Electronic device and method for detecting abnormal network traffic of application thereof

Abstract

The disclosure provides a method for detecting abnormal network traffic of application thereof. The method includes the following steps. Mobile network traffic data of a plurality of mobile electronic devices is received. The mobile network traffic data of each mobile electronic device includes application network traffic of an application. A statistical analysis processing is performed on the application network traffic of the mobile electronic devices for the application, to obtain an average traffic per unit time of associated with a target unit period for the application. Whether the average traffic per unit time of the target unit period meets a traffic abnormality condition is determined. When the average traffic per unit time of the target unit period meets the traffic abnormal condition, a traffic abnormal version of the application is identified based on the average traffic per unit time of the target unit period.

Description

[Technical Field]

[0001] This disclosure relates to a method for detecting abnormal network traffic in an electronic device and its application. [Previous Technology]

[0002] The purpose of detecting mobile network traffic of applications is to help users understand the data usage of applications on mobile networks, and to avoid additional charges due to abnormal traffic increases. As application functions are constantly updated and become more complex, network traffic consumption may not only come from user operations, but may also stem from implicit behaviors executed in the background of the application or program problems.

[0003] Currently, the main method for detecting mobile network traffic in applications is to accumulate the overall traffic of the application and allow users to set a traffic limit. When the traffic exceeds the limit, the system notifies the user. However, this method cannot accurately determine the root cause of abnormal traffic; that is, the current method cannot distinguish whether the increase in traffic is caused by user behavior or application operation. In addition, relying solely on data analysis of individual cases lacks the reference of historical big data, making it difficult to accurately determine whether it is abnormal. In other words, current application traffic monitoring methods cannot identify the root cause of abnormal traffic, and therefore cannot provide users with clear judgment criteria and effective reminders. [Summary of the Invention]

[0004] This disclosure provides a method for detecting abnormal network traffic of an application, applicable to electronic devices, and includes the following steps: Receiving mobile network traffic data from multiple mobile electronic devices. The mobile network traffic data from each mobile electronic device includes application network traffic of an application. Performing statistical analysis on the application network traffic of the multiple mobile electronic devices for the application to obtain the average unit-time traffic of the application associated with a target unit-time period. Determining whether the average unit-time traffic of the target unit-time period meets the abnormal traffic conditions. When the average unit-time traffic of the target unit-time period meets the abnormal traffic conditions, identifying the abnormal version of the application based on the average unit-time traffic of the target unit-time period.

[0005] This disclosure also provides an electronic device including a storage device and a processor. The processor is coupled to the storage device and configured to perform the following steps: Receiving mobile network traffic data from a plurality of mobile electronic devices. The mobile network traffic data from each mobile electronic device includes application network traffic of an application. Performing statistical analysis processing on the application network traffic of the plurality of mobile electronic devices for the application to obtain a unit-time average traffic value associated with the application within a target unit-time period. Determining whether the unit-time average traffic value within the target unit-time period meets traffic anomaly conditions. When the unit-time average traffic value within the target unit-time period meets the traffic anomaly conditions, identifying a traffic anomaly version of the application based on the unit-time average traffic value within the target unit-time period.

[0006] Based on the above, in this disclosed embodiment, after collecting application network traffic from multiple mobile electronic devices, statistical analysis can be performed on the application network traffic generated by multiple mobile electronic devices running an application to obtain the average traffic per unit time of the application. Therefore, based on the average traffic per unit time obtained through big data analysis of the application network traffic of multiple mobile electronic devices, abnormal traffic events of the application can be detected and abnormal versions of the application can be obtained. Based on this, an objective and reasonable traffic reference can be obtained for the application, so as to more accurately determine whether the abnormal network traffic of the mobile electronic device is caused by the application.

