Traffic data processing method and apparatus, nonvolatile storage medium and electronic device

Abstract

Disclosed in the present application are a traffic data processing method and apparatus, a nonvolatile storage medium and an electronic device. The method comprises: on the basis of a traffic source of traffic data, determining a target input format corresponding to the traffic data (S102); and using the target input format to input the traffic data into a target identification model, and using a target network comprised in the target identification model to process same, so as to obtain a target identification result for the traffic data, the target identification model comprising a plurality of networks, the plurality of networks respectively corresponding to predetermined input formats and being used for processing various types of traffic identification tasks, there being a sharing layer among the plurality of networks, the sharing layer being used for performing knowledge transfer across the plurality of traffic identification tasks, and the target network belonging to the plurality of networks (S104).

Description

Traffic data processing methods, apparatus, non-volatile storage media and electronic equipment

[0001] Related applications

[0002] This application claims priority to Chinese patent application filed on April 24, 2024, with application number 202410500776.3, entitled "Flow Data Processing Method, Apparatus, Non-volatile Storage Medium and Electronic Device", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of data processing, and more particularly to a method, apparatus, non-volatile storage medium, and electronic device for processing traffic data. Background Technology

[0004] As networks grow in scale and complexity, the types of cyberattacks are increasing, and enterprises face increasingly severe cybersecurity challenges. Traditional manual methods of identifying cyberattacks are no longer adequate for the new environment. Traditional cyberattack identification algorithms build independent models for different types of traffic identification tasks, failing to encompass all information about single-point traffic or the entire network traffic. This fragmented modeling approach prevents information from being transferred between different tasks, leading to information omissions and low identification efficiency of traditional cyberattack identification algorithms.

[0005] There is currently no effective solution to the above problems. Summary of the Invention

[0006] This application provides a traffic data processing method, apparatus, non-volatile storage medium, and electronic device to at least solve the technical problem of unsatisfactory traffic data processing efficiency in related technologies.

[0007] According to one aspect of the embodiments of this application, a traffic data processing method is provided, comprising: determining a target input format corresponding to the traffic data based on the traffic source of the traffic data; inputting the traffic data into a target recognition model using the target input format, and processing it by a target network included in the target recognition model to obtain a target recognition result of the traffic data, wherein the target recognition model includes multiple networks, each of which corresponds to a predetermined input format and is used to process multiple traffic recognition tasks of different types, and there is a shared layer among the multiple networks for knowledge transfer between the multiple traffic recognition tasks, and the target network belongs to the multiple networks.

[0008] In some embodiments, obtaining the target identification result of the traffic data includes: if the target input format includes an attack type of network attack, obtaining historical attack data prior to the traffic data, wherein the historical attack data belongs to an attack node included in a predetermined attack link; based on the historical attack data and the traffic data, processing is performed using the target network to determine whether the target identification result is whether the traffic data belongs to an attack node included in the predetermined attack link.

[0009] In some embodiments, the target input format includes the traffic source, destination address, and request characteristics corresponding to the traffic data, wherein the destination address represents the address of the port attacked by the traffic data. Obtaining the target identification result of the traffic data includes: if the traffic data carries an initial label indicating whether it is a network attack, processing the target network based on the traffic source, the destination address, and the request characteristics to determine whether the traffic data includes a network attack label verification result; if the label verification result does not match the initial label, updating the initial label to obtain an updated label; and obtaining the target identification result based on the updated label.

[0010] In some embodiments, determining the target input format corresponding to the traffic data based on the traffic source includes: determining the regional characteristics corresponding to the traffic source and the target risk level corresponding to the regional characteristics; and determining the target input format based on the target risk level.

[0011] In some embodiments, the target identification result includes the attack type of the network attack. After obtaining the target identification result of the traffic data, the method further includes: when there are multiple traffic data and the multiple traffic data share the traffic source, determining the destination address corresponding to each of the multiple traffic data, wherein the destination address represents the address of the port attacked by the corresponding traffic data; determining the attack behavior characteristics corresponding to the traffic source based on the destination addresses corresponding to the multiple traffic data; and determining the attack link from which the network attack originates from the traffic source based on the destination addresses and attack behavior characteristics corresponding to the multiple traffic data.

