business operations.

[0095] This application provides a traffic detection method, which includes performing artificial intelligence (AI) anomaly detection on the traffic transmitted by network devices according to a traffic model, and determining the type of anomaly according to a preset statistical algorithm judgment strategy in response to detecting traffic anomalies.

[0096] The traffic detection method provided in this application can automatically and accurately perform AI anomaly detection on the traffic transmitted by network devices through a traffic model, thereby automatically and accurately identifying abnormal traffic in the network. Furthermore, based on the automated and accurate detection of abnormal traffic, it also automatically determines the type of anomaly according to a preset statistical algorithm judgment strategy, enabling automated, precise, and accurate identification of the anomaly type of abnormal traffic. This helps users understand the anomaly situation of abnormal traffic in more detail and better handle anomalies.

[0097] This application also provides a traffic control method, which includes obtaining statistical information on the traffic transmitted by a network device, automatically generating an access control policy based on the statistical information, and the network device performing access control on the traffic according to the access control policy.

[0098] The traffic control method provided in this application can automatically and accurately generate access control policies based on statistical information of the traffic transmitted by network devices. These access control policies can be used to indicate traffic access policies (e.g., policies indicating whether network devices are allowed or not allowed to transmit traffic). This enables the automatic release of normal traffic and the blocking of abnormal traffic, thereby achieving accurate and rapid management of network traffic. For example, it can quickly respond to the access control policy by allowing traffic (e.g., normal traffic) to be transmitted by network devices and blocking traffic (e.g., abnormal traffic) that is not allowed to be transmitted by network devices, reducing the security risks of traffic transmitted by network devices to various devices in the network.

[0099] The flow detection method and flow control method provided in this application can be used in combination to achieve automated, accurate and precise detection of abnormal flow conditions, as well as automated, accurate and rapid processing of abnormal flow.

[0100] The traffic detection and traffic control methods provided in this application are applicable to various types of networks, enabling traffic detection and control of network traffic in various network types. For example, they are applicable to campus networks, data center networks, wide area networks, mobile networks, virtual private networks, etc.

[0101] The traffic detection and traffic control methods provided in this application are applicable to traffic detection and traffic control of various devices in a network. For example, they can be applied to traffic detection and traffic control of user equipment (e.g., user terminals) connected to the network and traffic of internal network devices (e.g., servers within a data center network).

[0102] Figure 1 This is a schematic diagram of a communication system provided in an embodiment of this application. The communication system 100 can be used to implement the traffic detection method and traffic control method proposed in the embodiments of this application. Figure 1 This is merely a schematic diagram of the architecture of a communication system provided in this application embodiment. The positional relationships between the devices, components, modules, etc. shown in the figure do not constitute any limitation.

[0103] like Figure 1 As shown, the communication system 100 includes user equipment 110 and network equipment 120.

[0104] User equipment 110 refers to various devices available to the user, such as computers, mobile phones, printers, and other terminals.

[0105] Network device 120 is a device used to form network 140, and may include multiple network devices, such as network devices 120-1, 120-2, 120-3, 120-4, 120-5, 120-6, 120-7, 120-8, etc. Network devices can connect networks, enabling interconnection and interoperability between networks, and facilitating data transmission between network devices. Network devices can be routers, switches, or other devices capable of performing their functions.

[0106] In this embodiment of the application, network 140 can be various types of networks, such as campus network, data center network, wide area network, mobile network, virtual private network, etc.

[0107] To meet the communication needs of organizations and enterprises of different sizes and requirements, the network architecture of Network 140 can be divided into multiple layers according to actual needs, with each layer playing a different role and function in network networking.

[0108] As an example, such as Figure 1 As shown, network 140 includes an access layer, an aggregation layer, and a core layer. The access layer includes network devices 120-1, 120-2, 120-3, 120-4, etc., the aggregation layer includes network devices 120-5, 120-6, etc., and the core layer includes network devices 120-7, 120-8, etc.

[0109] The access layer connects user equipment 110 to network 140, providing an interface for user equipment to access the network. Access layer network devices (such as network devices 120-1, 120-2, 120-3, 120-4, etc.) can be switches, routers, etc. Access layer network devices can be referred to as Access Points (APs).

[0110] The aggregation layer connects one or more access layers, aggregating traffic from the access layers to the core layer for processing and forwarding. It also forwards and exchanges traffic between access layers and manages and controls access layer traffic. Furthermore, in data center networks, the aggregation layer connects servers, storage devices, and other equipment, aggregating data center device traffic to the core layer for processing and forwarding. Network devices in the aggregation layer (such as network devices 120-5, 120-6, etc.) can be switches, routers, etc.

[0111] The core layer connects one or more aggregation layers and network services, handling large volumes of traffic (including data transmission, routing decisions, and cross-network communication), enabling data transmission and exchange between different networks. In data center networks, the core layer also connects servers, storage devices, and other equipment, processing and forwarding data center device traffic. Core layer network devices (e.g., network devices 120-7, 120-8, etc.) can be switches, routers, etc.

[0112] In some embodiments, the communication system 100 may further include a control and management device 130. The control and management device 130 may connect to various devices in the network 140 (e.g., user equipment 110 connected to the network, devices in network device 120, etc.), and communicate with the devices in the network 140 to obtain data / information sent by the devices, and may also be used to process the received data / information.

[0113] The control and management device 130 can be any device or module capable of performing its functions, such as an application program, software module, or hardware device (e.g., router, switch, server, etc.).

[0114] In this embodiment of the application, one or more devices in the communication system 100 (such as user equipment 110, each device in network equipment 120, control and management device 130, etc.) can execute the traffic detection method and traffic control method provided in this embodiment of the application individually or in combination to detect and control the traffic in the network.

[0115] In the methods provided in the embodiments of this application (e.g.) Figure 2 , Figure 4 In the provided method, the traffic being detected and controlled can be traffic transmitted by various devices in the network. For example, it can be traffic transmitted by user equipment 110 connected to the network (such as computers, mobile phones, printers, etc.), or traffic transmitted by network internal devices (such as servers within a data center network). Furthermore, the traffic transmitted by the device can include traffic received by the device (referred to as inbound traffic) and traffic sent by the device (referred to as outbound traffic).

[0116] For ease of description, the device transmitting traffic to the network that is being detected and controlled will be referred to as the target device. Any traffic transmitted by the target device (e.g., real-time traffic transmitted by the target device, traffic transmitted by the target device within a historical time period, etc.) can be referred to as target device traffic. After the target device traffic is transmitted to the network, it is further transmitted, i.e., forwarded, by network devices in the network (e.g., network devices in network 120) to achieve the goal of transmitting the traffic to the destination IP address. In this way, target device traffic can be obtained on network devices within the network, and anomaly detection and access control can be performed on target device traffic.

[0117] The following is passed Figures 2-6 First, the flow detection method and flow control method provided in the embodiments of this application will be described in detail, and then... Figure 7 Examples of how the traffic detection method and traffic control method provided in the embodiments of this application are implemented in a communication system are introduced.

[0118] Figure 2 This is a flowchart illustrating the traffic detection method provided in an embodiment of this application. Figure 2 The provided flow detection method can be executed by various devices or components with processing capabilities. For example... Figure 2 As shown, the method includes the following steps.

[0119] exist Figure 2 In the provided traffic detection method, the detected traffic can be the traffic transmitted from the target device to the network (e.g., the traffic transmitted by the target device in real time), also referred to as target device traffic. After this target device traffic is transmitted to the network, it can be detected by network devices in the network (e.g., Figure 1 The network device 120 in the network shown continues to transmit, and can obtain the traffic of the target device on the network device in the network, and perform anomaly detection on the traffic of the target device.

[0120] Step 210: Perform AI anomaly detection on the traffic transmitted by network devices based on the traffic model.

[0121] A traffic model is an AI model used for AI-based detection of network traffic. In step 210, performing AI anomaly detection on the traffic transmitted by network devices based on the traffic model may include: inputting traffic information into the traffic model, which then processes the traffic information to obtain anomaly detection results. These results may indicate either abnormal or normal traffic.

[0122] The traffic information may include one or more of the following: source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, and packet interval.

[0123] The access frequency of traffic can refer to the frequency with which the traffic-transmitted packets (in this embodiment, the traffic-transmitted packets can also be replaced by data packets or other data forms) access the destination IP address (e.g., a specific destination IP address or a specific port of a specific destination IP address). For example, the frequency with which the traffic-transmitted packets access port 555 of the destination IP address 121.14.88.76 is 2 times per second (2 times / s), 10 times / s, 20 times / s, etc.