Implementation Method

[0007] Some embodiments of the present invention will now be described in detail with reference to the accompanying drawings. Component symbols used in the following description are considered the same or similar components when they appear in different drawings. These embodiments are only a part of the present invention and do not disclose all possible implementations of the invention. More precisely, these embodiments are merely examples of the apparatus and methods within the scope of the present invention's patent application.

[0008] Please refer to Figure 1, which is a block diagram illustrating an application traffic anomaly detection system according to an embodiment of the present invention. The application traffic anomaly detection system includes an electronic device 110 and multiple mobile electronic devices 120_1 to 120_N. In some embodiments, the mobile electronic devices 120_1 to 120_N can be connected to the electronic device 110 via a network. The mobile electronic devices 120_1 to 120_N are communication devices using mobile communication networks, such as mobile phones or tablet computers. The mobile communication network is, for example, a 4G network, a 5G network, or a future generation mobile communication network.

[0009] Mobile electronic devices 120_1 to 120_N can interact with the mobile network through various applications (APPs) and record mobile network traffic data accordingly. In other words, the mobile network traffic data is recorded data generated based on the interaction between mobile electronic devices 120_1 to 120_N and the mobile network. The mobile network traffic data of mobile electronic devices 120_1 to 120_N may include application network traffic from one or more applications. Mobile electronic devices 120_1 to 120_N can each provide their own mobile network traffic data to electronic device 110, enabling electronic device 110 to perform big data analysis on the application network traffic of multiple mobile electronic devices 120_1 to 120_N.

[0010] Electronic device 110 may be, for example, a laptop, desktop computer, server, or workstation, or other computing device with computing capabilities; this disclosure is not limited thereto. In some embodiments, electronic device 110 may receive mobile network traffic data from mobile electronic devices 120_1 to 120_N respectively via a network. Electronic device 110 may include storage device 111, transceiver 112, and processor 113.

[0011] Storage device 111 can be used to store data and software modules, etc., and can be, for example, any type of fixed or removable random access memory (RAM), read-only memory (ROM), flash memory or other similar devices, integrated circuits or combinations thereof.

[0012] Transceiver 112 transmits and receives data wirelessly or via a wired connection. Transceiver 112 can also perform operations such as low-noise amplification, impedance matching, mixing, up- or down-frequency conversion, filtering, amplification, and similar operations. Transceiver 112 can be used to receive data provided by mobile electronic devices 120_1 to 120_N and transmit data to mobile electronic devices 120_1 to 120_N.

[0013] The processor 113 is coupled to the storage device 111, such as a general-purpose processor, a special-purpose processor, a conventional processor, a digital signal processor, a microprocessor, one or more microprocessors incorporating a digital signal processor core, a controller, a microcontroller, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), any other type of integrated circuit, state machine, or other similar device.

[0014] The processor 113 can access and execute software modules recorded in the storage device 111 to implement the abnormal network traffic detection method of the application program in this embodiment of the invention. The above-mentioned software modules can be broadly interpreted as instructions, instruction sets, code, program code, program, software suite, thread, program, function, etc., regardless of whether they are called software, firmware, middleware, microcode, hardware description language or others.

[0015] Figure 2 is a flowchart illustrating an abnormal network traffic detection method for an application program according to an embodiment of the present invention. Referring to Figures 1 and 2, the method of this embodiment is applicable to the electronic device 110 in the above embodiments. The following describes the detailed steps of the abnormal network traffic detection method for an application program in this embodiment with reference to the various components in the electronic device 110.

[0016] In step S210, the processor 113 receives mobile network traffic data from multiple mobile electronic devices 120_1 to 120_N. The mobile network traffic data for each mobile electronic device 120_1 to 120_N includes application network traffic for an application. The application network traffic may include the application's uplink and downlink data volume per unit time (in KB or MB). For example, the mobile network traffic data for each mobile electronic device 120_1 to 120_N includes the daily application network traffic for each application.