[0012] In some embodiments, determining the attack behavior characteristics corresponding to the traffic source based on the destination addresses corresponding to the plurality of traffic data includes: determining the attack time corresponding to the plurality of traffic data; determining the port permission level corresponding to the plurality of ports attacked by the corresponding traffic data according to the destination addresses corresponding to the plurality of traffic data; and determining the attack behavior characteristics based on the port permission levels corresponding to the plurality of ports and the attack time corresponding to the plurality of traffic data.

[0013] In some embodiments, the method further includes: acquiring historical traffic data and annotation information corresponding to the historical traffic data; determining the historical input format corresponding to the historical traffic data based on the annotation information corresponding to the historical traffic data; when there are multiple historical traffic data and the historical input formats corresponding to the multiple historical traffic data are different, training multiple initial networks included in the initial recognition model according to the corresponding historical input formats using the multiple historical traffic data to obtain the multiple networks, wherein the multiple initial networks correspond to different historical input formats; and obtaining the target recognition model based on the multiple networks.

[0014] According to another aspect of the embodiments of this application, a traffic data processing apparatus is provided, comprising: a format matching module, configured to determine a target input format corresponding to the traffic data based on the traffic source of the traffic data; and a data recognition module, configured to input the traffic data into a target recognition model using the target input format, and to process the traffic data by a target network included in the target recognition model to obtain a target recognition result of the traffic data, wherein the target recognition model includes multiple networks, each of which corresponds to a predetermined input format and is used to process multiple traffic recognition tasks of different types, and there is a shared layer among the multiple networks for knowledge transfer between the multiple traffic recognition tasks, and the target network belongs to the multiple networks.

[0015] According to another aspect of the embodiments of this application, a non-volatile storage medium is provided, the non-volatile storage medium storing a plurality of computer instructions, the computer instructions being executed by a processor to cause the processor to implement the traffic data processing method described in any of the foregoing embodiments.

[0016] According to another aspect of the embodiments of this application, an electronic device is provided, including: one or more processors and a memory, wherein the memory is used to store one or more computer programs, and when the one or more computer programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the traffic data processing method described in any of the foregoing embodiments.

[0017] In this embodiment, the target input format corresponding to the traffic data is determined based on the traffic source. Using the target input format, the traffic data is input into a target recognition model, and processed by a target network included in the target recognition model to obtain the target recognition result of the traffic data. The target recognition model includes multiple networks, each corresponding to a predetermined input format and used to handle different types of traffic recognition tasks. A shared layer exists between these multiple networks for knowledge transfer between the various traffic recognition tasks. The target network belongs to all of these networks. This achieves the goal of knowledge transfer and shared recognition advantages between different traffic recognition tasks, thereby improving the technical efficiency of traffic data processing and solving the technical problem of unsatisfactory traffic data processing efficiency in related technologies. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 is a flowchart of a traffic data processing method according to an embodiment of this application.

[0020] Figure 2 is a schematic diagram of the input format types of a traffic data processing method provided according to an embodiment of this application.

[0021] Figure 3 is a schematic diagram of the overall flow of a traffic data processing method provided according to an embodiment of this application.

[0022] Figure 4 is a schematic diagram of a traffic data processing device according to an embodiment of this application. Detailed Implementation

[0023] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] For ease of description, the following explains some of the nouns or terms used in the embodiments of this application:

[0026] Large language models, deep learning models trained on massive amounts of text data, can generate natural language text or understand the meaning of language text. Large language models can handle a variety of natural language tasks, such as text classification, question answering, and dialogue.

[0027] A cyberattack is an offensive action against a computer information system, infrastructure, computer network, or personal computer device. For computers and computer networks, actions such as damaging, disclosing, modifying, or disabling software or services, or accessing data on any computer without authorization, are considered attacks on computers and computer networks.