[0124] The size of traffic can refer to the amount of data contained in the traffic, such as a traffic size of 5M per second (5M / s).

[0125] The message interval of traffic can refer to the time interval between messages transmitted by the traffic, such as the time interval between two messages or the average time interval between multiple messages, which is 1 second, 2 seconds, etc.

[0126] In the embodiments of this application, the traffic model can be implemented by various models / functions that can achieve the functions required by this application. For example, the traffic model may include Markov models, regression models, etc. The traffic model can be an existing, pre-established traffic model that can be directly obtained and used. Alternatively, the traffic model can also be established and used according to requirements.

[0127] In some embodiments, a traffic model can be established by: obtaining statistical information on the traffic of the target device, and training the model based on the traffic statistics to obtain the traffic model. The target device traffic may include normal traffic transmitted by the target device during a historical period.

[0128] Statistical information may include traffic (in Figure 2 The method may include one or more pieces of information such as source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, and packet interval (for normal traffic). The types of information included in the statistics can be configured as needed.

[0129] Normal traffic statistics can be obtained through various feasible methods. For example, by collecting traffic information from multiple normal traffic samples transmitted by the target device within a certain time period, statistical analysis can be performed on these multiple normal traffic samples to obtain the required statistical information for the normal traffic samples.

[0130] Statistical information from normal traffic samples can indicate the characteristics of normal traffic. For example, the statistical information for a normal traffic sample includes the following: "192.168.1.1, 9000, TCP, 121.14.88.76, 80, 10 times / s, 5M / s, 2s". This statistical information indicates that the device with IP address 192.168.1.1 sends normal traffic via port 9000 to port 80 of the device with IP address 121.14.88.76 using the transport layer protocol TCP. The maximum access frequency is 10 times / s, the maximum traffic size is 5M / s, and the minimum packet interval is 2s.

[0131] Developing a traffic model based on statistical information can be achieved through various feasible methods. As an example, developing a traffic model based on statistical information may include: training an initial model (which may refer to a model without parameter adjustments) based on statistical information from normal traffic samples to obtain the desired traffic model. Various feasible training methods can be used for model training, and this application does not impose any restrictions on them.

[0132] Step 220: In response to the detection of abnormal traffic, determine the abnormality type according to the preset abnormality type identification strategy.

[0133] The anomaly types can be configured according to requirements. For example, anomaly types may include network scanning, denial-of-service (DoS) attacks, bandwidth overload, and abnormal access frequency. For multiple anomaly types, the anomaly type identification strategy may include multiple identification strategies for each anomaly type.

[0134] Anomaly type identification strategies can be implemented in various feasible ways, such as algorithms and rules for identifying anomaly types in traffic. These strategies can be used to identify anomaly types in traffic based on its traffic information.

[0135] In some embodiments, the anomaly type identification strategy can be a statistical algorithm judgment strategy, which can be used to determine the anomaly type of traffic based on statistical algorithms. Specifically, the statistical algorithm can perform statistical analysis on traffic information to match traffic anomaly events.

[0136] For example, in step 220, the statistical algorithm judgment strategy can achieve the following: by comparing the statistical information of the target device's traffic with the traffic information of the traffic according to the statistical algorithm, to match traffic anomaly events, and to determine the anomaly type of the traffic based on the traffic anomaly event matching results.

[0137] As mentioned earlier, statistical information can include statistics from multiple normal traffic samples transmitted by the target device. This statistical information can indicate the characteristics of normal traffic, such as source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, and packet interval. Based on this, the traffic information of detected abnormal traffic is compared with the statistical information. The comparison results indicate the differences between each piece of traffic information and each traffic characteristic of normal traffic. These differences can be used to match abnormal traffic events. Each type of anomaly can have a corresponding abnormal traffic event; thus, the type of anomaly can be determined based on the matching results of these abnormal traffic events.

[0138] For example, abnormal traffic events may include: abnormally increased frequency, abnormally increased peer access, access to high-risk ports, abnormally increased traffic volume, abnormally decreased packet interval, etc.

[0139] An abnormal increase in frequency can refer to a situation where the access frequency of the first type of traffic exceeds the access frequency of normal traffic (which can be the maximum access frequency) indicated by the statistics, and the difference is greater than a preset frequency threshold. The preset frequency threshold can be set according to requirements, such as 10, 20, etc.

[0140] An abnormal increase in the number of peers refers to a situation where the number of peers for the first traffic exceeds the number of peers for normal traffic as indicated by statistics, and the difference exceeds a preset threshold. Specifically, when the first traffic is traffic received by the target device, the peer can refer to the source IP address or source port of the traffic sending the traffic (such as the first traffic); when the first traffic is traffic sent by the target device, the peer can refer to the destination IP address or destination port of the traffic receiving the traffic (such as the first traffic). The preset threshold can be set according to requirements, for example, to 10, 20, etc.

[0141] High-risk port access refers to the access port of the first traffic being a port other than the access port of normal traffic indicated by statistics, which may pose a risk. Specifically, when the first traffic is traffic received by the target device, the access port can refer to the source IP address or source port of the traffic sending the traffic (such as the first traffic); when the first traffic is traffic sent by the target device, the access port can refer to the destination IP address or destination port of the traffic receiving the traffic (such as the first traffic).

[0142] An abnormal increase in traffic volume refers to a situation where the volume of the first traffic flow exceeds the normal traffic volume indicated by statistics, and the difference exceeds a preset traffic volume threshold. This preset traffic volume threshold can be set according to requirements, for example, to 10M / s, 20M / s, 50M / s, etc.

[0143] An abnormally reduced message interval refers to a situation where the message interval of the first traffic flow is less than the message interval of the normal traffic flow indicated by statistics, and the difference is greater than the preset message interval threshold. The preset message interval threshold can be set according to requirements, such as 1 second, 1.5 seconds, etc.

[0144] The following provides a detailed description of various anomaly identification strategies.

[0145] As an example, for traffic transmitted by network devices, the traffic anomaly events matched based on statistical algorithms are "abnormal increase in frequency, abnormal increase at the peer end, and access to high-risk ports". At this time, the anomaly type of the traffic can be determined to be "network scanning".

[0146] Another example is that for traffic transmitted by network devices, the traffic anomaly events matched based on statistical algorithms are "abnormal increase in frequency" and "abnormal increase in traffic size". In this case, the anomaly type of the traffic can be determined to be "DoS attack".

[0147] Another example is that for traffic transmitted by network devices, the traffic anomaly event matched based on statistical algorithms is "abnormal increase in traffic volume". In this case, the anomaly type of the traffic can be determined as "bandwidth overload".

[0148] Another example is that for traffic transmitted by network devices, the traffic anomaly event matched based on statistical algorithms is "abnormal increase in frequency". In this case, the anomaly type of the traffic can be determined as "abnormal access frequency".

[0149] Thus, through the embodiments of this application, based on the automatic and accurate detection of abnormal traffic through the traffic model, the abnormal traffic events of the abnormal traffic can be automatically matched through the aforementioned preset abnormality type identification strategy to obtain fine and accurate matching results, and the abnormality type of the abnormal traffic can be automatically determined finely and accurately based on the matching results.

[0150] In some embodiments, the display interface of a device (such as a control and management device, a target device, or other devices) can display statistical information, traffic information, and information on traffic anomalies of the identified target device (including traffic anomaly events, traffic anomaly types, etc.). In this way, users can intuitively understand the anomalies of the abnormal traffic in detail based on the content displayed on the interface.

[0151] For ease of understanding, Figure 3A schematic diagram of a display interface is shown. As an example, the normal traffic transmitted by the target device is from the source IP address 10.44.166.23 to the destination IP address 10.44.166.66. The real-time traffic transmitted by the target device includes additional traffic from the source IP address 10.44.166.23 to 35 other destination IP addresses (e.g., 10.44.166.67, 10.44.166.68, etc.), and the destination port of the real-time traffic transmitted by the target device is 445. Thus, the number of peers for the real-time traffic has increased by 35 compared to the normal traffic, and the real-time traffic accesses the peers via port 445.

[0152] like Figure 3 As shown in Figure 312, the statistical information of the target device's traffic and the matching result of the traffic anomaly event of the real-time traffic transmitted by the target device are "abnormal increase in frequency, abnormal increase in peer, high-risk port access". The traffic anomaly type is "network scanning". Figure 314 shows the anomaly information of the real-time traffic transmitted by the target device as "abnormal 2024-05-22 17:09:55 network scan added 35 peers, accessed high-risk port 445 of peer". This means that at time 2024-05-22 17:09:55, the anomaly type of the real-time traffic transmitted by the target device was detected as network scanning, the number of peers of the real-time traffic increased by 35 compared to normal traffic, the port accessed by the real-time traffic was port 445, and port 445 is a high-risk port.