[0017] In some embodiments, application network traffic is background mobile network traffic. Specifically, background mobile network traffic is data exchange automatically generated by the application while it is running in the background, such as version updates, push notifications, and data synchronization automatically performed by the application. Therefore, since the processor 113 detects application traffic anomalies based on the background mobile network traffic of each mobile electronic device 120_1 to 120_N for a particular application, interference caused by background network traffic generated by user operations can be eliminated. This allows for more accurate identification of whether an application is engaging in abnormal traffic behavior in the background.

[0018] In step S220, the processor 113 performs statistical analysis on the network traffic of the applications of multiple mobile electronic devices 120_1 to 120_N for the application, in order to obtain the average unit-time traffic of the application associated with the target unit time period. That is, based on the application network traffic provided by the multiple mobile electronic devices 120_1 to 120_N for each unit time period, the processor 113 can calculate the average unit-time traffic for each application for each unit time period (e.g., daily, but not limited to this).

[0019] For example, mobile electronic devices 120_1 to 120_N can respectively provide the network traffic of a certain application on a certain day of a certain month to electronic device 110. Electronic device 110 can perform an average calculation on the N application network traffic provided by the N mobile electronic devices 120_1 to 120_N on a certain day of a certain month to obtain the average traffic per unit time of the application on that day of a certain month. In other words, the average traffic per unit time of the target unit period is generated by statistically averaging the application network traffic provided by multiple mobile electronic devices 120_1 to 120_N.

[0020] In step S230, the processor 113 determines whether the average traffic per unit time of the target unit time period meets the traffic anomaly condition. In some embodiments, the processor 113 may compare the average traffic per unit time of the target unit time period with the average traffic over a long period to determine whether the average traffic per unit time of the target unit time period meets the traffic anomaly condition. The aforementioned average traffic over a long period can be determined by statistically analyzing the application network traffic of mobile electronic devices 120_1 to 120_N over a long period of time. In addition, in some embodiments, the processor 113 may determine whether the average traffic per unit time of the target unit time period shows an upward trend compared with the average traffic per unit time of multiple historical unit time periods to determine whether the average traffic per unit time of the target unit time period meets the traffic anomaly condition.

[0021] In step S240, when the average traffic per unit time of the target unit period meets the traffic anomaly condition, the processor 113 identifies the traffic anomaly version of the application based on the average traffic per unit time of the target unit period. Specifically, the processor 113 can analyze the differences in background traffic behavior of different versions of the application to identify the traffic anomaly version that may cause the traffic anomaly. Thus, the cause of the traffic anomaly can be located more accurately, and more effective improvement measures can be proposed accordingly.

[0022] Figure 3 is a flowchart illustrating an abnormal network traffic detection method for an application program according to an embodiment of the present invention. Referring to Figures 1 and 3, the method of this embodiment is applicable to the electronic device 110 in the above embodiments. The following describes the detailed steps of the abnormal network traffic detection method for an application program in this embodiment with reference to the various components in the electronic device 110.

[0023] In step S310, the processor 113 receives mobile network traffic data from multiple mobile electronic devices 120_1 to 120_N. The mobile network traffic data from each mobile electronic device 120_1 to 120_N includes application network traffic for an application. In step S320, the processor 113 performs statistical analysis processing on the application network traffic of the multiple mobile electronic devices 120_1 to 120_N for the application to obtain the average unit-time traffic of the application associated with a target unit time period. The description of the above steps can be found in the description of the foregoing embodiments, and will not be repeated here.

[0024] In step S330, the processor 113 determines whether the average flow rate per unit time period of the target unit time period meets the abnormal flow conditions. In some embodiments, step S330 may be implemented as steps S331 to S334.

[0025] In step S331, the processor 113 can perform statistical analysis on the network traffic of multiple mobile electronic devices 120_1 to 120_N for the application to obtain a long-term average traffic value associated with the application over multiple historical time periods. Specifically, the processor 113 can statistically analyze the network traffic of multiple mobile electronic devices 120_1 to 120_N over the past several tens of days (e.g., the past 50 days, i.e., multiple historical time periods) to obtain a long-term average traffic value for the application. The long-term average traffic value can be considered as a normal traffic value under normal circumstances.

