Anomaly detection method and apparatus, and computing device cluster

Abstract

The present application provides an anomaly detection method and apparatus, and a computing device cluster. The method is applied to a network protection device for screening network traffic on the basis of at least two screening rules. The at least two screening rules include a first screening rule and a second screening rule. The method comprises: receiving a target packet comprising a first element and a second element, the target packet being any one of N (a positive integer greater than or equal to 1) packets comprised in the network traffic; determining whether the target packet satisfies the first screening rule (used for screening on the basis of the frequency of occurrence of the first element); when the target packet satisfies the first screening rule, determining whether the target packet satisfies the second screening rule (used for screening on the basis of the frequency of occurrence of the second element); and when the target packet satisfies the second screening rule, performing anomaly detection on the basis of the target packet. By performing anomaly detection on the basis of traffic that has undergone multi-level screening, resource consumption is reduced, and user experience is improved.

Description

Anomaly detection method, device and computing device cluster

[0001] The present application claims priority from the Chinese patent application No. 202411362389.4, filed on September 27, 2024, and entitled "Anomaly detection method, device and computing device cluster", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of cloud computing, in particular to an anomaly detection method, device and computing device cluster. BACKGROUND

[0003] At present, distributed denial of service attack (DDoS) attacks based on transport layer security (TLS) encrypted data streams (hereinafter referred to as TLS data streams) on servers are becoming more and more frequent. In order to ensure the normal operation of the server, a security protection device (for example, a firewall) is needed to filter the TLS data stream sent to the server, that is, the security protection device detects whether the TLS data stream is attack traffic.

[0004] At present, the security protection device needs to record the information of the traffic in order to facilitate subsequent analysis, but when the recorded information occupies a large amount of storage resources, it may affect the processing of subsequent traffic and affect the user experience. SUMMARY

[0005] The embodiments of the present application provide an anomaly detection method, device and computing device cluster, which reduces the number of messages for anomaly judgment through multi-level screening, thereby reducing the occupation of storage resources, reducing the impact on subsequent messages and improving user experience.

[0006] In a first aspect, the embodiments of the present application provide an anomaly detection method, which is applied to a network protection device. The network protection device is used to screen messages included in network traffic according to at least two screening rules, and the at least two screening rules include a first screening rule and a second screening rule. The method comprises the following steps:

[0007] The network traffic includes a target packet, the target packet is any one of N packets included in the network traffic, N is a positive integer greater than or equal to 1, and the target packet includes a first element and a second element; it is determined whether the target packet meets a first screening rule, wherein the first screening rule is used for screening according to the occurrence frequency of the first element; in the case that the target packet meets the first screening rule, it is determined whether the target packet meets a second screening rule, wherein the second screening rule is used for screening according to the occurrence frequency of the second element; in the case that the target packet meets the second screening rule, an anomaly detection is performed based on the target packet.

[0008] In the scheme, the number of packets for anomaly judgment is reduced through multi-stage screening, thereby reducing the occupation of storage resources, reducing the influence on subsequent packets, and improving user experience.

[0009] In a possible implementation, the first element or the second element includes at least one of the following: at least one element in a five-tuple, a routing hop number, a packet length, a service level, and a network protocol.

[0010] In a possible implementation, the first element and the second element are different.

[0011] In a possible implementation, the method further includes: determining the memory occupation of the network protection device; and updating at least one of the at least two screening rules when the memory occupation exceeds a first threshold.

[0012] In the scheme, the screening rules are constantly adjusted through the memory occupation, thereby reducing the memory occupation.

[0013] In a possible implementation, the first screening rule is used for screening based on a first hash function, and the method further includes: mapping the first element to a first variable in a first count array based on the first hash function; and determining the occurrence frequency of the first element based on the mapping times of the first variable in the first count array.

[0014] The second screening rule is used for screening based on a second hash function, and the method further includes: mapping a second variable value to a second variable in a second count array based on the second hash function; and determining the occurrence frequency of the second element based on the mapping times of the second variable in the second count array.

[0015] In a possible implementation, the collision rate of the first hash function is less than the collision rate of the second hash function.

[0016] In the scheme, the collision rate of the first hash function can be less than the collision rate of the second hash function, so that the second hash function is more accurate, and the accuracy of the occurrence frequency statistics of the packet is improved.

[0017] In a possible implementation, determining whether the target packet satisfies the first screening rule comprises:

[0018] In a case where the occurrence frequency of the first element is greater than or equal to the second threshold, it is determined that the target packet satisfies the first screening rule.

[0019] In a possible implementation, determining whether the target packet satisfies the second screening rule comprises:

[0020] In a case where the occurrence frequency of the second element is greater than or equal to the third threshold, it is determined that the target packet satisfies the second screening rule.

[0021] In a possible implementation, performing anomaly detection based on the target packet comprises: performing anomaly detection on a session including the target packet based on the target packet.

[0022] In this scheme, considering that recording the related information of the packets included in the sessions with more records will occupy a large amount of memory resources, a smaller number of packets are screened out through multi-level screening, the related information of the packets included in the sessions that need to be recorded is reduced, and the memory occupation is reduced. In a possible implementation, the number of packets screened out by the first screening rule is greater than the number of packets screened out by the second screening rule.

[0023] In this scheme, the screening range of the first screening rule is greater than the screening range of the second screening rule, which can reduce the screened traffic, so as to perform anomaly detection through less traffic, and further reduce the resource consumption required for analyzing less traffic.

[0024] In a second aspect, an anomaly detection apparatus is provided, which comprises a plurality of modules, each module being configured to perform each step of the anomaly detection method provided in the first aspect of the embodiments of the present application. The division of the modules is not limited herein. The specific functions performed by each module of the anomaly detection apparatus and the beneficial effects achieved are for reference to the functions of each step of the anomaly detection method provided in the first aspect of the embodiments of the present application, which will not be described herein again.