[0153] Figure 4 This is a flowchart illustrating the flow control method provided in an embodiment of this application. Figure 4 The provided flow control method can be executed by various devices or components with processing capabilities. For example... Figure 4 As shown, the method includes the following steps.

[0154] exist Figure 4 In the provided flow control method, the flow being controlled can be the flow transmitted from the target device to the network (e.g., the flow transmitted by the target device in real time), which can be referred to as target device flow. After the target device flow is transmitted to the network, it can be continued to be transmitted by network devices in the network. The target device flow can be obtained by the network devices in the network, and access control can be performed on the target device flow.

[0155] Step 410: Obtain statistical information on the traffic transmitted by the network device.

[0156] In step 410, the traffic may include normal traffic transmitted by the target device during a certain historical time period (i.e., a normal traffic sample), and the traffic statistics may include statistical information on the normal traffic transmitted by the target device. For a detailed introduction to the statistical information on normal traffic, please refer to [link to relevant documentation]. Figure 2 Related descriptions in Chinese.

[0157] Step 420: Automatically generate access control policies based on traffic statistics.

[0158] Access control policies can be implemented through various feasible methods, such as algorithms and rules, to achieve the functions of the access control policies described in the embodiments of this application. For example, access control policies may include Access Control Lists (ACLs), User Control Lists (UCLs), etc. More detailed information about ACLs and UCLs can be found in the relevant description of step 430 below.

[0159] In one implementation, in step 420, a first access control policy can be automatically generated based on statistical information of normal traffic transmitted by the target device. For example, one or more characteristics of normal traffic indicated by the statistical information of normal traffic can be mapped to the first access control policy. As an example, characteristics such as fixed IP address and traffic size of normal traffic can be mapped to ACL rules.

[0160] The first access control policy can indicate the traffic that network devices are allowed to transmit (which can be called a traffic whitelist), for example, indicating one or more characteristics of the traffic that network devices are allowed to transmit (such as source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, packet interval, etc.).

[0161] In another implementation, in step 420, a second access control policy can be automatically generated based on statistical information of the normal traffic transmitted by the target device. For example, traffic characteristics that exceed one or more characteristics of the normal traffic indicated by the statistical information of normal traffic can be mapped to the second access control policy. As an example, characteristics such as traffic size that are outside the range of normal traffic size can be mapped to ACL rules.

[0162] The second access control policy can indicate which traffic network devices are not allowed to transmit (which can be called a traffic blacklist). For example, it can indicate one or more characteristics of the traffic that network devices are not allowed to transmit (such as source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, packet interval, etc.).

[0163] Step 430: The network device performs access control on traffic according to the access control policy.

[0164] Traffic access control can include allowing traffic (i.e., allowing traffic to pass through network devices or be transmitted through network devices to other devices in the network) and blocking traffic (i.e. preventing traffic from passing through network devices or being transmitted through network devices to other devices in the network).

[0165] In this embodiment, access control policies can be configured for network devices. For example, the access control policies can be automatically sent to the access control entity in the network device, enabling the network device to control access to traffic transmitted to the network according to the access control policies. The access control entity can be a network device or hardware, software, or programs on the network device.

[0166] In one implementation, in step 430, traffic may be allowed or blocked according to a first access control policy (which may indicate the traffic that the network device is allowed to transmit).

[0167] For example, if the traffic information of a traffic item matches one or more characteristics of the traffic that the network device is allowed to transmit as indicated by the first access control policy, then the traffic item can be considered to belong to the traffic that the network device is allowed to transmit (which can be called the traffic whitelist), and the traffic item can be allowed to pass.

[0168] For example, if the traffic information does not conform to one or more characteristics of the traffic that the network device is allowed to transmit as indicated by the first access control policy, then the traffic can be considered to be traffic that the network device is not allowed to transmit, and the traffic can be blocked.

[0169] In one implementation, in step 430, traffic can be allowed or blocked according to a second access control policy (which may indicate which traffic the network device does not allow to be transmitted).

[0170] For example, if the traffic information matches one or more characteristics of traffic that the network device is not allowed to transmit as indicated by the second access control policy, then the traffic can be considered to belong to the traffic that the network device is not allowed to transmit (which can be called the traffic blacklist), and the traffic can be blocked.

[0171] For example, if the traffic information does not meet one or more characteristics of traffic that the network device is not allowed to transmit as indicated by the second access control policy, then the traffic can be considered to be traffic that the network device is allowed to transmit, and the traffic can be allowed.

[0172] Allowing or blocking traffic can be achieved in various feasible ways. For example:

[0173] Allowing traffic to pass through can be achieved by having network devices forward traffic packets to a destination interface. This destination interface can enable packets to flow into or out of the network device (e.g., forwarding packets from the current network device to other devices in the network), thus enabling packet transmission through the network device or to other devices in the network via the network device.

[0174] Traffic can be blocked by having network devices drop packets. This prevents packets from being forwarded from the current network device to other devices in the network, thus preventing packet transmission through the network device or through the network device to other devices in the network.

[0175] The following provides a detailed description of how access control policies are implemented and how traffic is controlled based on these policies.

[0176] In the following examples, we will mainly use the example of traffic being transmitted in the form of packets, that is, the packets mentioned below can be equated with traffic.

[0177] In one implementation, the access control policy may include an Access Control List (ACL). An ACL may include one or more rules, which may indicate packet matching conditions. For example, a rule may be a statement describing the packet matching conditions. In this embodiment, the packet matching conditions may include the packet's source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, packet interval, etc.

[0178] Devices configured with ACLs can perform packet matching based on ACL rules. Each rule can filter out specific packets and allow or block filtered packets from passing through. In this way, ACLs can act as packet filters, and the rules included in the ACLs can act as the filter elements.

[0179] For example, for traffic transmitted from the target device into the network, the traffic information is matched with ACL rules:

[0180] If the traffic information of a traffic item matches the packet matching conditions included in a certain ACL rule, then the traffic information of that traffic item has successfully matched that ACL rule.

[0181] If the traffic information does not meet the packet matching conditions included in an ACL rule, then the traffic information of that traffic has not successfully matched that ACL rule.

[0182] In some embodiments, the traffic information of traffic can be matched with ACL rules in the following mechanism: the traffic information of traffic can be matched with each ACL rule in the ACL in turn. If the traffic information of traffic is successfully matched with a certain ACL rule, the matching stops. The network device controls the passage or blocking of the traffic according to the matched ACL rule. Otherwise, the matching operation continues until all ACL rules have been matched (this mechanism can be called "stop matching when hit").

[0183] For ease of understanding, Figure 5 A schematic diagram of access control for traffic based on ACL is shown.

[0184] Each configured ACL rule can include packet matching conditions and ACL actions, where ACL actions can include allow (represented by permit) and block (represented by deny).

[0185] In one implementation, such as Figure 5 As shown in 510, through Figure 4 The method described herein generates a first access control policy (capable of instructing network devices on the traffic allowed to be transmitted), the first access control policy including the following ACLs 1-3:

[0186] ACL1: "permit tcp host 10.44.166.23 host 110.242.68.66" This ACL rule indicates that packets with TCP as the transport protocol, source IP address 10.44.166.23, and destination IP address 110.242.68.66 are allowed to be transmitted.

[0187] ACL2: "permit tcp host 10.44.166.36 host 136.63.68.128 50M / s" This ACL rule indicates that packets with the TCP protocol, source IP address 10.44.166.36, destination IP address 136.63.68.128, and a bandwidth not exceeding 50M / s are allowed to be transmitted.

[0188] ACL3: "permit tcp host 10.44.166.37 host 10.44.166.116 30M / s 10 times / s" This ACL rule indicates that packets with the TCP protocol, source IP address 10.44.166.37, destination IP address 10.44.166.116, a traffic size not exceeding 30M / s, and a traffic access frequency not exceeding 10 times / s are allowed to be transmitted.

[0189] If the traffic information transmitted from the target device to the network matches any of the allowed ACL rules (such as ACL1-ACL3) in the first access control policy, the network device allows the traffic packets (e.g., forwards the traffic packets to the destination interface, through which the traffic packets flow into or out of the network device). If the traffic information transmitted from the target device to the network does not match any of the ACL rules in the first access control policy, the network device blocks the traffic packets (e.g., discards the traffic packets).