[0026] In step S332, the processor 113 can determine whether the average flow rate per unit time is greater than a threshold value determined based on the average flow rate over a long period. Specifically, the processor 113 can determine a threshold value based on the average flow rate over a long period of multiple historical time periods, and determine whether there is an anomaly in the average flow rate per unit time of the target time period based on this threshold value.

[0027] In some embodiments, the processor 113 can calculate standard deviation data based on the application network traffic of multiple mobile electronic devices 120_1 to 120_N over multiple historical time periods. Then, the processor 113 determines a threshold value based on the standard deviation data and the long-term traffic average. Specifically, the processor 113 can statistically analyze the application network traffic of multiple mobile electronic devices 120_1 to 120_N over multiple historical time periods to obtain a long-term traffic average and a standard deviation. Afterwards, the processor 113 can determine the threshold value based on the long-term traffic average and the corresponding standard deviation through table lookup or function calculation.

[0028] For example, processor 113 may determine the threshold value according to the following formula (1). Formula (1) Where m3d_threshold represents the threshold value; represents the long-term average traffic value; represents the standard deviation. Processor 113 will determine whether the average traffic value per unit time today is greater than m3d_threshold.

[0029] For example, please refer to FIG4, which is a schematic diagram illustrating the average unit-time traffic of an application over multiple unit time periods according to an embodiment of the present invention. By statistically analyzing the daily network traffic of the application on multiple mobile electronic devices 120_1 to 120_N, the processor 113 can obtain the daily average unit-time traffic of an application. In addition, the processor 113 can calculate the long-term average traffic and standard deviation data of multiple sample data for multiple historical unit time periods (i.e., January 6 to February 4). The processor 113 can determine whether the average unit-time traffic "A1" for the target unit time period (i.e., February 5) is greater than the long-term average traffic of multiple historical unit time periods plus 3 times the standard deviation.

[0030] If step S332 is satisfied, proceed to step S333. In step S333, processor 113 obtains the rate of increase of the moving average of the application's average traffic based on the application's average traffic per unit time over multiple consecutive time periods. The multiple consecutive time periods include the target time period. In step S334, processor 113 determines whether the rate of increase of the moving average of the average traffic is greater than a threshold value. That is, processor 113 will determine whether the application's average traffic per unit time over multiple consecutive time periods shows an upward trend. The threshold value can be set according to actual conditions, and this disclosure does not limit it.

[0031] For example, please refer to FIG5, which is a schematic diagram illustrating the calculation of the average traffic moving average according to an embodiment of the present invention. By statistically analyzing the daily application network traffic of multiple mobile electronic devices 120_1 to 120_N, the processor 113 can obtain the daily average traffic per unit time of an application. The processor 113 can calculate an average traffic moving average M1 based on three average traffic per unit time data from February 3 to February 5. The processor 113 can calculate an average traffic moving average M2 based on three average traffic per unit time data from February 2 to February 4. The processor 113 can calculate the rate of increase of the average traffic moving average by subtracting the average traffic moving average M2 from the average traffic moving average M1. For example, the processor 113 can determine the rate of increase of the average traffic moving average according to the following formula (2). Formula (2)

[0032] In the embodiment of Figure 3, when the average flow rate per unit time of the target unit time period is greater than a threshold value determined based on the long-term flow rate average value, and the rate of increase of the moving average of the average flow rate is greater than the rising threshold value, the average flow rate per unit time of the target unit time period meets the flow anomaly condition. That is, when the average flow rate per unit time of the target unit time period is greater than the threshold value, and the average flow rate per unit time of multiple consecutive unit time periods shows an upward trend, the processor 113 can determine that the average flow rate per unit time of the target unit time period meets the flow anomaly condition and mark the target unit time period as an abnormal period. In some embodiments, the processor 113 can determine the long-term flow rate average value and its corresponding threshold value after excluding the flow data of the above-mentioned abnormal period.