[0028] As networks grow in scale and complexity, the types of cyberattacks are also increasing, making cybersecurity challenges increasingly severe for enterprises. Faced with these increasingly frequent attacks, traditional manual methods of identifying cyberattacks are no longer adequate. Utilizing big data algorithms for cyberattack identification has become an indispensable part of enterprise cybersecurity. Traditional cyberattack identification algorithms cannot encompass all information about individual traffic points or the entire network traffic flow; their fragmented modeling methods prevent information from being transferred between different tasks. This information omission affects the efficiency of cyberattack identification algorithms.

[0029] To address the aforementioned issues, this application provides a method embodiment for processing traffic data. It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowcharts, in some cases, the steps shown or described may be executed in a different order than that presented here.

[0030] Figure 1 is a flowchart of an optional traffic data processing method according to an embodiment of this application. As shown in Figure 1, the method includes the following steps:

[0031] Step S102: Based on the traffic source of the traffic data, determine the target input format corresponding to the traffic data;

[0032] It is understandable that, based on the source of traffic data, i.e., the source IP address (Internet Protocol Address), the traffic source to a certain extent characterizes the risk level of the traffic data, which is used for traffic classification, and thus determines the target input format corresponding to the traffic data. By determining the target input format of traffic data according to its source, this process facilitates subsequent model processing of traffic data, and by matching the target input format, the format of the traffic data itself is not required, thereby improving the robustness of the model.

[0033] Step S104: Using the target input format, input the traffic data into the target recognition model, and process it by the target network included in the target recognition model to obtain the target recognition result of the traffic data. The target recognition model includes multiple networks, each corresponding to a predetermined input format, for processing different types of traffic recognition tasks. There is a shared layer between the multiple networks for knowledge transfer between multiple traffic recognition tasks. The target network belongs to multiple networks.

[0034] It is understandable that traffic data is input into the target recognition model according to the target input format. The target network in the target recognition model performs recognition processing to obtain the target recognition result of the traffic data. This target recognition model contains multiple networks, each corresponding to a specific input format and handling different types of traffic recognition tasks. There are shared layers among the multiple networks, thereby achieving the goal of sharing knowledge corresponding to different traffic recognition tasks. This realizes the technical effect of knowledge transfer between various traffic recognition tasks and improves the efficiency of traffic data processing.

[0035] In one optional embodiment, obtaining the target identification result of traffic data includes: if the target input format includes the attack type of network attack, obtaining historical attack data prior to the traffic data, wherein the historical attack data belongs to the attack nodes included in the predetermined attack link; based on the historical attack data and traffic data, processing is performed using the target network to determine whether the target identification result is whether the traffic data belongs to the attack nodes included in the predetermined attack link.

[0036] It is understandable that if the target input format includes the attack type of the network attack, it is considered that the traffic data provides or involves information about the attack type. Therefore, historical attack data of the traffic data is obtained. This historical attack data belongs to attack nodes included in a predetermined attack chain, which represents the expected attack action. Based on the historical attack data and the traffic data, the target network is processed to determine whether the traffic data belongs to an attack node included in the predetermined attack chain. Through this processing, determining whether the traffic data belongs to an attack node included in the predetermined attack chain allows for the prediction of the expected attack action of the traffic data, improving the accuracy of traffic data processing.

[0037] In some embodiments, in the above-mentioned attack link identification task, based on historical traffic information and predetermined attack links, it is determined whether the current traffic is the next link in the attack link. Furthermore, when the target input format includes the attack type of the network attack and the predetermined attack link, the attack type of the next traffic data under this predetermined attack link can be predicted based on historical traffic information, predetermined attack links, and information such as the current traffic source, target address, and attack type.

[0038] In some embodiments, the above-mentioned attack types include: SYN Flood attack (Synchronous Flood Attack), where the attacker sends a large number of forged TCP connection requests, consuming server resources and preventing it from processing requests from real users; UDP Flood attack (User Datagram Protocol Flood Attack), where the attacker sends a large number of UDP packets to the target server, exhausting bandwidth and processing power; ICMP Flood attack (Internet Control Message Protocol Flood Attack), where the attacker sends a large number of ICMP Echo requests to attack the target server; NTP (Network Time Protocol), DNS (Domain Name System), and SSDP (Simple Service Discovery Protocol) type reflection attacks: sending a large number of reflection requests to the target server to attack it; CC traffic attack (Challenge Collapsar Attack), where the attacker controls certain servers to continuously send a large number of data packets to the target server, causing server resource exhaustion; and HTTP Flood (Hypertext Transfer Protocol) attack. Flood (Hypertext Transfer Protocol flooding attack) is an attack in which an attacker simulates a large number of legitimate HTTP requests, causing server resources to be exhausted.