[0190] like Figure 5As shown in Figure 510, the traffic information of traffic A transmitted from the target device to the network is "10.44.166.37, 900, TCP, 10.44.166.116, 60, 2 times / s, 5M / s, 2s" (meaning that the source IP address of traffic A is 10.44.166.37, the source port is 900, the transport layer protocol is TCP, the destination IP address is 10.44.166.116, the destination port is 60, the access frequency is 2 times / s, the traffic size is 5M / s, and the packet interval is 2s).

[0191] If traffic A matches ACL3 and the ACL action of ACL3 is "allow", then the network device will allow traffic A.

[0192] For example Figure 5 As shown in Figure 520, the traffic information of traffic B transmitted from the target device to the network is "10.44.166.38, 100, TCP, 10.44.166.115, 50, 2 times / s, 2M / s, 1s" (meaning that the source IP address of the first traffic B is 10.44.166.38, the source port is 100, the transport layer protocol is TCP, the destination IP address is 10.44.166.115, the destination port is 50, the access frequency is 2 times / s, the traffic size is 2M / s, and the packet interval is 1s).

[0193] Traffic B does not match any of the ACL rules in the first access control policy, so traffic B is considered not allowed to be transmitted, and the network device blocks the message of traffic B.

[0194] In one implementation, such as Figure 5 As shown in Figure 520, through Figure 4 The method described herein generates a second access control policy (capable of indicating which traffic network devices are not allowed to transmit), the second access control policy including the following ACL4-ACL5:

[0195] ACL4: "deny tcp host 10.44.166.39 port 900 host 192.168.50.6 port 80" This ACL rule indicates that packets with the TCP protocol, source IP address 10.44.166.39, source port 900, destination IP address 192.168.50.6, and destination port 80 are not allowed to be transmitted (i.e., transmission is blocked).

[0196] ACL5: "deny tcp host 10.44.166.40 host 192.168.50.6 5M / s 15 times / s", this ACL rule indicates that packets with the TCP protocol, source IP address 10.44.166.40, destination IP address 192.168.50.6, bandwidth greater than or equal to 5M, and access frequency greater than or equal to 15 times per second are not allowed to be transmitted (i.e., transmission is blocked).

[0197] If the traffic information transmitted by the target device to the network matches an ACL rule (such as ACL4-ACL5) in the second access control policy that is set to block, the network device will block the traffic packet. If the traffic information transmitted by the target device to the network does not match any of the ACL rules in the second access control policy, the network device will allow the traffic packet.

[0198] like Figure 5 As shown in Figure 520, the traffic information of traffic C transmitted from the target device to the network is "10.44.166.39, 900, 192.168.50.6, TCP, 80, 5 times / s, 10M / s, 2s" (meaning that the source IP address of traffic C is 10.44.166.39, the source port is 900, the transport layer protocol is TCP, the destination IP address is 192.168.50.6, the destination port is 80, the access frequency is 5 times / s, the traffic size is 10M / s, and the packet interval is 2s).

[0199] Traffic C matches ACL4, and the ACL action for ACL4 is to block. The network device blocks the packet containing traffic C.

[0200] In another implementation, the access control policy may include a UCL (User-defined Channel). A UCL may include one or more UCL groups, and a UCL group may include multiple devices. Each UCL group deploys a set of network access policies (i.e., multiple devices in a UCL group deploy the same network access policy). The network access policy enables access control of network traffic and may include one or more rules, such as ACL rules, which indicate packet matching conditions. Compared to deploying a network access policy for each device, deploying network access policies based on UCL groups reduces workload.

[0201] For devices configured with UCL, such as devices in a UCL group, packet matching can be performed based on the network access policies configured in the UCL group, such as ACL rules. Each rule can filter out specific packets and can allow or block filtered packets from passing through.

[0202] For ease of understanding, Figure 6A schematic diagram of access control based on UCL traffic is shown.

[0203] like Figure 6 As shown, multiple network devices in the network are divided into multiple UCL groups (such as the first UCL group, the second UCL group, etc.). The first UCL group includes network devices responsible for access control of traffic. A set of ACL rules is configured for the first UCL group, such as the aforementioned ACL1-ACL3.

[0204] like Figure 6 As shown, the traffic information of traffic E transmitted from the target device to the network is "10.44.166.36, 900, TCP, 136.63.68.128, 60, 2 times / s, 20M / s, 1s" (meaning that the source IP address of traffic E is 10.44.166.36, the source port is 900, the transport layer protocol is TCP, the destination IP address is 136.63.68.128, the destination port is 60, the access frequency is 2 times / s, the traffic size is 20M / s, and the packet interval is 1s).

[0205] If traffic E matches ACL2 and the ACL action of ACL2 is to allow, then the network device will allow the packet of the first traffic E.

[0206] Among the methods provided above (including Figure 2 , Figure 4 The provided method allows for the collection of traffic information (such as traffic information transmitted from the target device to the network, traffic information of normal traffic transmitted by the target device during a certain time period, etc.) through various feasible methods. This application embodiment does not limit the collection method.

[0207] As an example, traffic information of the target device transmitted into the network can be obtained through the following methods: Traffic data of the target device transmitted into the network can be directly collected from various devices in the network (such as the target device, access layer network devices, aggregation layer network devices, etc.) to obtain the required traffic information. Alternatively, traffic collection devices can be connected alongside various devices in the network, and traffic mirroring and other technologies can be used to collect traffic data of the target device transmitted into the network to obtain the required traffic information.

[0208] In the embodiments of this application, Figure 2 The steps in the provided flow detection method and Figure 4 The steps in the provided flow control method can be used in combination.

[0209] For example, in Figure 2The provided traffic detection method may further include, in response to detecting abnormal traffic transmission by a network device, the network device automatically performs access control on the traffic according to an access control policy. Specifically, performing access control on the traffic according to the access control policy can be achieved through... Figure 4 The provided flow control method is implemented.

[0210] For example, in Figure 4 The provided traffic control method may further include, before the network device performs access control on the traffic according to the access control policy, anomaly detection on the traffic transmitted by the network device, and, in response to the detection of traffic anomalies, the network device automatically performs access control on the traffic according to the access control policy. The anomaly detection can be performed through... Figure 2 The provided traffic detection method is implemented.

[0211] For ease of understanding, the following exemplifies a traffic management method that combines traffic detection and traffic control methods. The traffic management method includes the following steps S10-S50.

[0212] S10. Obtain statistical information on the traffic transmitted by network devices.

[0213] For more detailed information on step S10, please refer to the relevant description of step 410 above.

[0214] S20. Automatically generate access control policies based on traffic statistics.

[0215] For more detailed information on step S20, please refer to the description of step 420 above.

[0216] S30. Perform AI anomaly detection on the traffic transmitted by network devices based on the traffic model.

[0217] For more detailed information on step S30, please refer to the relevant description of step 210 above.

[0218] S40. In response to detecting abnormal traffic, determine the abnormality type according to the preset abnormality type identification strategy.

[0219] For more detailed information on step S40, please refer to the description of step 220 above.

[0220] S50. In response to detecting abnormal traffic, the access control policy is automatically sent to the access control entity in the network device, so that the network device can control the traffic access according to the access control policy.

[0221] For more detailed information on access control of traffic based on access control policies in step S50, please refer to the relevant description of step 430 above.

[0222] The following combination Figure 7 Examples of how the flow detection method and flow control method provided in the embodiments of this application are implemented in a communication system are described below. The following are merely implementation examples, and the positional relationships between the communication entities described in the figures and descriptions do not constitute any limitation.

[0223] The following sections will introduce the implementation methods of flow detection and flow control in communication systems.

[0224] like Figure 7 As shown, the communication system 710 can be used to implement the traffic detection method. The communication system 710 can be implemented on a single device; for example, this single device implements all the steps of the traffic detection method provided in this application. This single device or all entities on this device used to implement the traffic detection method can constitute the communication system 710. The communication system 710 can also be implemented by multiple devices; for example, multiple devices can each implement some steps of the traffic detection method provided in the embodiments of this application, so that multiple devices jointly implement the traffic detection method. These multiple devices can constitute the communication system 710.

[0225] As an example, the communication system 710 may include multiple communication entities to respectively implement some steps of the traffic detection method provided in the embodiments of this application. Each communication entity may be a device with communication and processing capabilities, or any combination of one or more of the hardware, software, and programs on that device. These multiple communication entities may be on one device, in which case the communication system 710 is implemented on one device. Alternatively, these multiple communication entities may be on multiple devices, in which case the communication system 710 is implemented by multiple devices. The multiple communication entities and the functions implemented by each communication entity are described in detail below.

[0226] The communication system 710 may include a first communication entity 711 and a second communication entity 712. In some implementations, the communication system 710 may also include a fourth communication entity 714 and a fifth communication entity 715.