[0033] Subsequently, in step S340, when the average unit-time traffic of the target unit time period meets the traffic anomaly condition, the processor 113 identifies the traffic anomaly version of the application based on the average unit-time traffic of the target unit time period. Specifically, when the processor 113 determines that a traffic anomaly event has occurred in the application, the processor 113 can identify the traffic anomaly version from these application versions based on the average unit-time traffic of all application versions and the average unit-time traffic of each different version.

[0034] In step S350, based on the abnormal traffic version of the application, the processor 113 sends a traffic warning notification to at least one of the multiple mobile electronic devices 120_1 to 120_N via transceiver 112. In some embodiments, the processor 113 may send a traffic warning notification to the multiple mobile electronic devices 120_1 to 120_N to notify them that the abnormal traffic version of the application has an abnormal traffic situation. Therefore, when the mobile electronic devices 120_1 to 120_N need to update to the abnormal traffic version or have already installed the abnormal traffic version of the application, the mobile electronic devices 120_1 to 120_N can execute corresponding traffic control policies. For example, the mobile electronic devices 120_1 to 120_N may prompt the user that the currently installed version has an abnormal network traffic situation, or perform a traffic restriction operation on the abnormal traffic version of the application. The aforementioned traffic restriction operations can include preventing applications from running in the background, limiting the maximum network traffic that an application can transmit per day, or restricting applications from starting automatically.

[0035] Please refer to Figure 6, which is a flowchart illustrating the identification of abnormal traffic versions according to an embodiment of the present invention. In some embodiments, the multiple application versions of an application include a first version and multiple second versions. Specifically, the first version is any one of the multiple application versions, while the multiple second versions are the others among the multiple application versions.

[0036] In step S341, the processor 113 obtains the first average traffic value of multiple second versions of the application within the target time period. That is, the processor 113 can calculate the first average traffic value without taking into account the network traffic of the first version of the application. On the other hand, the average traffic value per unit time for the target time period is based on the statistical results of all multiple application versions.

[0037] In some embodiments, the processor 113 may determine whether the first version is a traffic aberration version based on the difference between the average unit-time traffic associated with multiple application versions and the first average traffic not associated with the first version.

[0038] In step S342, the processor 113 obtains the impact ratio of the first version of the application in the target unit time period based on the difference between the average traffic per unit time and the first average traffic.

[0039] For example, the processor 113 may determine the impact ratio according to the following formula (3). Formula (3) Where, represents an impact ratio of the first version in the target unit time period; represents the average unit time traffic of all multiple application versions in the target unit time period; represents the first average traffic of the target unit time period calculated after excluding the data of the first version.

[0040] In step S343, when the impact ratio of the first version is greater than zero, the processor 113 adds the first version to an abnormal version list. Specifically, based on the network traffic reported by mobile electronic devices 120_1 to 120_N corresponding to different application versions, the processor 113 can obtain the average unit-time traffic for all versions and the average first-time traffic excluding a certain version. Based on the average unit-time traffic for all versions and the average first-time traffic excluding a certain version, the processor 113 can analyze the degree of influence of the excluded version on abnormal traffic, thereby determining whether the excluded version is a traffic abnormal version. When the impact ratio is positive, it means that the traffic of the excluded version (i.e., the first version) is relatively high, therefore the first version is added to an abnormal version list.