[0039] In one optional embodiment, the target input format includes the traffic source, destination address, and request characteristics corresponding to the traffic data. The destination address represents the address of the port attacked by the traffic data. Obtaining the target identification result of the traffic data includes: if the traffic data carries an initial label indicating whether it is a network attack, processing the traffic data using the target network based on the traffic source, destination address, and request characteristics to determine whether the traffic data includes a label verification result of a network attack; if the label verification result does not match the initial label, updating the initial label to obtain an updated label; and obtaining the target identification result based on the updated label.

[0040] It is understandable that the target input format includes the source of the traffic (e.g., the IP address of the traffic data source), the destination IP address, and the request characteristics corresponding to the traffic data. The destination IP address is the IP address of the port being attacked by the traffic data. If the traffic data carries an initial label indicating whether it is a network attack, then based on the traffic source IP address, destination IP address, and request characteristics, the target network—that is, a target network with network attack identification capabilities—is used to process the traffic data to determine whether the initial label is correct. If incorrect, the label is updated, and the correct identification result is the target identification result. Through the above processing, when the traffic data carries an initial label indicating whether it is a network attack, the appropriate target network is used to determine whether the initial label is correct based on the information in the traffic data. If incorrect, the label is updated, which avoids the problem of inaccurate initial labels, and updating the label helps improve the accuracy of identification.

[0041] In the above embodiments, given traffic data containing network traffic information, predicting whether this traffic data constitutes a network attack is a traffic identification task, which can be called a network attack identification task. A traffic identification task can also be given traffic data containing network traffic information and predicting which category of traffic it belongs to; this can be called an attack category identification task.

[0042] In the above embodiments, based on the traffic source, destination address, and request characteristics corresponding to the traffic data contained in the target input format, it is possible to predict whether the traffic data is a network attack and the attack type of the traffic data.

[0043] In one optional embodiment, determining the target input format corresponding to the traffic data based on the traffic source includes: determining the regional characteristics corresponding to the traffic source and the target risk level corresponding to the regional characteristics; and determining the target input format based on the target risk level.

[0044] It is understandable that traffic data from different sources corresponds to different risk levels. IP addresses from high-risk network attack sources should be matched with higher risk levels. Determining the target input format based on the risk level corresponding to the traffic data source can make the target recognition model more targeted during processing, making it easier for the target recognition model to determine which function to use for processing, thereby improving the efficiency of traffic data processing.

[0045] Optionally, Figure 2 is a schematic diagram of the input format types of an optional traffic data processing method provided according to an embodiment of this application. As shown in Figure 2, the target input format includes three categories: The first category is the input format (Input template) corresponding to the network attack identification task. The Input template includes the traffic source, i.e., the source IP address and its characteristics (such as risk level), the target IP address and its characteristics (such as vulnerability to attack), and the characteristics of the request. For example, the format is: Source IP_{IP address and characteristics} initiated a request_{request characteristics} to target IP_{IP address and characteristics}, whether this request is a network attack.

[0046] The second category is the input format for attack category identification tasks. The input template includes the source IP address and its characteristics (such as risk level), the target IP address and its characteristics (such as vulnerability), and the characteristics of the request. For example, the format is: Source IP_{IP address and characteristics} initiated a request_{request characteristics} to target IP_{IP address and characteristics}. If this request is an attack, what type of attack is it?