[0227] The first communication entity 711 (which may be called the anomaly detection entity) is used to perform AI anomaly detection on the traffic transmitted by network devices based on the artificial intelligence (AI) traffic model, and obtain anomaly detection results.

[0228] The second communication entity 712 (which may be referred to as the anomaly classification entity) is used to obtain the anomaly detection result from the first communication entity 711. In response to the anomaly detection result indicating traffic anomaly, it determines the anomaly type according to a preset statistical algorithm judgment strategy. In some implementations, the second communication entity 712 can also be used to match traffic anomaly events based on statistical algorithms and determine the anomaly type based on the matching result.

[0229] The fourth communication entity 714 (which may be referred to as the data acquisition entity) is used to acquire traffic information of the network device's transmitted traffic and to send the traffic information of the network device's transmitted traffic to the first communication entity 711 and the second communication entity 712. This allows the first communication entity 711 to perform AI anomaly detection on the traffic transmitted by the network device based on the AI ​​traffic model, and the second communication entity 712 to determine the anomaly type of the traffic based on a preset statistical algorithm judgment strategy. The fourth communication entity 714 can also be used to acquire statistical information of the traffic transmitted by the network device and to send the statistical information of the traffic to the second communication entity 712 and other communication entities for their use.

[0230] The fifth communication entity 715 (which may be referred to as the model training entity) is used to train an AI traffic model based on statistical information of the traffic transmitted by network devices. The fifth communication entity 715 can also be used to send the AI ​​traffic model to the first communication entity 711 for use by the first communication entity 711.

[0231] In one implementation, the traffic detection method is implemented by a single device, where the aforementioned multiple communication entities (including the first communication entity 711, the second communication entity 712, the fourth communication entity 714, and the fifth communication entity 715) are implemented on one device; that is, the communication system 710 is implemented on a single device. As an example, the device used to implement the traffic detection method can be a network device directly or indirectly connected to the target device in the network, such as an access layer network device, an aggregation layer network device, or a core layer network device, or it can be a control and management device directly or indirectly connected to the target device. In this way, the workload, cost, and amount of communication data can be reduced.

[0232] In another implementation, the traffic detection method is implemented by multiple devices. The aforementioned multiple communication entities (including the first communication entity 711, the second communication entity 712, the fourth communication entity 714, and the fifth communication entity 715) are implemented on multiple devices, that is, the communication system 710 is implemented on multiple devices. In this way, the implementation method of the traffic detection method on multiple devices can be flexibly selected according to the usage requirements and the capabilities of the devices in the communication system.

[0233] For example, the fourth communication entity 714 may be on the first device, while the first communication entity 711, the second communication entity 712, and the fifth communication entity 715 may be on the second device. As another example, the first communication entity 711 and the fourth communication entity 714 may be on the first device, while the second communication entity 712 and the fifth communication entity 715 may be on the second device. As an example, the first device here may be a network device directly or indirectly connected to the target device, such as an access layer network device, an aggregation layer network device, a core layer network device, etc. The second device here may be various devices such as access layer network devices, aggregation layer network devices, core layer network devices, control and management devices, etc.

[0234] like Figure 7 As shown, the communication system 720 can be used to implement the flow control method. The communication system 720 can be implemented on a single device; for example, this single device may implement all the steps of the flow control method provided in this application. This single device or all entities on this device used to implement the flow control method can constitute the communication system 720. The communication system 720 can also be implemented by multiple devices; for example, multiple devices may each implement some steps of the flow control method provided in the embodiments of this application, so that multiple devices jointly implement the flow control method. These multiple devices can constitute the communication system 720.

[0235] As an example, the communication system 720 may include multiple communication entities to respectively implement some steps of the flow control method provided in the embodiments of this application. Each communication entity may be a device with communication and processing capabilities, or any combination of one or more of the hardware, software, and programs on that device. These multiple communication entities may be on one device, in which case the communication system 720 is implemented on one device. Alternatively, these multiple communication entities may be on multiple devices, in which case the communication system 720 is implemented by multiple devices. The multiple communication entities and the functions implemented by each communication entity are described in detail below.

[0236] The communication system 720 may include a third communication entity 713, an access control entity 716, and a fourth communication entity 714.

[0237] The third communication entity 713 (which may be referred to as the policy generation entity) is used to obtain statistical information about the traffic transmitted by the network device. This statistical information may include one or more of the following: source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, and packet interval. The third communication entity 713 is also used to automatically generate access control policies based on the traffic statistical information. In some implementations, the third communication entity 713 may also be used to automatically generate a first access control policy based on the traffic statistical information, the first access control policy indicating a whitelist of traffic that the network device is allowed to transmit; or, it may automatically generate a second access control policy based on the traffic statistical information, the second access control policy indicating a blacklist of traffic that the network device is not allowed to transmit.

[0238] Access control entity 716 is used to receive access control policies from third communication entity 713, enabling network devices to perform access control on traffic according to the access control policies. Access control entity 716 can be located on network devices used for traffic access control.

[0239] The fourth communication entity 714 (which may be called the data acquisition entity) is used to obtain traffic information of the traffic transmitted by the network device, and also to obtain statistical information of the traffic transmitted by the network device, and to send the traffic statistical information to the third communication entity 713 and other communication entities for use by the third communication entity 713 and other communication entities.

[0240] In one implementation, the flow control method is implemented by a single device, where the aforementioned multiple communication entities (including the third communication entity 713, the access control entity 716, and the fourth communication entity 714) are implemented on one device; that is, the communication system 720 is implemented on a single device. As an example, the device used to implement the flow control method can be a network device that is directly or indirectly connected to the target device in the network, such as an access layer network device, an aggregation layer network device, or a core layer network device. This reduces the workload, cost, and amount of communication data required for device deployment.

[0241] In another implementation, the flow control method is implemented by multiple devices. The aforementioned multiple communication entities (including the third communication entity 713, the access control entity 716, and the fourth communication entity 714) are implemented on multiple devices, meaning the communication system 720 is implemented on multiple devices. This allows for flexible selection of the implementation method of the flow detection method across multiple devices based on usage requirements and the capabilities of the devices in the communication system.

[0242] For example, the fourth communication entity 714 and the access control entity 716 may be on the first device, and the third communication entity 713 may be on the second device. As an example, the first device may be a network device directly or indirectly connected to the target device, such as an access layer network device, an aggregation layer network device, a core layer network device, etc. The second device may be various devices such as access layer network devices, aggregation layer network devices, core layer network devices, control and management devices, etc.

[0243] In some implementations, the flow detection method and the flow control method can be used in combination. The communication system 710 for implementing the flow detection method may also include a third communication entity 713 and an access control entity 716. Alternatively, the communication system 720 for implementing the flow control method may also include a first communication entity 711, a second communication entity 712, and a fifth communication entity 715.

[0244] When the traffic detection method and the traffic control method are used in combination, the third communication entity 713 can be used to obtain the anomaly detection result from the first communication entity 711. In response to the anomaly detection result indicating traffic anomaly, it automatically sends the access control policy to the access control entity 716 in the network device.

[0245] For more information on the functions implemented by the first communication entity 711, the second communication entity 712, the third communication entity 713, the fourth communication entity 714, the fifth communication entity 715, and the access control entity 716, please refer to [link / reference needed]. Figures 2-6 And related explanations.

[0246] In one implementation, when the flow detection method and the flow control method are used in combination, the communication system 710 or the communication system 720 can still be implemented by a single device, and the aforementioned multiple communication entities (including the first communication entity 711, the second communication entity 712, the third communication entity 713, the fourth communication entity 714, the fifth communication entity 715, and the access control entity 716) are on one device.

[0247] In another implementation, when the flow detection method and the flow control method are used in combination, the communication system 710 or the communication system 720 can still be implemented by multiple devices, and the aforementioned multiple communication entities (including the first communication entity 711, the second communication entity 712, the third communication entity 713, the fourth communication entity 714, the fifth communication entity 715, and the access control entity 716) are on multiple devices.

[0248] To facilitate understanding, the combination of flow detection and flow control methods will be discussed. Figure 7 Examples of two implementation methods of the method in a communication system are given in sections 730 and 740.

[0249] As an example, such as Figure 7 As shown in section 730: The target device is user equipment 110 connected to the network in communication system 100. Access control entity 716 and fourth communication entity 714 (which may be called data acquisition entity) may both be on access layer network devices connected to user equipment 110 (such as network devices 120-1, 120-2, 120-3, 120-4, etc.), or both on aggregation layer network devices indirectly connected to user equipment 110 (such as network devices 120-5, 120-6, etc.). First communication entity 711 (which may be called an anomaly detection entity), second communication entity 712 (which may be called an anomaly classification entity), fifth communication entity 715 (which may be called a model training entity), and third communication entity 713 (which may be called a policy generation entity) may all be on core layer network devices (such as network devices 120-7, 120-8, etc.), or both on control and management device 130.