[0041] In step S344, when the first version is added to the abnormal version list, the processor 113 obtains the second average traffic of the first version of the application within a target time period. For example, please refer to FIG7, which is a schematic diagram illustrating the average traffic of multiple application versions according to an embodiment of the present invention. Suppose that an application has released a total of 4 application versions since its launch, and these mobile electronic devices 120_1 to 120_N may have different versions of the application installed. Based on the current version and corresponding application network traffic reported by each mobile electronic device 120_1 to 120_N, the processor 113 can obtain the second average traffic of each version. For example, the processor 113 can calculate the second average traffic of "Version 4" on MM month DD day as "A71".

[0042] In step S345, the processor 113 performs a Z-test on the second average traffic flow of the first version to obtain the Z value of the first version. Taking Figure 7 as an example, the processor 113 can perform a Z-test on the second average traffic flow of "Version 4" on MM month DD day as "A71" to calculate the corresponding Z value. In detail, since the number of different versions installed in all mobile electronic devices 120_1 to 120_N is different, when determining whether a certain version is a version with abnormal traffic flow, the processor 113 can perform a statistical test (Z-test) on the average traffic flow per unit time of that version. This test can effectively determine whether the average traffic flow of the version significantly exceeds the expected normal range. In some embodiments, the above-mentioned Z-test is performed, for example, based on three times the standard deviation of all samples of all versions.

[0043] In step S346, the processor 113 determines whether the first version is a traffic-abnormal version based on the impact ratio and Z-value of the first version. Specifically, in some embodiments, the processor 113 can obtain the impact ratio and Z-value of each version in the abnormal version list and sort them according to the impact ratio and Z-value of each version. Then, the processor 113 can identify the traffic-abnormal version according to the sorting ranking of each version in the abnormal version list.

[0044] In summary, in this embodiment of the invention, after collecting application network traffic from multiple mobile electronic devices, statistical analysis can be performed on the application network traffic of multiple mobile electronic devices operating an application to obtain the average traffic per unit time of the application. Therefore, based on the average traffic per unit time obtained through big data analysis of the application network traffic of multiple mobile electronic devices, abnormal traffic events of the application can be detected and abnormal versions of the application can be obtained. Based on this, an objective and reasonable traffic reference can be obtained for the application, so as to more accurately determine whether the abnormal network traffic of the mobile electronic device is caused by the application.

[0045] Although the present invention has been disclosed above by way of embodiments, it is not intended to limit the present invention. Anyone skilled in the art can make some modifications and refinements without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims. [Simplified Explanation of the Diagram]

[0046] Figure 1 is a block diagram illustrating an application traffic anomaly detection system according to an embodiment of the present invention. Figure 2 is a flowchart illustrating an application anomaly network traffic detection method according to an embodiment of the present invention. Figure 3 is a flowchart illustrating an application anomaly network traffic detection method according to an embodiment of the present invention. Figure 4 is a schematic diagram illustrating the unit-time average traffic of an application over multiple unit time periods according to an embodiment of the present invention. Figure 5 is a schematic diagram illustrating the calculation of average traffic moving average according to an embodiment of the present invention. Figure 6 is a flowchart illustrating the identification of anomaly traffic versions according to an embodiment of the present invention. Figure 7 is a schematic diagram illustrating the average traffic of multiple application versions according to an embodiment of the present invention.

Claims

1. A method for detecting abnormal network traffic in an application, applicable to an electronic device, comprising: The system receives mobile network traffic data from multiple mobile electronic devices, wherein the mobile network traffic data from each of the multiple mobile electronic devices includes application network traffic of an application; performs statistical analysis processing on the application network traffic of the multiple mobile electronic devices for the application to obtain the average traffic per unit time period associated with the application; determines whether the average traffic per unit time period of the target unit time period meets the traffic anomaly conditions; and when the average traffic per unit time period of the target unit time period meets the traffic anomaly conditions, identifies a traffic anomaly version of the application based on the average traffic per unit time period of the target unit time period.

2. The method for detecting abnormal network traffic of an application as described in claim 1, wherein the application network traffic is background mobile network traffic.