[0047] The third category is the input format for attack chain identification tasks. The input template contains a given attack chain sequence, namely, several sets of source IP addresses and their characteristics (such as risk level), target IP addresses and their characteristics (such as vulnerability), and the attack type. For example, the format is: Given an attack chain sequence, source IP_{IP address and characteristics} launches {attack type} against target IP_{IP address and characteristics}; subsequently, source IP_{IP address and characteristics} launches {attack type} against target IP_{IP address and characteristics}... What might be the next attack type under this chain?

[0048] In an optional embodiment, the target identification result includes the attack type of the network attack. After obtaining the target identification result of the traffic data, the method further includes: when there are multiple traffic data and the multiple traffic data share a traffic source, determining the destination address corresponding to each of the multiple traffic data, wherein the destination address represents the address of the port attacked by the corresponding traffic data; determining the attack behavior characteristics corresponding to the traffic source based on the destination addresses corresponding to the multiple traffic data; and determining the attack link from which the network attack originates from the traffic source based on the destination addresses and attack behavior characteristics corresponding to the multiple traffic data.

[0049] It is understandable that traffic data from one source can attack multiple ports one by one, starting from an easily attacked port. Therefore, when multiple traffic data share the same traffic source (such as traffic data coming from the same IP address), it is necessary to determine the destination address corresponding to the multiple traffic data, i.e. the address of the port attacked by the traffic data. Based on the analysis of multiple destination addresses, the attack behavior characteristics corresponding to the traffic source can be determined. Based on the destination address and attack behavior characteristics, the complete attack chain of the network attack launched by the traffic source can be identified, which helps to predict the attack behavior.

[0050] In one optional embodiment, determining the attack behavior characteristics corresponding to the traffic source based on the destination addresses corresponding to multiple traffic data includes: determining the attack time corresponding to each of the multiple traffic data; determining the port permission levels corresponding to each of the multiple ports attacked by the corresponding traffic data according to the destination addresses corresponding to each of the multiple traffic data; and determining the attack behavior characteristics based on the port permission levels corresponding to each of the multiple ports and the attack time corresponding to each of the multiple traffic data.

[0051] It is understandable that, based on the destination addresses corresponding to multiple traffic data, the port privilege levels corresponding to multiple ports attacked by traffic data can be determined. The port privilege levels corresponding to multiple ports and the attack times corresponding to multiple traffic constitute the characteristics of the attack behavior. The attack behavior has a time sequence. Therefore, generating attack behavior characteristics according to the time sequence and port level is helpful to show the attacker's intentions and make prediction easier.

[0052] In an optional embodiment, the method further includes: acquiring historical traffic data and annotation information corresponding to the historical traffic data; determining the historical input format corresponding to the historical traffic data based on the annotation information corresponding to the historical traffic data; when there are multiple historical traffic data and the historical input formats corresponding to the multiple historical traffic data are different, training multiple initial networks included in the initial recognition model according to the corresponding historical input formats using the multiple historical traffic data to obtain multiple networks, wherein the multiple initial networks correspond to different historical input formats; and obtaining a target recognition model based on the multiple networks.

[0053] It is understandable that acquiring historical traffic data and its corresponding annotations constitutes the dataset for model training. This dataset consists of training data for network attack identification tasks, attack category identification tasks, and attack link identification tasks. Using this dataset, multiple networks are trained to obtain the target identification model. Through the above processing, using the model training dataset composed of historical traffic data and its corresponding annotations to train multiple networks and thus obtain the target identification model, information sharing among multiple networks can be achieved, enabling knowledge transfer between various traffic identification tasks and improving the efficiency of traffic data processing.

[0054] In some embodiments, multiple networks share the same input layer, and the hidden layers of subsequent networks are independent to perform different tasks.

[0055] In some embodiments, the target recognition model adopts an encoder-decoder structure, with the core using a Transformer architecture. Encoder: t = ε(x) = {t1, t2, ...}, decoder: P = D(y, t), loss function: The encoder is responsible for receiving the input sequence and encoding it into a fixed-size vector (or a series of vectors). The encoded vector is often called the "context vector" or "semantic" vector, capturing the overall meaning or features of the input sequence. Specifically, the encoder receives the input x and transforms it into a "semantic" vector t, where ε represents an empty input, meaning the encoder can receive an empty sequence and generate the corresponding representation. The decoder receives the encoded vector t and the target sequence y and generates the output P. The loss function can be calculated, for example, by calculating the negative logarithm of the probability of generating each element y in the target sequence and summing the negative logarithmic probabilities of all elements to obtain the final loss value. By minimizing the loss function during training, the model generates outputs that are as similar as possible to the target sequence. The Transformer architecture is based on a self-attention mechanism, allowing the model to focus on information at different positions in the input sequence, thereby capturing long-range dependencies.