[0025] For example, the anomaly detection apparatus is applied to a network protection device, and the network protection device is configured to screen packets included in network traffic according to at least two screening rules, the at least two screening rules comprising a first screening rule and a second screening rule, and the anomaly detection apparatus comprises:

[0026] The receiving module is configured to receive a target packet included in the network traffic, the target packet being any one of N packets included in the network traffic, wherein N is a positive integer greater than or equal to 1, and the target packet comprises a first element and a second element.

[0027] The first screening module is configured to determine whether the target packet meets a first screening rule, wherein the first screening rule is configured to screen according to a frequency of occurrence of a first element.

[0028] The second screening module is configured to determine whether the target packet meets a second screening rule in a case where the target packet meets the first screening rule, wherein the second screening rule is configured to screen according to a frequency of occurrence of a second element.

[0029] The anomaly detection module is configured to perform anomaly detection based on the target packet in a case where the target packet meets the second screening rule.

[0030] In a possible implementation, the first element or the second element includes at least one of the following: at least one element in a five-tuple, a routing hop count, a packet length, a service level, and a network protocol.

[0031] In a possible implementation, the first element and the second element are different.

[0032] In a possible implementation, the apparatus further includes:

[0033] The updating module is configured to determine a memory occupation of the network protection device, and update at least one of the at least two screening rules when the memory occupation exceeds a first threshold.

[0034] In a possible implementation, the first screening rule is configured to screen based on a first hash function, and the first screening module is further configured to map the first element to a first variable in a first counting array based on the first hash function, and determine the frequency of occurrence of the first element based on a mapping frequency of the first variable in the first counting array.

[0035] The second screening rule is configured to screen based on a second hash function, and the second screening module is further configured to map the second variable value to a second variable in a second counting array based on the second hash function, and determine the frequency of occurrence of the second element based on a mapping frequency of the second variable in the second counting array.

[0036] In a possible implementation, a collision rate of the first hash function is less than a collision rate of the second hash function.

[0037] In a possible implementation, the first screening module is configured to determine that the target packet meets the first screening rule in a case where the frequency of occurrence of the first element is greater than or equal to a second threshold.

[0038] The second screening module is configured to determine that the target packet meets the second screening rule in a case where the frequency of occurrence of the second element is greater than or equal to a third threshold.

[0039] In a possible implementation, the anomaly detection module is configured to perform anomaly detection on a session including the target packet based on the target packet.

[0040] In a possible implementation, the number of packets filtered by the first filtering rule is greater than the number of packets filtered by the second filtering rule.

[0041] In a third aspect, an embodiment of the present application provides an anomaly detection apparatus, including: at least one memory configured to store a program; and at least one processor configured to execute the program stored in the memory, and when the program stored in the memory is executed, the processor is configured to execute the method provided in the first aspect.

[0042] In a fourth aspect, an embodiment of the present application provides an anomaly detection apparatus, and the apparatus runs computer program instructions to execute the method provided in the first aspect. For example, the apparatus can be a chip or a processor.

[0043] In an example, the apparatus can include a processor, which can be coupled with a memory, read instructions in the memory and execute the method provided in the first aspect according to the instructions. The memory can be integrated in the chip or the processor, or can be independent of the chip or the processor.

[0044] In a fifth aspect, an embodiment of the present application provides a network protection device, including: at least one memory configured to store a program; and at least one processor configured to execute the program stored in the memory, and when the program stored in the memory is executed, the processor is configured to execute the method provided in the first aspect.

[0045] In a sixth aspect, an embodiment of the present application provides a computing device cluster, and the computing device cluster includes at least one computing device, and each computing device includes a processor and a memory; wherein the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method provided in the first aspect; or the processor of each computing device is configured to execute instructions stored in the memory of each computing device, so that each computing device executes the method provided in the first aspect, that is, for each computing device, the processor of the computing device is configured to execute instructions stored in the memory of the computing device, so that the computing device executes the method provided in the first aspect.

[0046] In a seventh aspect, an embodiment of the present application provides a computer storage medium, and the computer storage medium stores instructions, and when the instructions run on a computer, the computer executes the method provided in the first aspect.

[0047] In an eighth aspect, an embodiment of the present application provides a computer program product comprising instructions which, when executed on a computer, cause the computer to carry out the method provided in the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0048] FIG. 1 is a system architecture diagram of a communication system according to an embodiment of the present application;

[0049] FIG. 2 is a schematic diagram of n-stage screening according to an embodiment of the present application;

[0050] FIG. 3 is a flow diagram of an anomaly detection method according to an embodiment of the present application;

[0051] FIG. 4 is a schematic diagram of a first element screening scheme according to an embodiment of the present application;

[0052] FIG. 5a is a schematic diagram of implementing screening by statistical analysis of a first element according to an embodiment of the present application;

[0053] FIG. 5b is a schematic diagram of starting the next stage of screening according to an embodiment of the present application;

[0054] FIG. 5c is a schematic diagram of implementing screening by statistical analysis of a category to which a first element belongs according to an embodiment of the present application;

[0055] FIG. 5d is a schematic diagram of starting the next stage of screening according to an embodiment of the present application;

[0056] FIG. 6 is a schematic diagram of a second element screening scheme according to an embodiment of the present application;

[0057] FIG. 7a is a schematic diagram of implementing screening by statistical analysis of a second element according to an embodiment of the present application;

[0058] FIG. 7b is a schematic diagram of starting anomaly detection according to an embodiment of the present application;

[0059] FIG. 7c is a schematic diagram of implementing screening by statistical analysis of a category to which a second element belongs according to an embodiment of the present application;

[0060] FIG. 7d is a schematic diagram of starting the next stage of screening according to an embodiment of the present application;

