A traffic identification method, device, equipment and storage medium

Abstract

The application provides a traffic identification method and device, equipment and a storage medium, and relates to the technical field of data processing. The method comprises the following steps: sampling received traffic data to obtain sampling data, wherein the sampling data comprises a plurality of data packets and a timestamp corresponding to each data packet in each data packet; constructing a structured flow graph based on the sampling data, wherein the structured flow graph comprises a plurality of nodes and a plurality of edges; determining a mutant data packet in the plurality of data packets, wherein the data interval between the mutant data packet and an adjacent data packet is greater than a set interval threshold, and the adjacent data packet is a data packet adjacent to the mutant data packet in the plurality of data packets; calculating a mutant confidence corresponding to the mutant data packet based on the structured flow graph, wherein the mutant confidence is used to represent the probability that the mutant data packet is abnormal traffic; and generating a traffic identification result corresponding to the traffic data based on the mutant confidence. The application can improve the accuracy of traffic identification.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and specifically to a traffic identification method, apparatus, device, and storage medium. Background Technology

[0002] Identifying malicious traffic (such as data traffic used to attack servers) is a key technology in the field of network security. Related technologies typically employ deep learning algorithms or decision trees to identify and block malicious traffic. However, these algorithms can only provide macro-level identification of traffic data. Some malicious traffic consists of a small number of attack packets mixed into normal traffic, making it difficult for these technologies to accurately identify this type of malicious traffic.

[0003] It is evident that the relevant technologies suffer from a low accuracy rate in identifying malicious traffic. Summary of the Invention

[0004] This invention provides a traffic identification method, apparatus, device, and storage medium to address the problem of low accuracy in identifying malicious traffic in related technologies.

[0005] To solve the above problems, the present invention is implemented as follows: In a first aspect, embodiments of the present invention provide a traffic identification method, comprising: The received traffic data is sampled to obtain sampled data, which includes multiple data packets and a timestamp corresponding to each data packet in each data packet; A structured flow graph is constructed based on the sampled data. The structured flow graph includes multiple nodes and multiple edges. The multiple nodes correspond one-to-one with the multiple data packets. Each node is used to represent the state of the data packet. Each edge is used to represent whether the data packets corresponding to two connected nodes have a continuous transmission relationship, a response relationship, or a transmission anomaly relationship. The transmission anomaly relationship is used to represent the abnormal interval between the timestamps of the two nodes. Determine the mutation point data packet among the plurality of data packets, wherein the data interval between the mutation point data packet and the adjacent data packet is greater than a set interval threshold, and the adjacent data packet is the data packet that is adjacent to the mutation point data packet among the plurality of data packets; The mutation confidence score corresponding to the mutation point data packet is calculated based on the structured flow graph. The mutation confidence score is used to characterize the probability that the mutation point data packet is abnormal traffic. Based on the mutation confidence level, a traffic identification result corresponding to the traffic data is generated.

[0006] In a second aspect, embodiments of the present invention provide a traffic flow identification device, comprising: The sampling module is used to sample the received traffic data to obtain sampled data, which includes multiple data packets and a timestamp corresponding to each data packet in each data packet; The construction module is used to construct a structured flow graph based on the sampled data. The structured flow graph includes multiple nodes and multiple edges. The multiple nodes correspond one-to-one with the multiple data packets. Each node is used to represent the state of the data packet. Each edge is used to represent whether the data packets corresponding to two connected nodes have a continuous transmission relationship, a response relationship, or a transmission anomaly relationship. The transmission anomaly relationship is used to represent the abnormal interval of the timestamps between the two nodes. A determining module is used to determine the mutation point data packet among the plurality of data packets, wherein the data interval between the mutation point data packet and the adjacent data packet is greater than a set interval threshold, and the adjacent data packet is the data packet that is adjacent to the mutation point data packet among the plurality of data packets; The calculation module is used to calculate the mutation confidence level corresponding to the mutation point data packet based on the structured flow graph. The mutation confidence level is used to characterize the probability that the mutation point data packet is abnormal traffic. The generation module is used to generate traffic identification results corresponding to the traffic data based on the mutation confidence level.

[0007] Thirdly, embodiments of the present invention also provide an electronic device, including a transceiver and a processor. The processor is used to sample the received traffic data to obtain sampled data, which includes multiple data packets and a timestamp corresponding to each data packet in each data packet; The processor is configured to construct a structured flow graph based on the sampled data. The structured flow graph includes multiple nodes and multiple edges. The multiple nodes correspond one-to-one with the multiple data packets. Each node is used to characterize the state of the data packet. Each edge is used to characterize whether the data packets corresponding to two connected nodes have a continuous transmission relationship, a response relationship, or a transmission anomaly relationship. The transmission anomaly relationship is used to characterize the abnormal interval between the timestamps of the two nodes. The processor is configured to determine the mutation point data packet among the plurality of data packets, wherein the data interval between the mutation point data packet and the adjacent data packet is greater than a set interval threshold, and the adjacent data packet is the data packet that is adjacent to the mutation point data packet among the plurality of data packets; The processor is configured to calculate the mutation confidence level corresponding to the mutation point data packet based on the structured flow graph, wherein the mutation confidence level is used to characterize the probability that the mutation point data packet is abnormal traffic; The processor is used to generate a traffic identification result corresponding to the traffic data based on the mutation confidence level.

[0008] Fourthly, embodiments of the present invention provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the traffic identification method described in the first aspect.

[0009] Fifthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the traffic identification method described in the first aspect.

[0010] In a sixth aspect, the present invention also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the traffic identification method described in the first aspect.

[0011] In this embodiment of the invention, received traffic data is sampled to obtain sampled data, which includes multiple data packets and a timestamp corresponding to each data packet in each data packet. A structured flow graph is constructed based on the sampled data, which includes multiple nodes and multiple edges. The multiple nodes correspond one-to-one with the multiple data packets. Each node is used to characterize the state of the data packet, and each edge is used to characterize whether the data packets corresponding to two connected nodes have a continuous transmission relationship, a response relationship, or a transmission anomaly relationship. The transmission anomaly relationship is used to characterize the abnormal interval between the timestamps of the two nodes. A mutation point data packet is determined among the multiple data packets. The data interval between the mutation point data packet and its adjacent data packets is greater than a set interval threshold. The adjacent data packets are the data packets adjacent to the mutation point data packet among the multiple data packets. The mutation confidence score corresponding to the mutation point data packet is calculated based on the structured flow graph. The mutation confidence score is used to characterize the probability that the mutation point data packet is abnormal traffic. A traffic identification result corresponding to the traffic data is generated based on the mutation confidence score. In this way, by identifying the mutation point data packets among multiple data packets and calculating the mutation confidence corresponding to the mutation point data packets based on the structured flow graph, the traffic can be identified through the mutation confidence to determine whether the mutation point data packets are abnormal traffic packets. This achieves the identification of abnormal traffic from a single data packet, thereby improving the identification accuracy. Attached Figure Description

[0012] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a traffic identification method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the traffic device, feature construction, and model training provided in an embodiment of the present invention; Figure 3 This is a structural diagram of a flow identification device provided in an embodiment of the present invention; Figure 4 This is a structural diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] Please see Figure 1 , Figure 1 This is a flowchart of a traffic identification method provided in an embodiment of the present invention, such as... Figure 1 As shown, it includes the following steps: Step 101: Sample the received traffic data to obtain sampled data, which includes multiple data packets and a timestamp corresponding to each data packet in each data packet.