[0056] Optionally, the target input format and the target recognition result are generated using natural language processing, respectively. The target recognition model is a large language model, and the input and output of the large language model are both text-to-text. The aforementioned natural language processing (NLP) is used to communicate effectively with the model using natural language, which helps the large model understand traffic data and improves the readability of traffic data processing.

[0057] Through step S102, based on the traffic source of the traffic data, the target input format corresponding to the traffic data is determined; in step S104, the traffic data is input into the target recognition model using the target input format, and processed by the target network included in the target recognition model to obtain the target recognition result of the traffic data. The target recognition model includes multiple networks, each corresponding to a predetermined input format, used to handle different types of traffic recognition tasks. There is a shared layer among the multiple networks for knowledge transfer between various traffic recognition tasks. The target network belongs to multiple networks. This achieves the goal of knowledge transfer and sharing of recognition advantages between different traffic recognition tasks, realizing the technical effect of improving traffic data processing efficiency, and thus solving the technical problem of [keywords].

[0058] Based on the above embodiments and optional embodiments, this application proposes an optional implementation method, specifically comprising the following steps: Figure 3 is a schematic diagram of the overall flow of an optional traffic data processing method provided according to an embodiment of this application. As shown in Figure 3, historical traffic data and the corresponding annotation information are obtained. The historical traffic data includes traffic sources, such as source IP, destination addresses such as IP target, traffic time, log details, etc. The historical annotation information includes annotations by maintenance personnel indicating whether the traffic data constitutes an attack, annotations on attack types, and annotations on attack links. The historical traffic data and the corresponding annotation information are used as a dataset to train multiple initial networks included in the initial model, resulting in multiple networks. A target recognition model is then obtained based on these multiple networks.

[0059] In practical applications, traffic data can be acquired. Based on the source IP of the traffic data, the target risk level can be determined, and thus the target input format corresponding to the traffic data can be determined. The target input format includes network attack identification tasks: Source IP_{IP address and characteristics} initiated a request_{request characteristics} to target IP_{IP address and characteristics}, is this request a network attack? Attack category identification tasks: Source IP_{IP address and characteristics} initiated a request_{request characteristics} to target IP_{IP address and characteristics}, if this request is an attack, what type of attack is it? Attack chain identification tasks: Given an attack chain sequence, Source IP_{IP address and characteristics} initiates {attack type} to target IP_{IP address and characteristics}; subsequently, Source IP_{IP address and characteristics} initiates {attack type} to target IP_{IP address and characteristics}... what might be the next attack type under this chain?

[0060] Traffic data is input into the target identification model using a target input format. If the traffic data carries an initial label indicating whether it represents a network attack, the target network processes the data based on the traffic source, destination address, and request characteristics to determine if the traffic data includes a network attack label verification result. If the label verification result does not match the initial label, the initial label is updated to obtain an updated label. Based on the updated label (which can be an answer label), the target identification result is obtained. The target identification result includes the type of network attack. If the target input format includes the attack type, historical attack data prior to the traffic data is obtained. This historical attack data belongs to attack nodes included in a predetermined attack chain. Based on the historical attack data and the traffic data, the target network processes the data to determine if the target identification result is whether the traffic data belongs to an attack node included in the predetermined attack chain. A shared layer exists between multiple networks to facilitate knowledge transfer between various traffic identification tasks, improving the efficiency of traffic data processing.