[0061] FIG. 8a is a schematic diagram of packet screening by a first screening rule and a second screening rule according to an embodiment of the present application;

[0062] FIG. 8b is a schematic diagram of packet screening by a first screening rule and a second screening rule according to an embodiment of the present application;

[0063] FIG. 8c is a schematic diagram of packet screening by a first screening rule and a second screening rule according to an embodiment of the present application;

[0064] FIG. 8d is a schematic diagram of packet screening according to the first screening rule and the second screening rule according to an embodiment of the present application;

[0065] FIG. 9 is a schematic diagram of an abnormality detection method according to an embodiment of the present application;

[0066] FIG. 10a is a schematic diagram of a packet screening scenario according to an embodiment of the present application;

[0067] FIG. 10b is a schematic diagram of a packet screening scenario according to an embodiment of the present application;

[0068] FIG. 10c is a schematic diagram of a packet screening scenario according to an embodiment of the present application;

[0069] FIG. 11 is a schematic diagram of an abnormality detection apparatus according to an embodiment of the present application;

[0070] FIG. 12 is a schematic diagram of a computing device according to an embodiment of the present application;

[0071] FIG. 13 is a schematic diagram of a computing device cluster according to an embodiment of the present application;

[0072] FIG. 14 is a schematic diagram of a network connection between computing devices in a computer cluster according to an embodiment of the present application. DETAILED DESCRIPTION

[0073] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below with reference to the drawings.

[0074] In the description of the embodiments of the present application, the words “exemplary”, “for example”, or “e.g.” are used to mean serving as an example, instance, or illustration. Any embodiment or design solution described as “exemplary”, “for example”, or “e.g.” in the embodiments of the present application should not be construed as being more preferred or advantageous than other embodiments or design solutions. In fact, the words “exemplary”, “for example”, or “e.g.” are used to present the relevant concept in a specific manner.

[0075] In the description of the embodiments of the present application, the term “and / or” is merely used to describe an association relationship of associated objects, and represents that there can be three relationships, for example, A and / or B can represent three cases of A existing alone, B existing alone, and A and B existing simultaneously. In addition, unless otherwise specified, the term “multiple” means two or more. For example, multiple systems mean two or more systems, and multiple terminals mean two or more terminals.

[0076] In addition, the terms "first", "second" are only used for descriptive purposes and cannot be understood to indicate or imply relative importance or implicitly indicate the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more features. The terms "include", "contain", "have" and their variants mean "include but not limited to", unless otherwise specifically emphasized.

[0077] In the following, some of the terms in the present embodiment are explained. It should be noted that these explanations are for the convenience of those skilled in the art and do not limit the scope of protection claimed by the present application.

[0078] Network hardware platform: a computer and its supporting equipment used in the field of information and system science related engineering and technology. It mainly refers to network devices, transmission media and network connection devices, which play an important role in network security and are the basic carrier of network security hardware product function implementation, and constitute the core of network security solution.

[0079] Session: refers to a series of activities between a user and a computer system or application program. In network communication, session refers to a connection process that allows data exchange between devices. Session starts with the start of connection establishment, and devices can transmit data between each other. Session involves a series of interactions and information transmission between users and systems, and in the field of computers, session refers to the series of interaction processes recorded by the server when the user operates in the website.

[0080] Network traffic: refers to the data flow transmitted through computer networks or the Internet within a certain period of time.

[0081] Session behavior analysis: mainly focuses on how to evaluate the quality and depth of a session through events and attributes in the session. The quality of a session can be evaluated through a series of indicators, such as session duration, depth, number of events contained, and whether conversion occurs, etc. Session depth is usually represented by the number of events in the session, but this method may not accurately reflect the true quality of the session. Therefore, other dimensions need to be introduced to more accurately record or restore the depth of the session, so as to better evaluate the quality of the session.

[0082] First packet protection: mainly refers to the special processing of the first data packet (first packet) of a data packet in network communication to enhance the security of the network or improve the performance of network services. This technology is usually applied in firewalls, network security devices or other network devices to deal with various network attacks or optimize network services.

[0083] Distributed Denial of Service (DDOS) attack: a network attack method, whose attack principle is: an attacker controls a large number of zombie hosts in a botnet to send a large amount of data flow to a server, so that the server is busy processing data flow from these zombie hosts, thereby exhausting the system resources (including computing resources, storage resources and network resources) of the server, causing the server to be unable to process data flow from normal clients.

[0084] Transport Layer Security (TLS): used to provide confidentiality, data integrity and authenticity between two communicating applications.

[0085] Next, the communication system to which the anomaly detection method provided by the embodiments of the present application can be applied is introduced. FIG. 1 shows an architecture example diagram of a communication system provided by an embodiment of the present application. The anomaly detection method provided by the embodiments of the present application can be applied to the system architecture diagram as shown in FIG. 1. As shown in FIG. 1, the communication system includes a first electronic device 110, a network protection device 120, and a second electronic device 130.

[0086] The first electronic device 110 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, portable wearable devices, and the like. Exemplary embodiments of the terminal device involved in the present solution include, but are not limited to, electronic devices running iOS, android, Windows, Harmony OS, or other operating systems. The embodiments of the present application do not specifically limit the type of the first electronic device 110. Exemplarily, the first electronic device 110 can be an entity for receiving or transmitting signals on the user side, such as a new generation user equipment (gUE). The first electronic device 110 can also be referred to as a terminal device (User Equipment, UE), an access terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent, or a user device. The first electronic device 110 can be a station (STATION, ST) in a wireless local area network (Wireless Local Area Network, WLAN), can be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA) device, a handheld device with wireless communication function, a computing device, or other processing devices connected to a wireless modem, a vehicle-mounted device, a wearable device, and a next-generation communication system, such as a terminal device in a fifth-generation (5G) network or a terminal device in a future evolved public land mobile network (PLMN) network, a terminal device in a New Radio (NR) communication system, and the like. By way of example and not limitation, in the embodiments of the present application, the first electronic device 110 can also be a wearable device. The wearable device can also be referred to as a wearable smart device, which is a general term for devices that are designed and developed by applying wearable technology to daily wear, such as glasses, gloves, watches, clothing, and shoes. The wearable device is a portable device that is directly worn on the body or integrated into the user's clothes or accessories. The wearable device is not only a hardware device, but also realizes powerful functions through software support and data interaction and cloud interaction. The general wearable smart device includes a full function, a large size, and can realize complete or partial functions without relying on a smart phone, such as a smart watch or smart glasses, and focuses on only one type of application function, and needs to cooperate with other devices such as a smart phone, such as various smart wristbands and smart jewelry for monitoring vital signs.