[0250] In this example, when the access control entity 716 and the fourth communication entity 714 require low computing power, they can be implemented on devices with average or low computing power, such as network devices in the access layer and network devices in the aggregation layer. When the first communication entity 711, the second communication entity 712, the third communication entity 713, and the fifth communication entity 715 require high computing power, they can be implemented on devices with high computing power, such as control and management devices and network devices in the core layer. This better meets business needs and ensures business performance. Specifically, implementing the first communication entity 711, the second communication entity 712, the third communication entity 713, and the fifth communication entity 715 on core layer network devices reduces the need for additional control and management device deployment compared to implementation by the control and management device. When the fourth communication entity 714 is implemented on access layer network devices, the collected device traffic data is more comprehensive, and the network device used for access control of traffic is also an access layer network device. When the access control entity 716 is implemented on access layer network devices, it can block the first traffic near the user equipment, effectively reducing the impact range of abnormal traffic.

[0251] As an example, such as Figure 7As shown in section 740: The target device is user equipment 110 connected to the network in communication system 100. The first communication entity 711 (which may be called the anomaly detection entity), the fourth communication entity 714 (which may be called the data acquisition entity), and the access control entity 716 may all be on the access layer network devices connected to user equipment 110 (such as network devices 120-1, 120-2, 120-3, 120-4, etc.), or on the aggregation layer network devices indirectly connected to user equipment 110 (such as network devices 120-5, 120-6, etc.). The second communication entity 712 (which may be called the anomaly classification entity), the fifth communication entity 715 (which may be called the model training entity), and the third communication entity 713 (which may be called the policy generation entity) may all be on the core layer network devices (such as network devices 120-7, 120-8, etc.), or on the control and management device 130.

[0252] In this example, the first communication entity 711, the fourth communication entity 714, and the access control entity 716 are all implemented on one device. This allows traffic data acquisition, traffic detection, and traffic access control to be implemented on one device, which can improve the speed of traffic detection and the efficiency of traffic access control, reduce the continuous transmission of traffic data from the device containing the fourth communication entity 714 to other devices, and reduce the consumption of communication resources.

[0253] The above text combines Figures 2 to 7 This document describes in detail the flow control and flow detection methods and their implementation methods provided according to the embodiments of this application. The following will combine... Figure 8 This application describes the communication entities provided. These communication entities can be used to implement the functions of any communication entity proposed in the above method embodiments (such as the aforementioned first communication entity, second communication entity, third communication entity, fourth communication entity, fifth communication entity, access control entity, etc.), and thus can also achieve the beneficial effects of the above method embodiments.

[0254] Figure 8 This is a schematic diagram of a communication entity provided in an embodiment of this application. The communication entity 800 can correspond to any of the aforementioned communication entities (e.g., a first communication entity, a second communication entity, a third communication entity, a fourth communication entity, a fifth communication entity, an access control entity, etc.), and implement the functions performed by any of the aforementioned communication entities. Figure 8 As shown, the communication entity 800 includes a transceiver module 812 and a processing module 814.

[0255] In one possible implementation, communication entity 800 serves as the first communication entity 711 (which may be referred to as the anomaly detection entity). Transceiver module 812 receives traffic information from network devices. Processing module 814 performs AI anomaly detection on the traffic transmitted by network devices according to a traffic model, obtaining anomaly detection results. Transceiver module 812 can also send the anomaly detection results and traffic information from network devices to other communication entities for use.

[0256] In some implementations, transceiver module 812 is used to receive traffic information transmitted from the network device of the fourth communication entity. Transceiver module 812 is also used to receive AI traffic models from the fifth communication entity.

[0257] In another possible implementation, communication entity 800 serves as a second communication entity 712 (which may be referred to as an anomaly classification entity). Transceiver module 812 receives anomaly detection results of traffic transmitted to network devices from the first communication entity. Transceiver module 812 also receives traffic information of traffic transmitted to network devices from the first or fourth communication entity, etc. Processing module 814, in response to an anomaly detection result indicating traffic anomaly, determines the anomaly type according to a preset statistical algorithm judgment strategy.

[0258] In some implementations, the transceiver module 812 is further configured to receive statistical information on traffic transmitted from the network device of the fourth communication entity. The processing module 814 is further configured to match traffic anomaly events based on a statistical algorithm, and to determine the anomaly type based on the matching result. The statistical algorithm can be used to perform statistical analysis on the traffic information transmitted by the network device based on the traffic statistics to match traffic anomaly events.

[0259] In another possible implementation, communication entity 800 serves as a third communication entity 713 (which may be referred to as a policy generation entity). Transceiver module 812 receives traffic statistics from the network device. Processing module 814 automatically generates access control policies based on the traffic statistics. Transceiver module 812 also automatically sends the access control policies to the access control entity in the network device, enabling the network device to perform access control on the traffic according to the access control policies.

[0260] In some implementations, the transceiver module 812 is used to receive traffic statistics from the network device of the fourth communication entity.

[0261] In some implementations, the transceiver module 812 is further configured to receive anomaly detection results of traffic transmitted to the network device from the first communication entity. The transceiver module 812 is also configured to, in response to an anomaly detection result indicating abnormal traffic, automatically send an access control policy to the access control entity in the network device, so that the network device can perform access control on the traffic according to the access control policy.

[0262] In another possible implementation, communication entity 800 serves as a fourth communication entity 714 (which may be referred to as a data acquisition entity). Transceiver module 812 receives traffic information from network devices. Processing module 814 obtains required traffic information (e.g., traffic information from network devices, statistical information about network device traffic, etc.) based on the received traffic information. Transceiver module 812 also sends the obtained traffic information to other communication entities for use.

[0263] In another possible implementation, communication entity 800 serves as a fifth communication entity 715 (which may be referred to as a model training entity). Transceiver module 812 receives statistical information about the traffic transmitted by the network device. Processing module 814 trains a traffic model based on the traffic statistics. Transceiver module 812 also transmits the traffic model to other communication entities for use.

[0264] In some implementations, the transceiver module 812 is used to receive traffic statistics from the network device of the fourth communication entity.

[0265] In another possible implementation, communication entity 800 serves as access control entity 716. Transceiver module 812 receives access control policies from a third communication entity. Processing module 814 performs access control on the traffic transmitted by the network device according to the access control policies.

[0266] For more detailed information on the functions performed by the aforementioned communication entities, please refer to [link / reference]. Figures 2-7 The provided descriptions of the traffic detection methods, traffic control methods, and their implementation methods.

[0267] All modules can be implemented in software, hardware, or a combination of both. For example, the implementation methods of the transceiver module 812 and the processing module 814 will be described below.

[0268] As an example of a software functional unit, the transceiver module 812 or the processing module 814 may include code running on a device instance. The device instance may be at least one of a physical device (e.g., a switch, router, server, etc.) or a virtualized device (e.g., a virtual machine, etc.). Furthermore, the aforementioned device instance may be one or more. For example, the transceiver module 812 or the processing module 814 may include code running on multiple physical / virtualized devices.

[0269] As an example of a hardware functional unit, the transceiver module 812 or the processing module 814 may include at least one hardware device. For example, the transceiver module 812 may include a network interface card, a transceiver, etc., and the processing module 814 may include any one or more processors such as a central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a neural network processing unit (NPU), a data processing unit (DPU), or a microprocessor (MP). Alternatively, the processing module 814 may be a device or device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD).

[0270] This application also provides a communication device 900. The communication device 900 is an example of a hardware device. The communication device 900 provided in this application can be any communication entity proposed in this application (such as the aforementioned first communication entity, second communication entity, third communication entity, fourth communication entity, fifth communication entity, access control entity, etc.) or any device with communication and processing capabilities (such as the aforementioned network devices, control and management devices, etc.).

[0271] like Figure 9 As shown, the communication device 900 includes: a bus 902, a communication interface 904, a processor 906, and a memory 908. The communication interface 904, processor 906, and memory 908 communicate with each other via the bus 902. It should be understood that this application does not limit the number of processors and memories in the communication device 900. Optionally, the processor 906 of the communication device 900 can be connected to a display or input device via the communication interface 902. Figure 9 (Not shown in the image).

[0272] The 902 bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9 The bus 902 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 902 may include a path for transmitting information between various components of the communication device 900 (e.g., communication interface 904, processor 906, memory 908).