[0016] The aforementioned traffic data refers to data received by a server or base station, and consists of continuous data packets. In this embodiment, the traffic data is sampled to obtain sampled data. Sampled data can retain the characteristics of the traffic data while reducing the amount of data for subsequent analysis, thereby improving identification efficiency. In some implementations, a static sampling period can be set to sample the traffic data.

[0017] The above-mentioned data packets are sampled data packets. When collecting multiple data packets, the timestamps corresponding to the data packets are collected synchronously. The timestamps can be used to determine the sending or receiving time of the sampled data packets, so as to facilitate the analysis of the data packets.

[0018] Step 102: Construct a structured flow graph based on the sampled data. The structured flow graph includes multiple nodes and multiple edges. The multiple nodes correspond one-to-one with the multiple data packets. Each node is used to represent the state of the data packet. Each edge is used to represent whether the data packets corresponding to two connected nodes have a continuous transmission relationship, a response relationship, or a transmission anomaly relationship. The transmission anomaly relationship is used to represent the abnormal interval of the timestamps between the two nodes.

[0019] The structured flow graph described above is used to characterize the transmission between multiple data packets, and is specifically determined by the nodes and edges included in the data flow graph.

[0020] In this structured flow graph, each node corresponds to a data packet, and the features of the node are used to characterize the state of the data packet, such as the sending frequency, data packet size, and data packet parameters.

[0021] Edges are used to characterize the relationship between two data packets. The relationship can include a continuous transmission relationship, a response relationship, or a transmission anomaly relationship between the data packets. A continuous transmission relationship means that the two data packets are transmitted sequentially. A response relationship means that the two data packets are two data packets with response messages, such as data packets in ACK and SEQ respectively. A transmission anomaly relationship is used to characterize an abnormal interval between the timestamps of the two data packets, which can be less than a set first interval threshold or greater than a set second interval threshold.

[0022] In this embodiment, a structured flow graph is constructed, which allows the relationship between data packets to be determined, thereby determining whether the data packets are abnormal traffic packets.

[0023] The edges include multiple types, such as window edges corresponding to continuous transmission relationships, acknowledgment edges corresponding to response relationships, or time-delay edges corresponding to transmission anomaly relationships.

[0024] Furthermore, the basic weights of the window edges are defined as follows: This is used to reflect the window sliding length or the continuity of the private room time; the basic weight of the confirmed edge is... To reflect the matching strength or the response accuracy of the acknowledgment packet; the base weight w of the time-delay edge. t Defined in the form of exponential decay: ; In the formula, Indicates the time interval between adjacent data packets. This is a global timescale constant. This weight can maintain the smoothness of the time delay representation without relying on a fixed sampling interval, thus enhancing the temporal interpretability of the graph.

[0025] In some implementations, the weights of all edges can be normalized or standardized to eliminate the influence of different units of measurement. Specifically, normalization can be achieved using the following formula: ; In the formula, Here, w represents the weights after normalization, and w represents the weights before normalization. The average of all edge weights. is the standard deviation of all edge weights.

[0026] Step 103: Determine the mutation point data packet among the plurality of data packets. The data interval between the mutation point data packet and the adjacent data packet is greater than a set interval threshold. The adjacent data packet is the data packet that is adjacent to the mutation point data packet among the plurality of data packets.

[0027] The data interval between the aforementioned mutation point data packet and its adjacent data packets is greater than a set interval threshold. Multiple data packets may contain one or more mutation point data packets. It should be noted that mutation point data packets may be data packets within abnormal traffic, requiring further analysis to determine whether the traffic is indeed abnormal.

[0028] The data interval can be the change between the data included in a data packet and the data included in an adjacent data packet, or it can be the change between the data characteristics of a data packet and the data characteristics of an adjacent data packet.

[0029] It should be noted that abnormal traffic is malicious traffic.

[0030] In some embodiments, the data interval between each data packet and its adjacent data packets can be calculated, and then the mutation point data packets can be obtained by filtering from multiple data packets.

[0031] Step 104: Calculate the mutation confidence level corresponding to the mutation point data packet based on the structured flow graph. The mutation confidence level is used to characterize the probability that the mutation point data packet is abnormal traffic.

[0032] Step 105: Generate the traffic identification result corresponding to the traffic data based on the mutation confidence level.

[0033] The aforementioned mutation confidence level is used to characterize the probability that a data packet at a mutation point is abnormal traffic. By calculating the mutation confidence level, and comparing it with a pre-set threshold, it is determined whether the traffic is abnormal. Specifically, if the mutation confidence level is greater than or equal to the set threshold, the traffic is determined to be abnormal, and a traffic identification result of abnormal traffic is generated; conversely, if the mutation confidence level is less than the set threshold, the traffic is determined to be normal, and a traffic identification result of normal traffic is generated.

[0034] In some implementations, the edges corresponding to mutation point data can be determined by a structured flow graph, and then the weights corresponding to the edges can be weighted to obtain the mutation confidence.

[0035] In this embodiment of the invention, received traffic data is sampled to obtain sampled data, which includes multiple data packets and a timestamp corresponding to each data packet in each data packet. A structured flow graph is constructed based on the sampled data, which includes multiple nodes and multiple edges. The multiple nodes correspond one-to-one with the multiple data packets. Each node is used to characterize the state of the data packet, and each edge is used to characterize whether the data packets corresponding to two connected nodes have a continuous transmission relationship, a response relationship, or a transmission anomaly relationship. The transmission anomaly relationship is used to characterize the abnormal interval between the timestamps of the two nodes. A mutation point data packet is determined among the multiple data packets. The data interval between the mutation point data packet and its adjacent data packets is greater than a set interval threshold. The adjacent data packets are the data packets adjacent to the mutation point data packet among the multiple data packets. The mutation confidence score corresponding to the mutation point data packet is calculated based on the structured flow graph. The mutation confidence score is used to characterize the probability that the mutation point data packet is abnormal traffic. A traffic identification result corresponding to the traffic data is generated based on the mutation confidence score. In this way, by identifying the mutation point data packets among multiple data packets and calculating the mutation confidence corresponding to the mutation point data packets based on the structured flow graph, the traffic can be identified through the mutation confidence to determine whether the mutation point data packets are abnormal traffic packets. This achieves the identification of abnormal traffic from a single data packet, thereby improving the identification accuracy.

[0036] In one embodiment, sampling the received traffic data to obtain sampled data includes: The traffic data is sampled to obtain first data at a first collection granularity and second data at a second collection granularity, wherein the second collection granularity is smaller than the first collection granularity; Calculate the first sampling confidence level and timestamp quality corresponding to the first data. The first sampling confidence level is used to characterize the sampling difference of the first data, and the timestamp quality is used to characterize the time fluctuation when sampling the first data. If the first sampling confidence level is greater than a set confidence threshold, and the timestamp quality is greater than a set quality threshold, then the first data is set as the sampling data; and / or, If the first sampling confidence level is less than the set confidence threshold, or if the timestamp quality is less than the set quality threshold, the second data is set as the sampling data.

[0037] The first and second acquisition granularities mentioned above are different acquisition granularities. The first acquisition granularity is larger, resulting in fewer data packets of the first data, while the second acquisition granularity is smaller, resulting in more data packets of the second data. By distinguishing between different acquisition granularities, the sampled data used for subsequent processing can be determined based on set confidence thresholds and set quality thresholds.