[0087] The second electronic device 130 is configured to communicate with the first electronic device 110 and process services of the first electronic device 110. The second electronic device 130 can be a server. In some possible implementation manners, the server involved in the present scheme can be configured to provide cloud services, which can be a server or a super terminal that can establish a communication connection with other devices and provide computing and / or storage functions for other devices. The server involved in the present scheme can be a hardware server or can be implanted in a virtualization environment. For example, the server involved in the present scheme can be a virtual machine executed on a hardware server including one or more other virtual machines. For example, the second electronic device 130 can be a cloud (a software platform using an application virtualization technology, integrating multiple functions such as software search, download, use, management, backup, etc.). In specific use, the cloud can be configured as a data center 131, and a cloud management platform 132 can also be configured. In addition, the data center 131 can deploy nodes, and the nodes in the data center 131 can be virtual machine instances, container instances, physical servers, etc. In the data center 131, the number of nodes is generally massive. The cloud management platform 132 can be independently deployed on a server or a virtual machine in the data center 131, or can be distributedly deployed on multiple servers in the data center 131 or multiple virtual machines in the data center 131, or a part of the cloud management platform 132 can be independently or distributively deployed in an edge environment (also referred to as an edge device), and the other part of the cloud management platform 132 can be independently or distributively deployed in the data center 131. The edge environment is an environment close to a terminal computing device of a user in a geographical position, and the edge environment includes edge devices such as edge servers and edge small stations with computing capabilities.

[0088] It should be noted that the number of the first electronic device 110 and the second electronic device 130 can be multiple.

[0089] The network protection device 120 is a device with a message forwarding function and a protection function, such as a switch, a router, and the like. The number of the network protection device 120 can be multiple. The first electronic device 110 and the second electronic device 130 communicate through the network protection device 120.

[0090] In the embodiments of the present application, as shown in FIG. 2, the network protection device 120 performs n-level screening on the received message. The process of n-level screening is as follows: first, it is judged whether the message meets the screening rule 1. If the message does not meet the screening rule 1, the message is forwarded. If the message meets the screening rule 1, the next level of screening is started, and it is judged whether the message meets the screening rule 2. If the message does not meet the screening rule 2, the message is forwarded. If the message meets the screening rule 2, the next level of screening is started. In this way, if the message meets the screening rule n, the message meeting the n-level screening is subjected to abnormality judgment. Through multi-level screening, the message that may exist attack can be screened from a large number of messages for abnormality judgment, and it is not necessary to perform abnormality judgment on each message, thereby reducing the number of messages subjected to abnormality judgment, reducing the occupation of storage resources, reducing the influence on subsequent messages, and improving user experience.

[0091] Next, in combination with the communication system provided above, an abnormality detection method provided by the embodiments of the present application is described in detail. FIG. 3 is a flowchart of the abnormality detection method provided by the embodiments of the present application. The embodiments of the present application can be applied on electronic devices, and specifically can be applied on servers or general computers.

[0092] As shown in FIG. 3, the abnormality detection method provided by the embodiments of the present application at least includes the following steps:

[0093] In step 301, the first electronic device 110 sends a data stream to the network protection device 120.

[0094] The data stream refers to a one-way message stream transmitted between a source IP address and a destination IP address within a period of time. The concept of data stream (Flow) involves communication between a source IP address and a destination IP address, wherein all messages have the same transmission protocol and source IP address, destination IP address. The source IP address represents the sending end. The destination IP address represents the receiving end. The transmission protocol refers to the protocol used when sending a data packet, such as Transmission Control Protocol (TCP), User Datagram Protocol (UDP), etc. For some specific protocols such as TCP and UDP, all messages have the same source port number and destination port number. The source port number refers to the port number used by the computer sending the data packet, which is used to identify which application program the data packet is sent from. The destination port number refers to the port number used by the computer receiving the data packet, which is used to identify which application program the data packet should be handed over to for processing. This definition emphasizes the specific attributes of the data stream in network communication, i.e., it describes the data transmission process from a source to a specific destination within a specific period of time. This transmission can be continuous or intermittent, but they share the same five-tuple information, which makes them regarded as the same data stream in the network.

[0095] In a specific implementation, the plurality of first electronic devices 110 and the plurality of second electronic devices 130 can establish a session at a session layer, which is built on a transport layer and uses the services provided by the transport layer to enable an application to establish and maintain a session and enable the session to be synchronized. Subsequently, for the first electronic device 110 and the second electronic device 130 in the session, the first electronic device 110 can send a data stream to the second electronic device 130, and each packet in the data stream can include the following contents:

[0096] Header or title: It includes the address of the sending station, the address of the terminal receiving station, and other auxiliary control information. For example, it can include the source and target addresses, protocol types, and the like. In addition, for some specific protocols such as TCP, the header also includes the source port number and the destination port number, the sequence number and the acknowledgement number, and the like. The sequence number and the acknowledgement number are used to ensure the sequential transmission and reliability of data

[0097] Packet body: This is the part that transmits user information and contains the actual data content, i.e., the data block to be sent by the station at one time. The length and content of the packet body can be varied according to specific needs and can be text, image, video, and other forms of data.