[0273] Communication interface 904 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between communication device 900 and devices or communication networks. Communication interface 904 may include wired communication interfaces and wireless communication interfaces. Specifically, communication interface 904 may be an Ethernet interface, a Fast Ethernet (FE) interface, a Gigabit Ethernet (GE) interface, an Asynchronous Transfer Mode (ATM) interface, a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof. The Ethernet interface may be an optical interface, an electrical interface, or a combination thereof.

[0274] The display may include various display devices capable of display functions, such as plasma displays and liquid crystal displays. The communication device 900 can realize display functions through the display. Input devices may include various input devices capable of information / signal input, such as keyboards, mice, and touch screens.

[0275] Processor 906 may include a CPU, DSP, NP, NPU, DPU, MP, or one or more integrated circuits for implementing the solutions of this application. For example, processor 906 includes an ASIC, PLD, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A PLD may be, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute various logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of this invention. A processor may also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc. In the embodiments of this application, processor 906 can be used to execute the embodiments of this application. Figure 2 , Figure 4 The steps or operations in the proposed flow detection and flow control methods.

[0276] Memory 908 may include volatile memory, such as random access memory (RAM). Memory 908 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD). Alternatively, memory 908 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer.

[0277] The memory 908 may store program code that executes the scheme of this application, and the processor 906 may execute the program code stored in the memory 908. That is, the communication device 900 can implement the embodiments of this application through the processor 906 and the program code in the memory 908. Figure 2 , Figure 4 The steps or operations in the provided flow detection and flow control methods. The program code may include one or more software modules. Optionally, the processor 906 itself may also store program code or instructions for executing the solution of this application.

[0278] In a specific embodiment, the communication device 900 may correspond to any of the aforementioned communication entities (e.g., the aforementioned first communication entity, second communication entity, third communication entity, fourth communication entity, fifth communication entity, access control entity, etc.). The processor 906 reads the instructions in the memory 908, enabling the communication device 900 to execute the operations performed by any of the communication entities.

[0279] In a specific embodiment, the memory 908 stores executable program code for implementing the functions of the aforementioned transceiver module 812 and processing module 814. The processor 904 executes the executable program code to implement the functions of the aforementioned transceiver module 812 and processing module 814 respectively.

[0280] This application also provides a communication device 1000. The communication device 1000 is another example of a hardware device. The communication device 1000 provided in this application can be used as a network device (e.g., a switch, router, etc.) in this application. Any communication entity proposed in this application (e.g., the aforementioned first communication entity, second communication entity, third communication entity, fourth communication entity, fifth communication entity, access control entity, etc.) can be implemented on the communication device 1000.

[0281] like Figure 10As shown, the communication device 1000 includes a main control board 1010 and an interface board 1030.

[0282] The main control board 1010, also known as the main processing unit (MPU) or route processor card, is used to control and manage the various components in the communication device 1000, including routing calculation, device management, device maintenance, and protocol processing functions. The main control board 1010 includes a central processing unit 1011 and a memory 1012.

[0283] Interface board 1030 is also known as a line processing unit (LPU), linecard, or service board. Interface board 1030 provides various service interfaces and implements packet forwarding. Service interfaces include, but are not limited to, Ethernet interfaces, POS (Packet over SONET / SDH) interfaces, etc., with Ethernet interfaces including, for example, Flexible Ethernet Clients (FlexE Clients). Interface board 1030 includes: a central processing unit 1031, a network processor 1032, a forwarding table entry memory 1034, and a physical interface card (PIC) 1033.

[0284] The central processing unit 1031 on the interface board 1030 is used to control and manage the interface board 1030 and communicate with the central processing unit 1011 on the main control board 1010.

[0285] The network processor 1032 is used to implement packet forwarding processing. The network processor 1032 can be in the form of a forwarding chip. Specifically, the network processor 1032 forwards received packets based on the forwarding table stored in the forwarding table entry memory 1034. If the destination address of the packet is the address of the communication device 1000, the packet is sent to the CPU (such as the central processing unit 1011) for processing; if the destination address of the packet is not the address of the communication device 1000, the next hop and outgoing interface corresponding to the destination address are looked up in the forwarding table according to the destination address, and the packet is forwarded to the outgoing interface corresponding to the destination address. Uplink packet processing includes: packet ingress interface processing, forwarding table lookup; downlink packet processing includes: forwarding table lookup, etc.

[0286] The physical interface card 1033 is used to implement physical layer interfacing functions. Raw traffic enters the interface board 1030 through this card, and processed packets are sent out from the physical interface card 1033. The physical interface card 1033, also called a daughter card, can be installed on the interface board 1030. It is responsible for converting photoelectric signals into packets, performing validity checks on the packets, and forwarding them to the network processor 1032 for processing. In some embodiments, the central processing unit can also perform the functions of the network processor 1032, such as implementing software forwarding based on a general-purpose CPU, thus eliminating the need for the network processor 1032 in the physical interface card 1033.

[0287] Optionally, the communication device 1000 includes multiple interface boards. For example, the communication device 1000 also includes an interface board 1040, which includes a central processing unit 1041, a network processor 1042, a forwarding table entry memory 1044, and a physical interface card 1043.

[0288] Optionally, the communication device 1000 also includes a switching fabric board 1010. The switching fabric board 1010 can also be referred to as a switch fabric unit (SFU). In cases where the communication device has multiple interface boards 1030, the switching fabric board 1010 is used to complete data exchange between the interface boards. For example, interface boards 1030 and 1040 can communicate via the switching fabric board 1010.

[0289] The main control board 1010 and the interface board 1030 are coupled. For example, the main control board 1010, interface board 1030, interface board 1040, and switching network board 1010 are interconnected via a system bus and connected to the system backplane. In one possible implementation, an inter-process communication (IPC) channel is established between the main control board 1010 and the interface board 1030, and the main control board 1010 and the interface board 1030 communicate with each other through the IPC channel.

[0290] Logically, the communication device 1000 includes a control plane and a forwarding plane. The control plane includes a main control board 1010 and a central processing unit 1031, while the forwarding plane includes various components that perform forwarding, such as a forwarding table entry memory 1034, a physical interface card 1033, and a network processor 1032. The control plane performs functions such as router operation, generating forwarding tables, processing signaling and protocol messages, and configuring and maintaining the device's status. The control plane distributes the generated forwarding table to the forwarding plane. In the forwarding plane, the network processor 1032 looks up and forwards messages received by the physical interface card 1033 based on the forwarding table distributed by the control plane. The forwarding table distributed by the control plane can be stored in the forwarding table entry memory 1034. In some embodiments, the control plane and the forwarding plane can be completely separated and not on the same device.

[0291] In this embodiment, the operation on interface board 1040 is the same as that on interface board 1030, and will not be described again for simplicity. The communication device 1000 in this embodiment can correspond to the communication device in the above-described method embodiments. The main control board 1010, interface board 1030 and / or 1040 in the communication device 1000 can realize the functions and / or various steps implemented by the communication device in the above-described method embodiments, and will not be described again for simplicity.

[0292] It's worth noting that a communication device may have one or more main control boards, including a primary and a backup main control board. It may also have one or more interface boards; the stronger the data processing capability of the communication device, the more interface boards it provides. Each interface board may also have one or more physical interface cards. A switching network board may or may not exist; multiple boards can share the load and provide redundancy. In a centralized forwarding architecture, the communication device may not need a switching network board, as the interface boards handle the entire system's business data processing. In a distributed forwarding architecture, the communication device can have at least one switching network board, which enables data exchange between multiple interface boards, providing high-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of a distributed architecture communication device are greater than those of a centralized architecture device. Alternatively, the communication device can also consist of a single board, without a switching network board. The functions of the interface board and the main control board are integrated on this single board. In this case, the central processing unit (CPU) on the interface board and the CPU on the main control board can be combined into a single CPU to execute the combined functions. This type of device has lower data exchange and processing capabilities (e.g., low-end switches or routers). The specific architecture adopted depends on the specific network deployment scenario, and no restrictions are imposed here.

[0293] In a specific embodiment, any of the aforementioned communication entities (e.g., the first, second, third, fourth, fifth, and access control entities) can be implemented on the communication device 1000. The memory 1012 of the main control board 1010 can store instructions for implementing the functions performed by the aforementioned communication entities (e.g., instructions for implementing the functions of the aforementioned transceiver module 812 and processing module 814). The central processing unit 1011 of the main control board 1010 executes the instructions in the memory 1012 and can perform the functions performed by the aforementioned communication entities together with other components such as the interface board 1030 and the switching network board 1010.