[0038] After collecting the first data and the second data, the first sampling confidence level and timestamp quality corresponding to the first data are calculated. If the first sampling confidence level is greater than the set confidence threshold and the timestamp quality is greater than the set quality threshold, the first data is considered to meet the requirements of subsequent data processing, and the first data can be set as the sampling data to reduce the amount of sampling data and improve the efficiency of subsequent calculations.

[0039] However, if the confidence level of the first sample is less than the set confidence threshold, or if the quality of the timestamp is less than the set quality threshold, the quality of the first data is low. In this case, the result obtained by analyzing the first data will have a large error. Therefore, the second data is set as the sampling data for subsequent data processing to improve the accuracy of the recognition result.

[0040] The aforementioned first sampling confidence level is used to characterize the sampling differences of the first data, and can be obtained by calculating the variance or standard deviation of the data packets included in the first data as the first sampling confidence level. The aforementioned timestamp quality is used to characterize the time fluctuation of the first data, and can be obtained by calculating the time interval of the data packets included in the first data, and then using the reciprocal of the variance or standard deviation of the time interval of each data packet as the timestamp quality.

[0041] In some implementations, the received traffic data is sampled, using a network 5-tuple (source address, destination address, source port, destination port, transport protocol) as an identifier. Each flow is treated as an independent input object, and two parallel sampling channels are started simultaneously. The fast sampling channel performs the first sampling at a granular level, capturing the first n bits of the flow. fast Data packets (e.g., 8 packets) are used to achieve low-latency real-time identification and early warning; a second sampling granularity is collected through a deep sampling channel, and segmented sampling is performed at the head, middle and tail of the flow according to the time window or flow segment ratio (e.g., 4 packets are extracted from each segment) to form a globally representative sample set.

[0042] In some implementations, the sampling confidence score can be calculated using the following formula: ; Where N represents the number of sampled data packets, coverage is the time or segment coverage, uniqueness reflects the feature entropy or discriminative power of the sample in the overall distribution, and w len,w cov ,w uni where is the weighting coefficient, and the sum of the weighting coefficients is 1. The initial value can be set to (0.3, 0.4, 0.3). It should be understood that when the sampling coverage of the entire flow is sufficient and the sample variability is high, the sampling confidence score is close to 1, and vice versa.

[0043] In some implementations, the timestamp quality tsq can be calculated using the following formula: ; in, Indicates the time interval between adjacent data packets. and These represent the mean and standard deviation of the time intervals, respectively. Ratio is a coefficient. outliers This represents the proportion of abnormal time intervals. This indicator can effectively reflect whether there are packet loss, rearrangement, or abnormal delays in the time series of sampled data packets. When the timestamp fluctuations are small and the sequence is continuous, the tsq value is close to 1.

[0044] In one embodiment, setting the second data as the sampled data when the first sampling confidence level is less than the set confidence threshold, or when the timestamp quality is less than the set quality threshold, includes: If the first sampling confidence level is less than the set confidence threshold, or if the timestamp quality is less than the set quality threshold, obtain the remaining computing resources; If the remaining computing resources are less than a set resource threshold, the second data is set as the sampled data; If the remaining computing resources are greater than or equal to the set resource threshold, calculate the second sampling confidence level corresponding to the second data. The second sampling confidence level is used to characterize the sampling difference of the second data. The first weight is calculated based on the first sampling confidence level and the second sampling confidence level; The first data and the second data are weighted and calculated based on the first weight to obtain the sampled data.

[0045] It should be noted that if the confidence level of the first sample is less than the set confidence threshold, or if the timestamp quality is less than the set quality threshold, the first data and the second data can be weighted to obtain the sampled data.

[0046] Specifically, the remaining computing resources of the device are used to determine whether to weight the first and second data. The remaining computing resources refer to the parameters of the device sampling the traffic data, which can be a server or a base station; that is, the remaining computing resources are used to determine whether weighting the first and second data is feasible.

[0047] In some implementations, the first weight is calculated based on the first sampling confidence level and the second sampling confidence level, which may be by directly setting the quotient of the first sampling confidence level and the second sampling confidence level as the first weight.

[0048] In some implementations, the first data and the second data are weighted based on the first weight to obtain the sampled data, which can be expressed by the following formula: ; In the formula, This represents the local behavioral features extracted during the fast sampling phase (i.e., the first data). This represents the global structural feature representation extracted during the deep sampling stage (i.e., the second representation). To enhance the adjustment coefficient, the fused For sampled data, As the first weight, score fast The score represents the confidence level of the first sample. deep This represents the confidence level for the second sampling.

[0049] In some implementations, the flow data can be further processed by flow segmentation to transform the continuous flow representation into local behavioral units suitable for graph modeling.

[0050] For example, the flow can be dynamically segmented based on time consistency constraints and window size constraints, thereby forming multiple structurally stable local behavioral flow segments. Subsequently, abrupt change point data identification and analysis can be performed on each of the multiple flow segments.

[0051] Specifically, the basic segmentation is first performed based on time consistency constraints. When the time interval between adjacent data packets exceeds a preset threshold, the connection is determined to be interrupted in stages, and a new flow segment is generated as the boundary of the flow segment to ensure the consistent expression of time continuity.

[0052] Based on this, a window size constraint mechanism is introduced. When the number of data packets or the duration in a single stream segment exceeds the set window length, the system performs forced segmentation to control the scale complexity and computational overhead of the subsequent graph structure and ensure comparability between multiple streams.

[0053] The multiple flow segments formed after being segmented by the above mechanism will serve as the flow segments for subsequent identification and analysis of abrupt change points, thereby determining whether the flow data is abnormal.

[0054] In one embodiment, determining the mutation point data packet among the plurality of data packets includes: The plurality of data packets are divided into a plurality of initial intervals, the plurality of initial intervals having the same time length, and each initial interval including at least two data packets; Calculate the mean state value of the state data of at least two data packets included in each initial interval; A first interval is determined, wherein the difference between the state mean of the first interval and the state mean of the adjacent initial interval is greater than a set change threshold. Calculate the disturbance intensity corresponding to each of the at least two data packets included in the first interval, wherein the disturbance intensity is used to characterize the state change of the corresponding data packet; The data packet with the largest disturbance intensity among the at least two data packets included in the first interval is designated as the mutation point data packet.

[0055] The aforementioned method divides the multiple data packets into multiple initial intervals, thereby first determining the first interval based on the scale of the initial intervals, and then determining the mutation data packets from the first interval. The time length of the initial intervals is pre-configured so that each initial interval includes at least two data packets.

[0056] The aforementioned state mean is the average of the state data of at least two data packets included in the initial interval. State data can be data controlled by the data packets, such as transmission delay, transmission frequency, and other parameters. By calculating the state mean of each initial interval, the first interval can be determined from multiple initial intervals.

[0057] It should be noted that the first interval can be one or more, and the first interval includes a mutation point data packet. In this embodiment, a disturbance intensity is introduced, and the mutation point data packet is determined by the disturbance intensity.

[0058] In some implementations, the state mean It can be calculated in the following way: ; In the formula, The length of the sliding window. For microstep intervals, The state data at time i is... For the first The status data. If Exceeding the set change threshold If the segment is identified as a potential disturbance region (i.e., the first region), then that segment is marked as such. This process performs a rapid scan of large changes with low computational overhead, providing a location reference for subsequent fine-tuning of data packets that identify abrupt changes.

[0059] Furthermore, in some implementations, the change in state data between a data packet and its neighboring data packets can be used as the disturbance intensity of that data packet.