[0098] Trailer: It indicates the end mark of the packet. If the length of the packet is specified, this mark can be omitted. The trailer exists to clearly indicate the end position of the packet, so as to facilitate the correct parsing of the packet content by the receiving end.

[0099] Step 302, the network protection device 120 receives a target packet, the target packet includes a first element and a second element, and the target includes any packet in the data stream.

[0100] It should be noted that there can be multiple packets in the data stream, and the network protection device 120 needs to perform the same steps: steps 303 to 306, on each packet.

[0101] In the embodiment of the application, the first element can be a feature value of at least one feature (for the convenience of description and distinction, it can be referred to as a first feature) in the network protocol header.

[0102] For example, the network protocol is the IP protocol, and the first feature can be at least one of the following:

[0103] Source IP address, destination IP address, version number (identifying the version of the IP protocol, such as IPv4 and IPv6), header length (indicating the length of the IP packet excluding the payload, used to describe the length of the IP header, and the IP header length is variable), service type (Type Of Service, including priority field and TOS field, used to define the priority of the packet), packet length (the length of the entire packet), time to live (TTL, used to indicate the number of routers allowed to transit before reaching the destination), and route hop count (used to indicate the number of routers that transit before reaching the destination).

[0104] Exemplarily, the network protocol is the TCP protocol, and the first feature can be at least one of the following:

[0105] Header length (length of the TCP packet header, used to describe the length of the TCP header), window size (indicating the maximum amount of data the sender is willing to receive), source port number, destination port number, and flag bit (including synchronization, end, confirmation, push, reset, etc. Marks, used to control the establishment, maintenance and termination of connection).

[0106] Exemplarily, the network protocol is the HTTP protocol, and the first feature can be at least one of the following:

[0107] Status code and reason phrase (indicating the status of the response result and the HTTP version), and at least one field in the header field (including various conditions and attributes of requests and responses, such as user agent, content type, cache control, etc.).

[0108] It should be noted that the first feature can be designed in combination with actual needs and features in the packet, for example, the first element can be at least one of the following: at least one element of the five-tuple, route hop count, packet length, service level, and network protocol; wherein the five-tuple is source IP, destination IP, transmission protocol, source port number and destination port number; exemplarily, the first element can be source IP or destination IP; exemplarily, the first element can be source IP and destination IP.

[0109] In the embodiment of the application, the second element can be a feature value of at least one feature (which can be referred to as a second feature for the sake of description and distinction) in the network protocol header. The specific content of the second feature can be referred to the description of the first feature, and will not be repeated. It should be noted that the first feature and the second feature can be the same or different, and the specific needs are set in combination with actual needs. Exemplarily, the first feature can be source IP, and the second feature can be source IP and destination IP; exemplarily, the first feature can be source IP, and the second feature can be destination IP.

[0110] It should be understood that the first feature and the second feature shown above are only examples and do not constitute specific limitations, and the first feature and the second feature can be flexibly designed in combination with actual conditions.

[0111] Step 303, the network protection device 120 determines whether the target message meets the first screening rule; the first screening rule is related to the first element, if yes, step 304 is performed, and if no, step 305 is performed.

[0112] In the embodiment of the application, the first screening rule is used for screening according to a result value of the first statistical analysis on any feature value of the first feature. The result value of the first statistical analysis is used to indicate the degree of frequency of any feature value of the first feature; specifically, the result value of the first statistical analysis is related to the frequency of any feature value of the first feature.

[0113] In some possible cases of the embodiment, for the first element, the first element is any feature value of the first feature, and the result value of the first statistical analysis can be the frequency of the first element, and can also be the proportion of the frequency of the first element in the total frequency of the first feature. The frequency of the first element can be represented by the number of occurrences of the first element, can also be represented by the ratio of the number of occurrences of the first element to the statistical time, and can also be represented by the ratio of the number of occurrences of the first element to the total number of occurrences of the first feature; the total number of occurrences of the first feature is used to indicate the number of occurrences of all feature values of the first feature, and the total frequency of the first feature is used to indicate the frequency of all feature values of the first feature.

[0114] In some possible implementation manners of the case, the first screening rule is used for screening according to the first hash function; wherein the first hash function is used to count the frequency of any feature value of the first feature.

[0115] In addition, in actual application, the network protection device 120 continuously receives messages, and after receiving each message, the frequency of any feature value of the first feature is determined again. Therefore, in the embodiment of the application, the frequency of the first element is updated on the basis of the historical frequency of the first element.

[0116] Exemplarily, the network protection device 120 can determine the frequency of the first element in the following manner:

[0117] The first element is mapped to a first variable in the first counting array based on the first hash function (hash value keyhashvalue in FIG. 5a), and the frequency of occurrence of the first element is determined based on the number of times of mapping of the first variable (count in FIGS. 5a and 5b). Exemplarily, the frequency of occurrence of the first element can be the number of times of mapping of the first variable (count in FIGS. 5a and 5b), and can also be a ratio of the number of times of mapping of the first variable (count in FIGS. 5a and 5b) to the total number of times of mapping of all variables in the first counting array. It should be noted that the first counting array is composed of a plurality of counters (represented by rectangles in the first counting array in FIGS. 5a and 5b), each of which is used to count hash values, which are values mapped by the first hash function to any feature value of the first feature. Therefore, different feature values of the first feature can be mapped to different counters in the first counting array by the first hash function, so as to count the number of times of mapping of the hash values. Correspondingly, the first variable can be understood as a value mapped by the first hash function to a feature value of the first feature represented by the first element.