[0061] The above optional implementation methods achieve at least one of the following effects: combining the following three identification modes: First, treating each traffic data point as a sample and using the relevant information of the traffic data as features to identify the traffic data. Second, treating a series of traffic data as a sequence and mining the patterns of sequence changes. Third, associating the source and destination of traffic into a graph network structure and mining the community types and attack links in the graph. This integrates all information from single-point traffic data and the entire network traffic data, realizes knowledge transfer between various traffic identification tasks, and improves the efficiency of traffic data processing.

[0062] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0063] This embodiment also provides a traffic data processing device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the terms "module" and "device" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0064] According to an embodiment of this application, an apparatus embodiment for implementing a traffic data processing method is also provided. FIG4 is a schematic diagram of a traffic data processing apparatus according to an embodiment of this application. As shown in FIG4, the traffic data processing apparatus includes a format matching module 402 and a data recognition module 404. The apparatus will be described below.

[0065] The format matching module 402 is used to determine the target input format corresponding to the traffic data based on the traffic source of the traffic data.

[0066] The data recognition module 404, connected to the format matching module 402, is used to input traffic data into the target recognition model using the target input format, and the target network included in the target recognition model processes the traffic data to obtain the target recognition result of the traffic data. The target recognition model includes multiple networks, each corresponding to a predetermined input format, and is used to handle different types of traffic recognition tasks. There is a shared layer among the multiple networks for knowledge transfer between multiple traffic recognition tasks. The target network belongs to multiple networks.

[0067] This application provides a traffic data processing device that determines the target input format of the traffic data based on its source. The traffic data is then input into a target recognition model using the target input format, and processed by a target network within the model to obtain the target recognition result. The target recognition model includes multiple networks, each corresponding to a predetermined input format, used to handle various traffic recognition tasks of different types. A shared layer exists between these networks to facilitate knowledge transfer between different traffic recognition tasks. The target network belongs to all networks. This achieves the goal of knowledge transfer and shared recognition advantages between different traffic recognition tasks, thereby improving the efficiency of traffic data processing and solving the technical problem described in [keywords]. It should be noted that the above modules can be implemented using software or hardware. For example, in the latter case, they can be implemented in the same processor or in different processors in any combination.

[0068] It should be noted that the format matching module 402 and data recognition module 404 mentioned above correspond to steps S102 to S104 in the embodiments. The instances and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should be noted that the above modules, as part of the device, can run in a computer terminal.

[0069] It should be noted that the optional or preferred implementation methods of this embodiment can be found in the relevant descriptions in the embodiments, and will not be repeated here.

[0070] The aforementioned traffic data processing device may also include a processor and a memory. The format matching module 402, the data recognition module 404, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0071] The processor contains a core that retrieves the corresponding program unit from memory. One or more cores may be configured. Memory may include non-persistent memory in computer-readable media, random access memory (RAM), and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory includes at least one memory chip.

[0072] This application provides a non-volatile storage medium storing a program that, when executed by a processor, implements a traffic data processing method.

[0073] This application provides an electronic device including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs the following steps: determining the target input format corresponding to the traffic data based on the traffic source; inputting the traffic data into a target recognition model using the target input format, and processing it by a target network included in the target recognition model to obtain the target recognition result of the traffic data. The target recognition model includes multiple networks, each corresponding to a predetermined input format, used to handle different types of traffic recognition tasks. A shared layer exists between the multiple networks for knowledge transfer between various traffic recognition tasks. The target network belongs to multiple networks. The device described herein may be a server, PC, etc.

[0074] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program with the following method steps: determining the target input format corresponding to the traffic data based on the traffic source of the traffic data; using the target input format, inputting the traffic data into a target recognition model, and processing it by a target network included in the target recognition model to obtain the target recognition result of the traffic data, wherein the target recognition model includes multiple networks, each corresponding to a predetermined input format, used to handle different types of traffic recognition tasks, and there is a shared layer among the multiple networks for knowledge transfer between multiple traffic recognition tasks, and the target network belongs to multiple networks.