3. The method for detecting abnormal network traffic in an application as described in claim 1, wherein the step of determining whether the average traffic per unit time period of the target unit time period meets the abnormal traffic condition includes: The statistical analysis process is performed on the network traffic of the application on the multiple mobile electronic devices to obtain a long-term average traffic value associated with the application over multiple historical time periods; and it is determined whether the average traffic value per unit time is greater than a threshold value determined based on the long-term average traffic value.

4. The method for detecting abnormal network traffic in an application as described in claim 3, wherein the step of determining whether the average traffic per unit time period of the target unit time period meets the abnormal traffic condition further includes: Standard deviation data is calculated based on the application network traffic of the multiple mobile electronic devices in the multiple historical time periods; And the threshold value is determined based on the standard deviation data and the long-term average flow rate.

5. The method for detecting abnormal network traffic in an application as described in claim 3, wherein the step of determining whether the average traffic per unit time period of the target unit time period meets the abnormal traffic condition further includes: Based on the average traffic of the application over multiple consecutive time periods, the rising rate of the moving average of the average traffic is obtained; and it is determined whether the rising rate of the moving average of the average traffic is greater than a rising threshold value.

6. The method for detecting abnormal network traffic in an application as described in claim 5, wherein the average traffic per unit time period of the target unit time period satisfies the abnormal traffic condition when the average traffic per unit time period is greater than the threshold value determined based on the average traffic per long time period, and the rate of increase of the average traffic moving average is greater than the rate of increase threshold value.

7. The method for detecting abnormal network traffic of an application as described in claim 1, wherein the multiple application versions of the application include a first version and multiple second versions, and when the average traffic per unit time period of the target unit time period meets the abnormal traffic condition, the step of identifying the abnormal traffic version of the application based on the average traffic per unit time period of the target unit time period includes: Obtain the first average traffic of the plurality of second versions of the application in the target unit time period, wherein the average traffic per unit time period is based on statistical results of the plurality of application versions; And based on the difference between the average traffic per unit time associated with the plurality of application versions and the first average traffic not associated with the first version, determine whether the first version is the version with abnormal traffic.

8. The method for detecting abnormal network traffic of an application as described in claim 7, wherein the step of determining whether the first version is the abnormal traffic version based on the difference between the average traffic per unit time associated with the plurality of application versions and the first average traffic not associated with the first version includes: Based on the difference between the average traffic per unit time and the first average traffic, obtain an impact ratio of the first version of the application in the target unit time period; And when the impact ratio of the first version is greater than zero, the first version is added to an abnormal version list.

9. The method for detecting abnormal network traffic of an application as described in claim 8, wherein the step of determining whether the first version is the version with abnormal traffic based on the difference between the average traffic per unit time associated with the plurality of application versions and the first average traffic not associated with the first version further includes: When the first version is added to the abnormal version list, the second average traffic of the first version of the application in the target unit time period is obtained; The Z-test is performed on the second average flow rate of the first version to obtain the Z value of the first version; And based on the impact ratio of the first version and the Z value, determine whether the first version is the abnormal traffic version.

10. The method for detecting abnormal network traffic of an application as described in claim 1, the method further comprising: Based on the abnormal traffic version of the application, a traffic alert notification is sent to at least one of the plurality of mobile electronic devices.

11. An electronic device comprising: A storage device; A processor, coupled to the storage device and configured to: receive mobile network traffic data from a plurality of mobile electronic devices, wherein the mobile network traffic data from each of the plurality of mobile electronic devices includes application network traffic of an application; perform a statistical analysis on the application network traffic of the plurality of mobile electronic devices for the application to obtain a unit-time average traffic value of the application associated with a target unit-time period; determine whether the unit-time average traffic value of the target unit-time period meets a traffic anomaly condition; and when the unit-time average traffic value of the target unit-time period meets the traffic anomaly condition, identify a traffic anomaly version of the application based on the unit-time average traffic value of the target unit-time period.

Images