[0118] Subsequently, based on the frequency of occurrence of the first element, a result value of the first statistical analysis of the first element can be determined. For example, the frequency of occurrence of the first element can be taken as the result value of the first statistical analysis of the first element. For another example, in the case where the frequency of occurrence of the first element is the number of times of mapping of the first variable (count in FIGS. 5a and 5b), a ratio of the frequency of occurrence of the first element to the total number of times of mapping of all variables in the first counting array can be determined, and the ratio can be taken as the result value of the first statistical analysis of the first element.

[0119] In some possible cases of this embodiment, the result value of the first statistical analysis is used to indicate the degree of frequency of occurrence of the category to which the first element belongs. Exemplarily, the result value of the first statistical analysis can be the frequency of occurrence of the category to which the first element belongs, and can also be a proportion of the frequency of occurrence of the category to which the first element belongs in the total frequency of occurrence of the first feature classification. The first feature classification is a plurality of categories of the first feature, and therefore the total frequency of occurrence of the first feature classification is used to indicate the frequency of occurrence of all categories of the first feature. It should be noted that in specific implementation, the network protection device 120 includes the first feature classification, which is composed of a plurality of counters (represented by rectangles in the first feature classification in FIG. 5c), each of which is used to count a category. Subsequently, the network protection device 120 can match the first element and the categories in the first feature classification to determine the category to which the first element belongs.

[0120] Exemplarily, the frequency of occurrence of the category to which the first element belongs is similar to the frequency of occurrence of the first element, for example, Count in FIG. 5c.

[0121] Exemplarily, as shown in FIG. 5d, the category to which the first element belongs is used to describe the feature value interval in which the first element is located, specifically, each counter (rectangle in the first feature category in FIG. 5d) in the first feature category is used to count the feature value interval; in actual application, the feature value range of the first feature can be divided to obtain a plurality of feature value intervals, and each feature value interval is a category; for example, if the first element represents the length of a packet, the length of the packet can be divided into three categories: short packet, medium packet and long packet; correspondingly, the manner in which the network protection device 120 performs the first statistical analysis on the first element can be: matching the first element with the feature value interval in the first feature category to determine the Count (Count in FIG. 5d) of the matched feature value interval; subsequently, based on the Count (Count in FIG. 5d) of the matched feature value interval, the result value of the first statistical analysis is determined.

[0122] The first filtering rule is used to indicate a condition (which can be referred to as a first condition for the sake of description and distinction) that needs to be met by the result value of the first statistical analysis on any feature value of the first feature. Correspondingly, the network protection device 120 determines whether the target packet meets the first filtering rule based on the result value of the first statistical analysis on the first element (representing any feature value of the first feature) in the target packet; for example, as shown in FIG. 4, in a case where the result value of the first statistical analysis on the first element meets the first condition, the network protection device 120 determines that the target packet meets the first filtering rule and starts the next level of filtering. In a case where the result value of the first statistical analysis on the first element does not meet the first condition, the network protection device 120 determines that the target packet does not meet the first filtering rule and directly forwards the target packet.

[0123] In some possible scenarios, if the first filtering rule is used to perform filtering according to a first hash function. The first hash function is used to count the frequency of occurrence of any feature value of the first feature. As shown in FIG. 5a, the network protection device 120 maps the first element to a keyhashvalue in the first count array based on the first hash function; based on the Count of the keyhashvalue, the result value of the first statistical analysis is determined, in a case where the result value of the first statistical analysis meets the first condition, it is determined that the target packet meets the first filtering rule and the next level of filtering is started; in a case where the result value of the first statistical analysis on the first element does not meet the first condition, it is determined that the target packet does not meet the first filtering rule and the target packet is directly forwarded.

[0124] In some possible scenarios, the result value of the first statistical analysis is used to indicate how frequently the category to which the first element belongs appears. As shown in FIG. 5c, the network protection device 120 determines the result value of the first statistical analysis based on the frequency (Count) of the category to which the first element belongs, and determines that the target packet meets the first screening rule and initiates the next level of screening if the result value of the first statistical analysis meets the first condition, or determines that the target packet does not meet the first screening rule and directly forwards the target packet if the result value of the first statistical analysis does not meet the first condition.

[0125] For example, the first condition can be greater than or equal to a first threshold value. Correspondingly, the network protection device 120 determines that the target packet meets the first screening rule and initiates the next level of screening if the result value of the first statistical analysis of the first element is greater than or equal to the first threshold value, or determines that the target packet does not meet the first screening rule and directly forwards the target packet if the result value of the first statistical analysis of the first element is less than the first threshold value.

[0126] In this example, the first screening rule is used to screen according to a first hash function. The first hash function is used to count the frequency of occurrence of any feature value of the first feature.

[0127] When the result of the first statistical analysis is the frequency of occurrence of the first element, the network protection device 120 determines that the target packet meets the first screening rule and initiates the next level of screening if the frequency of occurrence of the first element is greater than or equal to the first threshold value, or determines that the target packet does not meet the first screening rule and directly forwards the target packet if the frequency of occurrence of the first element is less than the first threshold value. For example, as shown in FIG. 5b, the first element is mapped to a keyhashvalue in the first count array based on the first hash function, and the next level of screening is initiated if the Count of the keyhashvalue is greater than or equal to the first threshold value.

[0128] In addition, if the frequency of occurrence of the first element is the Count of the keyhashvalue in the first count array, the first threshold value can be the average of the mapping times of each variable in the first count array.

[0129] In this example, if the result value of the first statistical analysis is used to indicate the frequency of occurrence of the category to which the first element belongs. The network protection device 120 determines that the target packet meets the first screening rule and starts the next level of screening if the frequency of occurrence of the category to which the first element belongs is greater than or equal to the first threshold value; determines that the target packet does not meet the first screening rule and directly forwards the target packet if the frequency of occurrence of the category to which the first element belongs is less than the first threshold value. For example, if the category to which the first element belongs is used to describe the characteristic value interval in which the first element is located, as shown in FIG. 5d, the network protection device 120 matches the first element and the characteristic value interval in the first characteristic classification, determines the Count of the matched characteristic value interval, and starts the next level of screening if the Count of the matched characteristic value interval is greater than or equal to the first threshold value.