[0060] In other implementations, the disturbance intensity R(t) can be calculated using the following formula: ; in, Indicates the sensitivity parameter based on channel or category. The expanded template function, A larger value results in a shorter template time window, adapting to rapidly responding flow types. This is achieved by adjusting the template time window within the coarse-scale segment (i.e., the first interval). Extracting local maxima to accurately extract the set of candidate mutation point data packets. This enables the identification of mutation point data packets within a multi-scale framework.

[0061] In this embodiment of the invention, the plurality of data packets are divided into a plurality of initial intervals, the plurality of initial intervals having the same time length, and each initial interval including at least two data packets; the state mean of the state data of the at least two data packets included in each initial interval is calculated; a first interval is determined, wherein the difference between the state mean of the first interval and the state mean of the adjacent initial interval is greater than a set change threshold; the disturbance intensity corresponding to each data packet in the at least two data packets included in the first interval is calculated, the disturbance intensity being used to characterize the state change of the corresponding data packet; the data packet with the largest disturbance intensity in the at least two data packets included in the first interval is set as the mutation point data packet. In this way, by determining the first interval through the state mean, and then determining the mutation point data packet from the first interval, the mutation point data packet can be quickly determined from different scales.

[0062] In one embodiment, calculating the mutation confidence corresponding to the mutation point data packet based on the structured flow graph includes: Determine multiple intermediate data packets corresponding to the mutation point data packet, and the multiple intermediate data packets and the mutation point data packet are within a set sampling window; Calculate the variance of the state data of the plurality of intermediate data packets and the mutation point data packets; Based on the structured flow graph, at least one connection edge corresponding to the mutation point data packet is determined, and the at least one connection edge is an edge in the structured flow graph that connects to the node corresponding to the mutation point data packet; Calculate the standard deviation corresponding to the at least one connecting edge, where the standard deviation is the standard deviation corresponding to the edge weight of the at least one connecting edge; The variance, the standard deviation, and the disturbance intensity of the mutation point data packet are weighted to obtain the mutation confidence level corresponding to the mutation point data packet.

[0063] It should be noted that the mutation point data packet may still be within the normal range when viewed from the perspective of multiple data packets included in the traffic data as a whole. Therefore, this embodiment introduces a sampling window to determine multiple intermediate data packets corresponding to the mutation point data packet. This allows the abnormality of the mutation point data packet to be determined from a local range through multiple intermediate data packets, thereby realizing the identification of traffic data.

[0064] The length of the sampling window can be preset, such as including 10 data packets before and after the mutation point data packet.

[0065] Furthermore, after determining multiple intermediate data packets by setting a sampling window, the variance of the state data of the multiple intermediate data packets and the mutation point data packets, as well as the standard deviation corresponding to at least one connection edge, are calculated. The mutation confidence is calculated by using the variance, standard deviation, and disturbance intensity of the mutation point data packets. This allows the mutation confidence of the mutation point data packets to be determined by the data packet relationship and the state of different data packets, thus improving the accuracy of the mutation confidence.

[0066] In some implementations, the perturbation strength of the mutation point data packet It can be represented as: ; In some implementations, candidate mutation point data packets t k A local time-domain window with a sampling window length of 2W is set as the center. And calculate the state data S within that window. t variance for: ; In the formula, S represents the mean of the state data within this window. t This represents the state data of the data packet at time t. It should be understood that variance can effectively eliminate isolated single-packet random noise interference. If the variance is too large and disordered, it usually indicates the presence of high-frequency background noise in the environment, and the confidence level should be appropriately reduced.

[0067] In some implementations, after calculating the standard deviation corresponding to the at least one connection edge, the distribution entropy is calculated based on the standard deviation, and the variance value, the distribution entropy, and the disturbance intensity of the mutation point data packet are weighted to obtain the mutation confidence level corresponding to the mutation point data packet.

[0068] Among them, distribution entropy It can be represented as: ; In the formula, This represents the standard deviation of the normalized weights w of all edges directly adjacent to the node corresponding to the data packet at the mutation point. It should be noted that if the edge weights within the topological neighborhood exhibit high cooperative synchronization (i.e., extremely small standard deviation and consistency score close to 1), it indicates that the mutation point is not caused by occasional packet loss, but may be triggered by graph-level network behaviors with structured characteristics (such as cooperative attacks and batch retransmissions).

[0069] The variance value, the distribution entropy, and the perturbation intensity of the mutation point data packet are weighted to obtain the mutation confidence (t) corresponding to the mutation point data packet. k ), can be represented as: ; in, , , This is the preset adjustment weight coefficient.

[0070] In some implementations, a threshold can be incorporated. and threshold By comparing each one individually, accurate identification can be achieved.

[0071] When the confidence value is higher than the threshold When the traffic is abnormal, it can proceed to subsequent analysis; when the confidence level is between and In between, the deep sampling channel can be automatically triggered in parallel to perform data supplementation, and fine-scale detection can be re-executed after the supplemented data arrives to further determine the flow rate; if the confidence level is lower than If so, the traffic is normal.

[0072] In some implementations, the length of the sampling window can be dynamically adjusted. The length of the sampling window can be calculated using the following formula: ; In the formula, As the global timescale benchmark, g() represents the correction function based on the neighborhood edge weight distribution and node density of the node corresponding to the mutation point data packet, and loacl_edge_profile is the local profile feature used to quantify the heterogeneity of the microscopic behavior of the mutation point data packet within the topological neighborhood. This parameter is jointly determined by the neighborhood node density and the spatial dispersion of the edge weight, and its specific mathematical expression is as follows: ; In the formula, The neighborhood node density is determined by the candidate mutation point data packet t. k The corresponding node is the core The density score is determined by the total number of active nodes or the average node degree within the hop topology neighborhood (N is initially set to 2 or 3). The more frequent the packet interactions and the tighter the temporal connections within this neighborhood, the higher the density score. The standard deviation is the value of the edge weights of certain critical transmission paths within a neighborhood that are extremely high, while the edge weights of ordinary background traffic are extremely low. The significant increase indicates that the causal transmission at the mutation point has extremely strong directionality and heterogeneity.

[0073] The correction function g() employs a monotonically decreasing mapping relationship. When the edge weight difference near the node corresponding to the mutation point data packet is large and the structure is denser, the loacl_edge_profile obtained by the composite calculation shows high explicitness, and the correction coefficient output after processing by the g() function decreases accordingly. At this time, the adaptive attribution time window T... window Automatic shrinking enables precise focus on the core event chain, avoiding the introduction of irrelevant background noise.

[0074] Conversely, if the topology around the mutation point is sparse and the differences in edge weights are small, it indicates that there is no overtly strong causal event, and the anomaly may be caused by long-period slow penetration or multi-hop indirect behavior. In this case, the `loacl_edge_profile` value decreases, and the correction coefficient output by the adjustment function `g()` increases. At this point, relaxing `T`... window The time frame is designed to accommodate and capture potential indirect triggering paths.

[0075] In one embodiment, the method further includes: Based on the structured flow graph, a reverse extension path corresponding to the mutation point data packet is generated. The reverse extension path includes the mutation point data packet and multiple connection edges. The reverse extension path is a path that may send the mutation point data packet. Obtain the edge features corresponding to each of the plurality of connection edges, and the edge features are used to characterize the network behavior corresponding to the respective connection edge; Determine the data characteristics corresponding to the mutation point data packet; Calculate the first score corresponding to the reverse expansion path. The first score is a weighted sum of the similarities corresponding to the multiple connecting edges. The similarity is the similarity between the edge feature and the data feature corresponding to the connecting edge. If the first score is greater than a first set score threshold, a blocking strategy is generated, which is used to instruct the disconnection of the traffic transmission path corresponding to the reverse extension path.