[0075] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0076] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0077] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0078] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0079] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0080] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0081] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0082] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0083] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0084] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0085] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for processing traffic data, comprising: Based on the traffic source of the traffic data, determine the target input format corresponding to the traffic data; Using the target input format, the traffic data is input into the target recognition model and processed by the target network included in the target recognition model to obtain the target recognition result of the traffic data. The target recognition model includes multiple networks, each corresponding to a predetermined input format, for processing different types of traffic recognition tasks. There is a shared layer among the multiple networks for knowledge transfer between the multiple traffic recognition tasks. The target network belongs to the multiple networks.

2. The method according to claim 1, wherein obtaining the target identification result of the traffic data includes: If the target input format includes the attack type of network attack, historical attack data prior to the traffic data is obtained, wherein the historical attack data belongs to the attack nodes included in the predetermined attack chain; Based on the historical attack data and the traffic data, the target network is used for processing to determine whether the traffic data belongs to an attack node included in the predetermined attack link.

3. The method according to claim 1, wherein the target input format includes the traffic source, destination address, and request characteristics corresponding to the traffic data, wherein, The destination address represents the address of the port attacked by the traffic data, and obtaining the target identification result of the traffic data includes: If the traffic data carries an initial label indicating whether it is a network attack, the target network is used to process the traffic based on the traffic source, the destination address, and the request characteristics to determine whether the traffic data includes a network attack label verification result. If the label verification result does not match the initial label, the initial label is updated to obtain an updated label; based on the updated label, the target recognition result is obtained.

4. The method according to claim 1, wherein determining the target input format corresponding to the traffic data based on the traffic source of the traffic data includes: Determine the regional characteristics corresponding to the traffic source, and the target risk level corresponding to the regional characteristics; Based on the target risk level, the target input format is determined.

5. The method according to claim 1, wherein the target identification result includes the attack type of the network attack, and after obtaining the target identification result of the traffic data, the method further includes: When there are multiple traffic data points that share the same traffic source, the destination address corresponding to each of the multiple traffic data points is determined, wherein the destination address represents the address of the port attacked by the corresponding traffic data point. Based on the destination addresses corresponding to the multiple traffic data, the attack behavior characteristics corresponding to the traffic source are determined. Based on the destination address and attack behavior characteristics corresponding to the multiple traffic data, the attack link from which the traffic source launched the network attack is determined.

6. The method according to claim 5, wherein determining the attack behavior characteristics corresponding to the traffic source based on the destination addresses corresponding to the plurality of traffic data respectively includes: Determine the attack time corresponding to each of the multiple traffic data; Based on the destination addresses corresponding to the multiple traffic data, determine the port access levels corresponding to the multiple ports attacked by the corresponding traffic data. Based on the port permission levels corresponding to the multiple ports and the attack times corresponding to the multiple traffic data, the characteristics of the attack behavior are determined.

7. The method according to any one of claims 1 to 6, further comprising: Obtain historical traffic data and the corresponding annotation information for the historical traffic data; Based on the annotation information corresponding to the historical traffic data, the historical input format corresponding to the historical traffic data is determined; When there are multiple historical traffic data points, and each of the multiple historical traffic data points corresponds to a different historical input format, the multiple initial networks included in the initial recognition model are trained according to the corresponding historical input format using the multiple historical traffic data points to obtain the multiple networks, wherein each of the multiple initial networks corresponds to a different historical input format; The target recognition model is obtained based on the multiple networks.

8. A traffic data processing device, comprising: The format matching module is used to determine the target input format corresponding to the traffic data based on the traffic source of the traffic data; The data recognition module is used to input the traffic data into the target recognition model using the target input format, and to process the traffic data by the target network included in the target recognition model to obtain the target recognition result of the traffic data. The target recognition model includes multiple networks, each corresponding to a predetermined input format, for processing different types of traffic recognition tasks. There is a shared layer among the multiple networks for knowledge transfer between the multiple traffic recognition tasks. The target network belongs to the multiple networks.

9. A non-volatile storage medium storing a plurality of computer instructions, wherein the plurality of computer instructions, when executed by a processor, cause the processor to implement the traffic data processing method according to any one of claims 1 to 7.

10. An electronic device, comprising: One or more processors and a memory, the one or more memory being used to store one or more computer programs, wherein when the one or more computer programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the traffic data processing method according to any one of claims 1 to 7.

Images