[0130] In some possible cases, the first condition can be any of the p characteristic values with the maximum result value of the first statistical analysis on the first characteristic, where p is a positive integer greater than or equal to 1. It should be noted that the network protection device 120 receives a large number of packets, and performs the first statistical analysis on each characteristic value of the first characteristic in each packet to obtain the result value of the first statistical analysis corresponding to each characteristic value of the first characteristic. Correspondingly, the p characteristic values are the p characteristic values with the maximum result value of the first statistical analysis among each characteristic value of the first characteristic.

[0131] In step 304, the network protection device 120 determines whether the target packet meets the second screening rule; the second screening rule is related to the second element, and if so, step 306 is performed, and if not, step 305 is performed.

[0132] In the embodiment of the present application, the second screening rule is used to screen according to the result value of the second statistical analysis on any characteristic value of the second characteristic. The result value of the second statistical analysis is used to indicate the degree of frequent occurrence of any characteristic value of the second characteristic; specifically, the result value of the second statistical analysis is related to the frequency of occurrence of any characteristic value of the second characteristic.

[0133] In some possible cases of this embodiment, for the second element, the second element is any characteristic value of the second characteristic, and the result value of the second statistical analysis can be the frequency of occurrence of the second element, and can also be the proportion of the frequency of occurrence of the second element in the total frequency of occurrence of the second characteristic. The frequency of occurrence of the second element can be represented by the number of occurrences of the second element, can also be represented by the ratio of the number of occurrences of the second element to the statistical time, and can also be represented by the ratio of the number of occurrences of the second element to the total number of occurrences of the second characteristic. The total number of occurrences of the second characteristic is used to indicate the number of occurrences of all characteristic values of the second characteristic, and the total frequency of occurrence of the second characteristic is used to indicate the frequency of occurrence of all characteristic values of the second characteristic.

[0134] In some possible implementation manners of the case, the second screening rule is used for screening according to a second hash function; and the second hash function is used for counting the frequency of occurrence of any feature value of the second feature.

[0135] In addition, in actual application, the network protection device 120 constantly receives packets, and each time a packet is received, the frequency of occurrence of any feature value of the second feature is determined again. Therefore, in the embodiment of the present application, the frequency of occurrence of the second element is obtained by updating the historical frequency of occurrence of the second element.

[0136] Exemplarily, the network protection device 120 can determine the frequency of occurrence of the second element in the following manner:

[0137] Based on the second hash function, the second element is mapped to a second variable (hash value keyhashvalue in FIG. 7a) in a second counting array, and based on the mapping times of the second variable (count in FIG. 7a and FIG. 7b), the frequency of occurrence of the second element is determined. Exemplarily, the frequency of occurrence of the second element can be the mapping times of the second variable (count in FIG. 7a and FIG. 7b), or can be the ratio of the mapping times of the second variable (count in FIG. 7a and FIG. 7b) to the total mapping times of all variables in the second counting array. It should be noted that the second counting array is composed of a plurality of counters (represented by rectangles in the second counting array in FIG. 7a and FIG. 7b), each of which is used for counting a hash value, and the hash value is a value mapped by the second hash function to any feature value of the second feature. Therefore, different feature values of the second feature can be mapped to different counters in the second counting array by the second hash function, so as to count the mapping times of the hash value. Correspondingly, the second variable can be understood as a value mapped by the second hash function to a feature value of the second feature represented by the second element.

[0138] Subsequently, based on the frequency of occurrence of the second element, a result value of the second statistical analysis of the second element can be determined. For example, the frequency of occurrence of the second element can be taken as the result value of the second statistical analysis of the second element. For another example, in the case where the frequency of occurrence of the second element is the mapping times of the second variable (count in FIG. 7a and FIG. 7b), the ratio of the frequency of occurrence of the second element to the total mapping times of all variables in the second counting array can be determined, and the ratio is taken as the result value of the second statistical analysis of the second element.

[0139] In some possible cases of the embodiment, the result value of the second statistical analysis is used to indicate how frequently the category to which the second element belongs appears. Illustratively, the result value of the second statistical analysis can be the frequency of appearance of the category to which the second element belongs, or the proportion of the frequency of appearance of the category to which the second element belongs in the total frequency of appearance of the second feature classification. The second feature classification is a plurality of categories of the second feature, and thus the total frequency of appearance of the second feature classification is used to indicate the frequency of appearance of all categories of the second feature. It should be noted that, in actual implementation, the network protection device 120 includes the second feature classification, which is composed of a plurality of counters (represented by rectangles in the second feature classification in FIG. 7c), each of which is used to count a category; subsequently, the network protection device 120 can match the second element and the category in the second feature classification to determine the category to which the second element belongs.

[0140] Illustratively, the frequency of appearance of the category to which the second element belongs is similar to the frequency of appearance of the second element, for example, which can be Count in FIG. 7c.

[0141] Illustratively, as shown in FIG. 7d, the category to which the second element belongs is used to describe the feature value interval in which the second element is located, specifically, each counter (represented by rectangles in the second feature classification in FIG. 7d) in the second feature classification is used to count a feature value interval; in actual application, the range of the feature value of the second feature can be divided to obtain a plurality of feature value intervals, each of which is a category; for example, if the second element represents the length of a packet, the length of the packet can be divided into three categories: short packet, medium packet, and long packet; correspondingly, the manner in which the network protection device 120 performs the second statistical analysis on the second element can be: matching the second element and the feature value interval in the second feature classification to determine the Count (Count in FIG. 7d) of the matched feature value interval; subsequently, the result value of the second statistical analysis is determined based on the Count (Count in FIG. 7d) of the matched feature value interval.