[0076] The aforementioned reverse expansion path is the path for sending mutation point data packets. It can be one path or multiple paths. In the case of multiple paths, the first score is calculated for each path, and the path with the highest first score is the final reverse expansion path.

[0077] In some implementations, starting with the mutated data packet, the nodes are expanded from largest to smallest according to the edge weights to obtain a reverse expansion path.

[0078] Furthermore, after obtaining the reverse expansion path, the edge features of each connecting edge in the path and the data features of the mutation point data are determined. The edge features are used to characterize the network behavior corresponding to the corresponding connecting edge, and the network behavior can be batch retransmission, cooperative attack, etc. The data features can be the node features of the node corresponding to the mutation point data, which are used to describe the state of the standard mutation data.

[0079] After obtaining the edge characteristics of each connection edge and the data characteristics of the mutation point data, a first score is calculated based on these characteristics. This first score is used to determine the number of edges associated with the mutation point data packet. It should be understood that a low first score indicates that the mutation point data packet is a relatively independent packet with a small impact, and therefore does not require blocking. Conversely, a high first score indicates that the mutation point data packet may be part of a continuous data packet series, with a significant impact. In this case, blocking the reverse extension path is necessary to prevent abnormal traffic attacks on the server or base station.

[0080] In some implementations, the first score Impact(K) can be expressed as: ; In the formula, The normalized edge weights reflect the transmission strength between events; s(e) represents the similarity between the edge features and data features corresponding to the connecting edge, where e is the edge, K is the reverse expansion path, and s(e) can be determined based on the matching degree of the event type, keyword semantics, or behavior category corresponding to the edge.

[0081] To ensure the similarity calculation has a clear entity basis, the event content corresponding to edge e can be defined as the network behavior characteristics and service type identifier carried by the communication connection (specifically including: protocol control field attributes, port interaction categories, data packet length distribution patterns, etc.). Using a pre-defined service association matrix, the degree of fit between the network behavior corresponding to the edge and the target mutation behavior (i.e., the data characteristics corresponding to the mutation point data packet) is evaluated: if the behavior corresponding to the edge is a strongly correlated behavior (e.g., the mutation point is high-volume congestion, while the event content of the edge is control plane signaling for a distributed denial-of-service attack), then its content matching degree is high, and the s(e) score is close to 1; if the behavior corresponding to the edge is a normal background traffic switch, then the content matching degree is low, and the s(e) score is close to 0.

[0082] It should be noted that if multiple paths have Impact(K) values ​​close to or exceeding the threshold, these paths are included in the candidate path set and sorted from high to low according to their impact scores. The top M most representative paths are output as the final attribution explanation set. The M paths included in the final attribution explanation set are then analyzed to determine the final blocking strategy.

[0083] In this embodiment of the invention, a reverse extension path corresponding to the mutation point data packet is generated based on the structured flow graph. The reverse extension path includes the mutation point data packet and multiple connection edges, and the reverse extension path is a path that may send the mutation point data packet. Edge features corresponding to each of the multiple connection edges are obtained, and these edge features characterize the network behavior corresponding to the respective connection edge. Data features corresponding to the mutation point data packet are determined. A first score corresponding to the reverse extension path is calculated, where the first score is a weighted sum of the similarities corresponding to the multiple connection edges, and the similarity is the similarity between the edge feature corresponding to the connection edge and the data feature. If the first score is greater than a first set score threshold, a blocking strategy is generated, which instructs the disconnection of the traffic transmission path corresponding to the reverse extension path. In this way, by calculating the first score using the data features of the mutation point data packet, and then determining whether to block the traffic transmission path based on the first score, attacks on servers or base stations by abnormal traffic are avoided, thus improving security.

[0084] In one embodiment, generating a blocking strategy when the first score is greater than a set score threshold includes: If the first score is greater than the first set score threshold, a second score and a third score are calculated. The second score is used to characterize whether the reverse expansion path includes a preset object, and the third score is used to characterize the timestamp change of each node in the reverse expansion path. The blocking strategy is generated when the second score is greater than the second set score threshold and the third score is greater than the third set score threshold.

[0085] It should be noted that, in addition to generating a blocking strategy directly based on the first score, it is also possible to determine whether a blocking strategy needs to be generated based on the second and third scores.

[0086] The second score is used to characterize whether the reverse extension path includes a preset object. If the second score is greater than the second set score threshold, it means that a preset object exists. The preset object can be information such as the address of abnormal traffic or abnormal domain name.

[0087] The third score is used to characterize the timestamp changes of each node in the reverse expansion path. The more frequent the timestamp changes in the third score, the higher the frequency of abnormal traffic attacks, and the more likely it is to block the path.

[0088] In this embodiment, a second score and a third score are calculated. The second score is used to characterize whether the reverse extension path includes a preset object, and the third score is used to characterize the timestamp change of each node in the reverse extension path. When the second score is greater than the second set score threshold and the third score is greater than the third set score threshold, a blocking strategy is generated to achieve accurate blocking of abnormal traffic.

[0089] In some implementations, the second score S oper This is used to assess whether the source event or core vulnerability corresponding to the current attribution path can directly trigger standardized network service actions (such as ACL rule issuance, routing black hole blocking, etc.). Specifically, it can be calculated using the following formula: ; In the formula, The binary linkage flag is set as follows: (if the source is a clearly malicious address, malicious domain name, or other entity that can directly block the interface, it is marked as 1; otherwise, if it is a normal shared gateway, it is marked as 0). This indicates the matching degree of the linkage strategy (measuring whether there is a ready-made closed-loop response plan in the current defense system).

[0090] Third rating This is used to measure the reliability and sufficiency of evidence of a path. Specifically, the first score Impact(K) of path K is extracted and combined with the average timestamp quality of all data packet nodes involved in that path, calculated in step one. Perform comprehensive quantification: ; In the formula, , These are preset weighting coefficients. The higher the score, the more certain the path derivation in terms of statistics and graph topology, and the more reliable the analysis results.

[0091] It should be noted that when the path also has high operability ( ) and high confidence ( If the evidence is conclusive and the path is clear, a blocking strategy is generated. If the confidence level is high but the operability is insufficient (e.g., it is determined that the anomaly originates from some complex cross-domain collaboration, and it is impossible to directly block a single point), the attribution result and path can be pushed to the manual review and strategy optimization stage for a second manual assessment by security experts.

[0092] In some implementations, such as Figure 2 As shown, the status-corresponding features of the collected data packets can also be filtered to improve the accuracy of the subsequently generated recognition results.

[0093] Specifically, in the offline phase, a pre-defined screening method (such as the JSD method) can be used to select a set of features that are stable and have strong discriminative power in the traffic samples by calculating the distribution changes of candidate features. These features provide a preliminary stable feature set for subsequent flow-aware reweighting and incremental reconstruction.

[0094] In the subsequent processing stage, this scheme optimizes the feature set through two key processes. First, the system periodically calculates the increment of candidate features. This is used to evaluate the stability of a feature. If a feature's stability is... If the value exceeds the set threshold, the feature will be marked as unstable. At this time, it can be handled according to the following two strategies: 1) Feature annealing: reduce the weight of unstable features to reduce their impact on the model; 2) Feature replacement: select features that are more compatible with the current traffic pattern from historical samples or newly collected data to replace them.