[0294] In some possible implementations, any communication entity proposed in the embodiments of this application can be a virtualization device. As an example, a virtualization device can be a virtual machine (VM), which is deployed on a hardware device (e.g., a physical host). A virtual machine refers to a complete computer system simulated by software, possessing full hardware system functionality and running in a completely isolated environment. Virtual machines can be configured as the communication entities involved in the embodiments of this application. For example, the various communication entities can be implemented based on a general-purpose physical host combined with Network Functions Virtualization (NFV) technology. The communication entities can be virtual hosts, virtual routers, or virtual switches. Those skilled in the art can, by reading this application, virtualize the various communication entities with the functions described in the embodiments of this application on a general-purpose physical host using NFV technology.

[0295] In some possible implementations, any communication entity proposed in the embodiments of this application can be a processor or a chip. The chip may include a processor and a power supply circuit, the power supply circuit being used to supply power to the processor. In specific embodiments, the processor or chip may correspond to any of the aforementioned communication entities (e.g., the aforementioned first communication entity, second communication entity, third communication entity, fourth communication entity, fifth communication entity, access control entity, etc.), and the processor or chip can execute the operations performed by any of the communication entities.

[0296] This application also provides a communication system 1100, such as... Figure 11 As shown, the communication system includes one or more communication devices. These communication devices can be any combination of one or more of communication devices 900 or 1000. The combination of one or more communication devices can jointly perform the functions described in this embodiment. Figure 2 , Figure 4 The proposed flow control and flow detection methods.

[0297] The memory of one or more communication devices in the communication system 1100 may store the same information for executing the embodiments of this application. Figure 2 , Figure 4 The instructions for the proposed flow control and flow detection methods. Alternatively, the memory of one or more communication devices in the communication system 1100 may also store instructions for executing the embodiments of this application. Figure 2 , Figure 4 The proposed flow control and flow detection methods include some instructions. In other words, a combination of one or more communication devices can jointly execute instructions for implementing the embodiments of this application. Figure 2 , Figure 4 Instructions for the proposed flow control and flow detection methods.

[0298] In a specific embodiment, the memories in different communication devices within the communication system 1100 can store different instructions. The instructions stored in the memory of one communication device can be used to implement the functions of one or more of the aforementioned communication entities (e.g., the aforementioned first communication entity, second communication entity, third communication entity, fourth communication entity, fifth communication entity, access control entity, etc.). That is, the instructions stored in the memory of the communication device can implement the functions of the aforementioned transceiver module 812 and processing module 814.

[0299] In some possible implementations, one or more communication devices in the communication system 1100 can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc.

[0300] This application also provides another communication system, which includes one or more processors and one or more memories. The one or more memories store information for implementing the embodiments of this application. Figure 2 , Figure 4 The proposed flow control and flow detection methods, whose instructions can be executed by one or more processors executing instructions stored in one or more memories, are applicable to the embodiments of this application. Figure 2 , Figure 4 The proposed flow control and flow detection methods are described above. Further details regarding the processor and memory implementation can be found in the preceding descriptions of the processor and memory.

[0301] This application also provides a computer program product. The computer program product may be software or a program product containing instructions capable of running on a communication device or processor (e.g., running on one or more processors of the aforementioned communication device 900, communication device 1000, or communication system 1100) or stored on any usable medium. The instructions included in the computer program product may include instructions for executing the embodiments of this application. Figure 2 , Figure 4 The instructions for the steps or operations in the proposed flow control and flow detection methods. When the computer program product is run on a communication device or processor (e.g., on one or more processors of the aforementioned communication device 900, communication device 1000, or communication system 1100), it implements the embodiments of this application. Figure 2 , Figure 4 The steps or operations of the proposed flow control and flow detection methods.

[0302] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct a communication device or processor to execute the embodiments of this application. Figure 2 , Figure 4 The steps or operations of the proposed flow control and flow detection methods.

[0303] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of this application.

[0304] The terms “first,” “second,” “third,” and “fourth,” etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to define a specific order.

[0305] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

Claims

1. A flow rate detection method, characterized in that, The method includes: AI anomaly detection is performed on the traffic transmitted by network devices based on artificial intelligence (AI) traffic models; In response to the detection of abnormal traffic, the anomaly type is determined based on a pre-set statistical algorithm and judgment strategy.

2. The method according to claim 1, characterized in that, The step of determining the anomaly type based on a preset statistical algorithm strategy includes: Matching traffic anomaly events based on statistical algorithms; Based on the matching results, the anomaly type is determined.

3. The method according to claim 2, characterized in that, The abnormal events include one or more of the following: The frequency of access has increased abnormally, the peer has increased abnormally, access to high-risk ports has increased abnormally, the amount of traffic has increased abnormally, and the message interval has decreased abnormally.

4. The method according to any one of claims 1-3, characterized in that, The exception types include one or more of the following: Network scanning, Denial-of-Service (DoS) attacks, bandwidth overload, and abnormal access frequency.

5. The method according to any one of claims 1-4, characterized in that, Before performing AI anomaly detection on the traffic transmitted by network devices based on the artificial intelligence (AI) traffic model, the method further includes: The AI ​​traffic model is trained based on statistical information of the traffic transmitted by the network device.

6. The method according to any one of claims 1-5, characterized in that, The method further includes: Automatically generate access control policies based on the statistical information of the traffic transmitted by the network devices; In response to the detection of abnormal traffic, the access control policy is automatically sent to the access control entity in the network device, so that the network device can perform access control on the traffic according to the access control policy.

7. The method according to claim 5 or 6, characterized in that, The traffic statistics mentioned are those for normal traffic.

8. The method according to claim 6 or 7, characterized in that, The automatic generation of access control policies based on statistical information of traffic transmitted by the network device includes: A first access control policy is automatically generated based on the traffic statistics, and the first access control policy indicates the whitelist of traffic that the network device is allowed to transmit; or A second access control policy is automatically generated based on the traffic statistics, and the second access control policy indicates a blacklist of traffic that the network device is not allowed to transmit.

9. The method according to any one of claims 6-8, characterized in that, The access control policy includes Access Control List (ACL) or User Control List (UCL).

10. The method according to any one of claims 5-9, characterized in that, The statistical information includes one or more of the following: Source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic volume, and message interval.

11. A flow control method, characterized in that, The method includes: Obtain statistical information on the traffic transmitted by network devices, including one or more of the following: source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, and packet interval; Automatically generate access control policies based on the traffic statistics; The access control policy is automatically sent to the access control entity in the network device, so that the network device can control traffic access according to the access control policy.

12. The method according to claim 11, characterized in that, The traffic statistics mentioned are those for normal traffic.

13. The method according to claim 11 or 12, characterized in that, Automatically generate access control policies based on the traffic statistics, including: A first access control policy is automatically generated based on the traffic statistics, and the first access control policy indicates the whitelist of traffic that the network device is allowed to transmit; or A second access control policy is automatically generated based on the traffic statistics, and the second access control policy indicates a blacklist of traffic that the network device is not allowed to transmit.

14. The method according to any one of claims 11-13, characterized in that, The access control policy includes Access Control List (ACL) or User Control List (UCL).

15. The method according to any one of claims 11-14, characterized in that, The automatic sending of the access control policy to the access control entity in the network device includes: When abnormal traffic is detected in the network device, the access control policy is automatically sent to the access control entity in the network device.

16. A communication system, characterized in that, The system includes a first communication entity and a second communication entity. The first communication entity is used to perform AI anomaly detection on the traffic transmitted by the network device based on the artificial intelligence (AI) traffic model, and obtain anomaly detection results; The second communication entity is used to obtain the anomaly detection result from the first communication entity, and in response to the anomaly detection result being a traffic anomaly, determines the anomaly type according to a preset statistical algorithm judgment strategy.

17. A communication system, characterized in that, The system includes a third communication entity and an access control entity. The third communication entity is used to obtain statistical information of the traffic transmitted by the network device. The statistical information includes one or more of the following: source IP address, destination IP address, transport layer protocol, source port, destination port, access frequency, traffic size, and message interval. Based on the traffic statistical information, the entity automatically generates an access control policy and automatically sends the access control policy to the access control entity in the network device. The access control entity is used to receive the access control policy, enabling the network device to perform access control on traffic according to the access control policy.

18. A communication system, characterized in that, The system includes one or more processors and one or more memories; the one or more processors are configured to execute instructions stored in the one or more memories to cause the one or more processors to perform the method as described in any one of claims 1-15.

19. A computer program product, characterized in that, The computer program product includes instructions that, when executed by one or more processors, implement the method as described in any one of claims 1-15.

20. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer program instructions that, when executed by one or more processors, perform the method as described in any one of claims 1-15.

Images