[0095] Furthermore, a flow-aware feature weighting mechanism is introduced. During attribution analysis, feature weights are dynamically adjusted based on the impact of key event chains. This process ensures the model has higher responsiveness across key dimensions by increasing the weights of high-impact features and appropriately attenuating low-impact features. The feature weight adjustment follows this formula: ; In the formula, and These represent the weighting adjustment factors for high-impact and low-impact features, respectively. "Impact" indicates the feature's impact on mutations, and "unaffected" indicates the feature's low response in attribution analysis.

[0096] In some implementations, such as Figure 2 As shown, a teacher model can be trained, a student model can be obtained by distilling the teacher model, and then the student model can be deployed to reduce the pressure on the server or base station.

[0097] First, in the offline phase, a high-precision GraphSAT model is trained using the complete feature set as the teacher model, providing knowledge support for the subsequent online model. Next, in the online deployment phase, a lightweight Student model (single-layer GraphSAGE + low-dimensional attention mechanism) is deployed, and real-time performance is improved by combining it with an online distillation process.

[0098] During the distillation process, the student model records low-confidence samples and sends them to the distillation cache. The teacher model periodically or based on triggering conditions generates pseudo-labels on these cached samples and continuously optimizes the student model through incremental distillation training using knowledge replay and temperature smoothing.

[0099] Furthermore, this solution introduces an automated handling process to ensure rapid response and resolution of potential threats during malicious traffic monitoring. Upon detecting a mutation point, the system outputs structured results, including mutation time, impact factor, confidence level, recommended action (automatic / manual), and business priority. This output information will be used to determine the appropriate handling plan.

[0100] Based on the first, second, and third scores, the automated handling process is divided into three stages: self-service, AI confirmation, and direct interception / rate limiting. For low-risk threats, the system will push a self-service card, allowing users to handle the situation themselves; for medium-risk threats, the system will provide automated strategy suggestions and wait for one-click confirmation; for high-risk threats with extremely high confidence, the system will automatically intercept or rate limit the threat.

[0101] After each action, the system uses a closed-loop feedback process to write the user's or network's subsequent behavior as a feedback sample into the distillation cache and trigger a re-evaluation of feature stability.

[0102] While ensuring efficient model deployment and distillation processes, this solution also guarantees security and privacy. Long-term statistical data is stored using a linear projection sketch of the header fields, avoiding the need to store the complete header sequence. Simultaneously, critical decisions (such as automatic interception) trigger differential audit logs, recording triggering factors and trajectories for post-audit purposes. Furthermore, the system employs a least privilege policy, allowing fine-grained data to be pushed to the offline teacher model only when the "confidence level + score" meets the policy requirements.

[0103] Please see Figure 3 , Figure 3 This is a structural diagram of a flow identification device provided in an embodiment of the present invention, as shown below. Figure 3 As shown, the flow identification device 300 includes: The sampling module 301 is used to sample the received traffic data to obtain sampled data, which includes multiple data packets and a timestamp corresponding to each data packet in each data packet; Construction module 302 is used to construct a structured flow graph based on the sampled data. The structured flow graph includes multiple nodes and multiple edges. The multiple nodes correspond one-to-one with the multiple data packets. Each node is used to represent the state of the data packet. Each edge is used to represent whether the data packets corresponding to two connected nodes have a continuous transmission relationship, a response relationship, or a transmission anomaly relationship. The transmission anomaly relationship is used to represent the abnormal interval of the timestamps between the two nodes. The determining module 303 is used to determine the mutation point data packet among the plurality of data packets, wherein the data interval between the mutation point data packet and the adjacent data packet is greater than a set interval threshold, and the adjacent data packet is the data packet that is adjacent to the mutation point data packet among the plurality of data packets; The calculation module 304 is used to calculate the mutation confidence level corresponding to the mutation point data packet based on the structured flow graph, wherein the mutation confidence level is used to characterize the probability that the mutation point data packet is abnormal traffic; The generation module 305 is used to generate the traffic identification result corresponding to the traffic data based on the mutation confidence.

[0104] In one embodiment, the sampling module 301 includes: A sampling unit is used to sample the traffic data to obtain first data at a first sampling granularity and second data at a second sampling granularity, wherein the second sampling granularity is smaller than the first sampling granularity. The first calculation unit is used to calculate the first sampling confidence and timestamp quality corresponding to the first data. The first sampling confidence is used to characterize the sampling difference of the first data, and the timestamp quality is used to characterize the time fluctuation when sampling the first data. The first setting unit is configured to set the first data as the sampled data when the first sampling confidence level is greater than a set confidence threshold and the timestamp quality is greater than a set quality threshold; and / or, The second setting unit is configured to set the second data as the sampled data when the first sampling confidence level is less than the set confidence threshold, or when the timestamp quality is less than the set quality threshold; or... In one embodiment, the first setting unit is specifically used for: If the first sampling confidence level is less than the set confidence threshold, or if the timestamp quality is less than the set quality threshold, the second sampling confidence level corresponding to the second data is calculated. The second sampling confidence level is used to characterize the sampling difference of the second data. The first weight is calculated based on the first sampling confidence level and the second sampling confidence level; The first data and the second data are weighted and calculated based on the first weight to obtain the sampled data.

[0105] In one embodiment, the determining module 303 includes: A partitioning unit is used to divide the plurality of data packets into a plurality of initial intervals, wherein the plurality of initial intervals have the same time length and each initial interval includes at least two data packets; The fifth calculation unit is used to calculate the average state value of the state data of at least two data packets included in each initial interval; The first determining unit is used to determine a first interval, wherein the difference between the state mean of the first interval and the state mean of the adjacent initial interval is greater than a set change threshold. The sixth calculation unit is used to calculate the disturbance intensity corresponding to each of the at least two data packets included in the first interval, wherein the disturbance intensity is used to characterize the state change of the corresponding data packet; The third setting unit is used to set the data packet with the largest disturbance intensity among the at least two data packets included in the first interval as the mutation point data packet.

[0106] In one embodiment, the computing module 304 includes: The second determining unit is used to determine multiple intermediate data packets corresponding to the mutation point data packet, wherein the multiple intermediate data packets and the mutation point data packet are within a set sampling window; The seventh calculation unit is used to calculate the variance of the state data of the plurality of intermediate data packets and the mutation point data packets; The third determining unit is used to determine at least one connection edge corresponding to the mutation point data packet based on the structured flow graph, wherein the at least one connection edge is an edge in the structured flow graph that connects to the node corresponding to the mutation point data packet; The eighth calculation unit is used to calculate the standard deviation corresponding to the at least one connecting edge, wherein the standard deviation is the standard deviation corresponding to the edge weight of the at least one connecting edge; The ninth calculation unit is used to weight the variance value, the standard deviation, and the disturbance intensity of the mutation point data packet to obtain the mutation confidence level corresponding to the mutation point data packet.

[0107] In one embodiment, the traffic identification device 300 further includes: The first generation unit is used to generate a reverse extension path corresponding to the mutation point data packet based on the structured flow graph. The reverse extension path includes the mutation point data packet and multiple connection edges. The reverse extension path is a path that may send the mutation point data packet. The acquisition unit is used to acquire the edge features corresponding to each of the plurality of connection edges, and the edge features are used to characterize the network behavior corresponding to the corresponding connection edge. The fourth determining unit is used to determine the data characteristics corresponding to the mutation point data packet; The tenth calculation unit is used to calculate the first score corresponding to the reverse expansion path. The first score is a weighted sum of the similarities corresponding to the multiple connecting edges. The similarity is the similarity between the edge feature and the data feature corresponding to the corresponding connecting edge. The second generation unit is used to generate a blocking strategy when the first score is greater than a first set score threshold. The blocking strategy is used to instruct the cutting off of the traffic transmission path corresponding to the reverse extension path.

[0108] In one embodiment, the second generating unit is specifically used for: If the first score is greater than the first set score threshold, a second score and a third score are calculated. The second score is used to characterize whether the reverse expansion path includes a preset object, and the third score is used to characterize the timestamp change of each node in the reverse expansion path. The blocking strategy is generated when the second score is greater than the second set score threshold and the third score is greater than the third set score threshold.

[0109] The intent recognition device provided in this embodiment of the invention can implement each process of the above-described traffic recognition method, with one-to-one correspondence of technical features and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0110] It should be noted that the traffic identification device in the embodiments of the present invention can be a device, or it can be a component, integrated circuit, or chip in an electronic device.

[0111] This invention also provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the above-described functionality. Figure 1 The various processes of the traffic identification method embodiment shown are all capable of achieving the same technical effect, and will not be described again here to avoid repetition.

[0112] For details, see Figure 4As shown, this embodiment of the invention also provides an electronic device, including a bus 401, a transceiver 402, an antenna 403, a bus interface 404, a processor 405, and a memory 406.

[0113] The processor 405 is used to sample the received traffic data to obtain sampled data, the sampled data including multiple data packets and a timestamp corresponding to each data packet in each data packet; The processor 405 is configured to construct a structured flow graph based on the sampled data. The structured flow graph includes multiple nodes and multiple edges. The multiple nodes correspond one-to-one with the multiple data packets. Each node is used to characterize the state of the data packet. Each edge is used to characterize whether the data packets corresponding to two connected nodes have a continuous transmission relationship, a response relationship, or a transmission anomaly relationship. The transmission anomaly relationship is used to characterize the abnormal interval of the timestamps between the two nodes. The processor 405 is configured to determine the mutation point data packet among the plurality of data packets, wherein the data interval between the mutation point data packet and the adjacent data packet is greater than a set interval threshold, and the adjacent data packet is the data packet that is adjacent to the mutation point data packet among the plurality of data packets; The processor 405 is used to calculate the mutation confidence level corresponding to the mutation point data packet based on the structured flow graph, wherein the mutation confidence level is used to characterize the probability that the mutation point data packet is abnormal traffic; The processor 405 is used to generate a traffic identification result corresponding to the traffic data based on the mutation confidence level.

[0114] In one embodiment, sampling the received traffic data to obtain sampled data includes: The traffic data is sampled to obtain first data at a first collection granularity and second data at a second collection granularity, wherein the second collection granularity is smaller than the first collection granularity; Calculate the first sampling confidence level and timestamp quality corresponding to the first data. The first sampling confidence level is used to characterize the sampling difference of the first data, and the timestamp quality is used to characterize the time fluctuation when sampling the first data. If the first sampling confidence level is greater than a set confidence threshold, and the timestamp quality is greater than a set quality threshold, then the first data is set as the sampling data; and / or If the first sampling confidence level is less than the set confidence threshold, or if the timestamp quality is less than the set quality threshold, the second data is set as the sampling data.

[0115] In one embodiment, setting the second data as the sampled data when the first sampling confidence level is less than the set confidence threshold, or when the timestamp quality is less than the set quality threshold, includes: If the first sampling confidence level is less than the set confidence threshold, or if the timestamp quality is less than the set quality threshold, obtain the remaining computing resources; If the remaining computing resources are less than a set resource threshold, the second data is set as the sampled data; If the remaining computing resources are greater than or equal to the set resource threshold, calculate the second sampling confidence level corresponding to the second data. The second sampling confidence level is used to characterize the sampling difference of the second data. The first weight is calculated based on the first sampling confidence level and the second sampling confidence level; The first data and the second data are weighted and calculated based on the first weight to obtain the sampled data.

[0116] In one embodiment, determining the mutation point data packet among the plurality of data packets includes: The plurality of data packets are divided into a plurality of initial intervals, the plurality of initial intervals having the same time length, and each initial interval including at least two data packets; Calculate the mean state value of the state data of at least two data packets included in each initial interval; A first interval is determined, wherein the difference between the state mean of the first interval and the state mean of the adjacent initial interval is greater than a set change threshold. Calculate the disturbance intensity corresponding to each of the at least two data packets included in the first interval, wherein the disturbance intensity is used to characterize the state change of the corresponding data packet; The data packet with the largest disturbance intensity among the at least two data packets included in the first interval is designated as the mutation point data packet.

[0117] In one embodiment, calculating the mutation confidence corresponding to the mutation point data packet based on the structured flow graph includes: Determine multiple intermediate data packets corresponding to the mutation point data packet, and the multiple intermediate data packets and the mutation point data packet are within a set sampling window; Calculate the variance of the state data of the plurality of intermediate data packets and the mutation point data packets; Based on the structured flow graph, at least one connection edge corresponding to the mutation point data packet is determined, and the at least one connection edge is an edge in the structured flow graph that connects to the node corresponding to the mutation point data packet; Calculate the standard deviation corresponding to the at least one connecting edge, where the standard deviation is the standard deviation corresponding to the edge weight of the at least one connecting edge; The variance, the standard deviation, and the disturbance intensity of the mutation point data packet are weighted to obtain the mutation confidence level corresponding to the mutation point data packet.

[0118] In one embodiment, the processor 405 is further configured to generate a reverse extension path corresponding to the mutation point data packet based on the structured flow graph, the reverse extension path including the mutation point data packet and multiple connection edges, the reverse extension path being a path that may send the mutation point data packet; The processor 405 is further configured to obtain the edge features corresponding to each of the plurality of connection edges, the edge features being used to characterize the network behavior corresponding to the respective connection edge; The processor 405 is also used to determine the data characteristics corresponding to the mutation point data packet; The processor 405 is further configured to calculate a first score corresponding to the reverse expansion path, wherein the first score is a weighted sum of the similarities corresponding to the plurality of connecting edges, and the similarity is the similarity between the edge feature and the data feature corresponding to the corresponding connecting edge; The processor 405 is further configured to generate a blocking strategy when the first score is greater than a first set score threshold, the blocking strategy being used to instruct the cutting off of the traffic transmission path corresponding to the reverse extension path.

[0119] In one embodiment, generating a blocking strategy when the first score is greater than a set score threshold includes: If the first score is greater than the first set score threshold, a second score and a third score are calculated. The second score is used to characterize whether the reverse expansion path includes a preset object, and the third score is used to characterize the timestamp change of each node in the reverse expansion path. The blocking strategy is generated when the second score is greater than the second set score threshold and the third score is greater than the third set score threshold.

[0120] exist Figure 4In this document, a bus architecture (represented by bus 401) is used. Bus 401 may include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 405 and memory represented by memory 406. Bus 401 may also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 404 provides an interface between bus 401 and transceiver 402. Transceiver 402 may be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 405 is transmitted over a wireless medium via antenna 403, which further receives data and transmits data to processor 405.

[0121] Processor 405 is responsible for managing bus 401 and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 406 can be used to store data used by processor 405 during operation.

[0122] Optionally, the processor 405 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a graphics processing unit (GPU).

[0123] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the above-described functions. Figure 1 The various processes corresponding to the traffic identification method embodiments, and which achieve the same technical effect, will not be described again here to avoid repetition. The computer-readable storage medium mentioned includes, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0124] The present invention also provides a computer program product, including computer instructions that, when executed by a processor, implement the above-described... Figure 1 The various processes corresponding to the traffic identification method embodiments can achieve the same technical effect, and will not be described again here to avoid repetition.

[0125] In the embodiments of this invention, the terms "first," "second," etc., are used to distinguish similar object parameters and are not necessarily used to describe a specific order or sequence. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices. Additionally, the use of "and / or" in this application indicates at least one of the connected object parameters, such as A and / or B and / or C, representing seven possibilities: A alone, B alone, C alone, both A and B present, both B and C present, both A and C present, and A, B, and C present.

[0126] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0127] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, etc.) to execute the methods of the various embodiments of this application.

[0128] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A traffic flow identification method, characterized in that, include: The received traffic data is sampled to obtain sampled data, which includes multiple data packets and a timestamp corresponding to each data packet in each data packet; A structured flow graph is constructed based on the sampled data. The structured flow graph includes multiple nodes and multiple edges. The multiple nodes correspond one-to-one with the multiple data packets. Each node is used to represent the state of the data packet. Each edge is used to represent whether the data packets corresponding to two connected nodes have a continuous transmission relationship, a response relationship, or a transmission anomaly relationship. The transmission anomaly relationship is used to represent the abnormal interval between the timestamps of the two nodes. Determine the mutation point data packet among the plurality of data packets, wherein the data interval between the mutation point data packet and the adjacent data packet is greater than a set interval threshold, and the adjacent data packet is the data packet that is adjacent to the mutation point data packet among the plurality of data packets; The mutation confidence score corresponding to the mutation point data packet is calculated based on the structured flow graph. The mutation confidence score is used to characterize the probability that the mutation point data packet is abnormal traffic. Based on the mutation confidence level, a traffic identification result corresponding to the traffic data is generated.

2. The method as described in claim 1, characterized in that, The step of sampling the received traffic data to obtain sampled data includes: The traffic data is sampled to obtain first data at a first collection granularity and second data at a second collection granularity, wherein the second collection granularity is smaller than the first collection granularity; Calculate the first sampling confidence level and timestamp quality corresponding to the first data. The first sampling confidence level is used to characterize the sampling difference of the first data, and the timestamp quality is used to characterize the time fluctuation when sampling the first data. If the first sampling confidence level is greater than a set confidence threshold, and the timestamp quality is greater than a set quality threshold, then the first data is set as the sampling data; and / or, If the first sampling confidence level is less than the set confidence threshold, or if the timestamp quality is less than the set quality threshold, the second data is set as the sampling data.

3. The method as described in claim 2, characterized in that, The step of setting the second data as the sampled data when the first sampling confidence level is less than the set confidence threshold, or when the timestamp quality is less than the set quality threshold, includes: If the first sampling confidence level is less than the set confidence threshold, or if the timestamp quality is less than the set quality threshold, obtain the remaining computing resources; If the remaining computing resources are less than a set resource threshold, the second data is set as the sampled data; If the remaining computing resources are greater than or equal to the set resource threshold, calculate the second sampling confidence level corresponding to the second data. The second sampling confidence level is used to characterize the sampling difference of the second data. The first weight is calculated based on the first sampling confidence level and the second sampling confidence level; The first data and the second data are weighted and calculated based on the first weight to obtain the sampled data.

4. The method according to any one of claims 1 to 3, characterized in that, The step of determining the mutation point data packet among the plurality of data packets includes: The plurality of data packets are divided into a plurality of initial intervals, the plurality of initial intervals having the same time length, and each initial interval including at least two data packets; Calculate the mean state value of the state data of at least two data packets included in each initial interval; A first interval is determined, wherein the difference between the state mean of the first interval and the state mean of the adjacent initial interval is greater than a set change threshold. Calculate the disturbance intensity corresponding to each of the at least two data packets included in the first interval, wherein the disturbance intensity is used to characterize the state change of the corresponding data packet; The data packet with the largest disturbance intensity among the at least two data packets included in the first interval is designated as the mutation point data packet.

5. The method as described in claim 4, characterized in that, The calculation of the mutation confidence corresponding to the mutation point data packet based on the structured flow graph includes: Determine multiple intermediate data packets corresponding to the mutation point data packet, and the multiple intermediate data packets and the mutation point data packet are within a set sampling window; Calculate the variance of the state data of the plurality of intermediate data packets and the mutation point data packets; Based on the structured flow graph, at least one connection edge corresponding to the mutation point data packet is determined, and the at least one connection edge is an edge in the structured flow graph that connects to the node corresponding to the mutation point data packet; Calculate the standard deviation corresponding to the at least one connecting edge, where the standard deviation is the standard deviation corresponding to the edge weight of the at least one connecting edge; The variance, the standard deviation, and the disturbance intensity of the mutation point data packet are weighted to obtain the mutation confidence level corresponding to the mutation point data packet.

6. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Based on the structured flow graph, a reverse extension path corresponding to the mutation point data packet is generated. The reverse extension path includes the mutation point data packet and multiple connection edges. The reverse extension path is a path that may send the mutation point data packet. Obtain the edge features corresponding to each of the plurality of connection edges, and the edge features are used to characterize the network behavior corresponding to the respective connection edge; Determine the data characteristics corresponding to the mutation point data packet; Calculate the first score corresponding to the reverse expansion path. The first score is a weighted sum of the similarities corresponding to the multiple connecting edges. The similarity is the similarity between the edge feature and the data feature corresponding to the connecting edge. If the first score is greater than a first set score threshold, a blocking strategy is generated, which is used to instruct the disconnection of the traffic transmission path corresponding to the reverse extension path.

7. The method as described in claim 6, characterized in that, The step of generating a blocking strategy when the first score is greater than a set score threshold includes: If the first score is greater than the first set score threshold, a second score and a third score are calculated. The second score is used to characterize whether the reverse expansion path includes a preset object, and the third score is used to characterize the timestamp change of each node in the reverse expansion path. The blocking strategy is generated when the second score is greater than the second set score threshold and the third score is greater than the third set score threshold.

8. A flow rate identification device, characterized in that, include: The sampling module is used to sample the received traffic data to obtain sampled data, which includes multiple data packets and a timestamp corresponding to each data packet in each data packet; The construction module is used to construct a structured flow graph based on the sampled data. The structured flow graph includes multiple nodes and multiple edges. The multiple nodes correspond one-to-one with the multiple data packets. Each node is used to represent the state of the data packet. Each edge is used to represent whether the data packets corresponding to two connected nodes have a continuous transmission relationship, a response relationship, or a transmission anomaly relationship. The transmission anomaly relationship is used to represent the abnormal interval of the timestamps between the two nodes. A determining module is used to determine the mutation point data packet among the plurality of data packets, wherein the data interval between the mutation point data packet and the adjacent data packet is greater than a set interval threshold, and the adjacent data packet is the data packet that is adjacent to the mutation point data packet among the plurality of data packets; The calculation module is used to calculate the mutation confidence level corresponding to the mutation point data packet based on the structured flow graph. The mutation confidence level is used to characterize the probability that the mutation point data packet is abnormal traffic. The generation module is used to generate traffic identification results corresponding to the traffic data based on the mutation confidence level.

9. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the traffic identification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the traffic identification method as described in any one of claims 1 to 7.

Images