[0142] The second filtering rule is used to indicate a condition (for the sake of description and distinction, which can be referred to as a second condition) that needs to be met by the result value of the second statistical analysis on any feature value of the second feature. Correspondingly, the network protection device 120 determines, based on the result value of the second statistical analysis on the second element (representing any feature value of the second feature) in the target packet, whether the target packet meets the second filtering rule; for example, as shown in FIG. 6, in a case where the result value of the second statistical analysis on the second element meets the second condition, the network protection device 120 determines that the target packet meets the second filtering rule and performs an abnormality judgment based on the target packet. In a case where the result value of the second statistical analysis on the second element does not meet the second condition, it is determined that the target packet does not meet the second filtering rule, and the target packet is directly forwarded.

[0143] In some possible scenarios, the second screening rule is used for screening according to a second hash function. The second hash function is used to count the frequency of occurrence of any feature value of the second feature. As shown in FIG. 7a, the network protection device 120 maps the second element to a keyhash value in a second counting array based on the second hash function, determines a result value of the second statistical analysis based on the Count of the keyhash value, determines that the target packet meets the second screening rule in a case where the result value of the second statistical analysis meets a second condition, and performs the anomaly judgment based on the target packet; and determines that the target packet does not meet the second screening rule in a case where the result value of the second statistical analysis of the second element does not meet the second condition, and directly forwards the target packet.

[0144] In some possible scenarios, the result value of the second statistical analysis is used to indicate the degree of frequency of occurrence of the category to which the second element belongs. As shown in FIG. 7c, the network protection device 120 determines the result value of the second statistical analysis based on the frequency of occurrence of the category to which the second element belongs, determines that the target packet meets the second screening rule in a case where the result value of the second statistical analysis meets a second condition, and performs the anomaly judgment based on the target packet; and determines that the target packet does not meet the second screening rule in a case where the result value of the second statistical analysis of the second element does not meet the second condition, and directly forwards the target packet.

[0145] Exemplarily, the second condition can be greater than or equal to a second threshold value. Correspondingly, the network protection device 120 determines that the target packet meets the second screening rule in a case where the result value of the second statistical analysis of the second element is greater than or equal to the second threshold value, and performs the anomaly judgment based on the target packet; and determines that the target packet does not meet the second screening rule in a case where the result value of the second statistical analysis of the second element is less than the second threshold value, and directly forwards the target packet.

[0146] In this example, the second screening rule is used for screening according to a second hash function. The second hash function is used to count the frequency of occurrence of any feature value of the second feature.

[0147] In a case where the result of the second statistical analysis is the frequency of occurrence of the second element, the network protection device 120 determines that the target packet meets the second screening rule in a case where the frequency of occurrence of the second element is greater than or equal to a second threshold value, and performs the anomaly judgment based on the target packet; and determines that the target packet does not meet the second screening rule in a case where the frequency of occurrence of the second element is less than the second threshold value, and directly forwards the target packet. Exemplarily, as shown in FIG. 7b, the second element is mapped to a keyhash value in a second counting array based on a second hash function; and the anomaly judgment is performed based on the target packet in a case where the Count of the keyhash value is greater than or equal to the second threshold value.

[0148] In addition, if the occurrence frequency of the second element is the Count of the keyhashvalue in the second counting array, the second threshold value can be the average of the mapping times of each variable in the second counting array.

[0149] In this example, if the result value of the second statistical analysis is used to indicate the occurrence frequency of the category to which the second element belongs. The network protection device 120 determines that the target packet meets the second screening rule in the case that the occurrence frequency of the category to which the second element belongs is greater than or equal to the second threshold value, and performs anomaly judgment based on the target packet; in the case that the occurrence frequency of the category to which the second element belongs is less than the second threshold value, it is determined that the target packet does not meet the second screening rule, and the target packet is directly forwarded. Illustratively, if the category to which the second element belongs is used to describe the feature value interval in which the second element is located, as shown in FIG. 7d, the network protection device 120 matches the second element and the feature value interval in the second feature classification, determines the Count of the matched feature value interval, and performs anomaly judgment based on the target packet in the case that the Count of the matched feature value interval is greater than or equal to the second threshold value.

[0150] In some other possible cases, the second condition can be any of the p feature values with the maximum result value of the second statistical analysis of the second feature, and p is a positive integer greater than or equal to 1. It should be noted that the network protection device 120 will receive a large number of packets, and perform the second statistical analysis on each feature value of the second feature in each packet to obtain the result value of the second statistical analysis corresponding to each feature value of the second feature; correspondingly, the p feature values are the p feature values with the maximum result value of the second statistical analysis of each feature value of the second feature.

[0151] It is worth noting that in steps 303 and 304, in some possible embodiments, the first element and the second element can be the same, that is, the first feature represented by the first element and the feature represented by the second element are the same, but the first hash function and the second hash function are different. In some other possible embodiments, the first element and the second element can be different, that is, the first feature represented by the first element and the feature represented by the second element are different, and at this time the first hash function and the second hash function can be the same or different. In the case that the first hash function and the second hash function are different, the collision rate of the first hash function can be less than the collision rate of the second hash function, so that the second hash function is more accurate, and the accuracy of the occurrence frequency statistics of the packet is improved.

[0152] In addition, in steps 303 and 304, the screening range of the first screening rule and the second screening rule is different, and the screening range of the first screening rule is greater than the screening range of the second screening rule, thereby reducing the screened packets, and further reducing the occupation of resources based on fewer packets for anomaly detection.

[0153] Step 305, the network protection device 120 forwards the target packet.

[0154] Step 306, the network protection device 120 performs anomaly detection based on the target packet.

[0155] In some possible embodiments, the network protection device 120 performs anomaly detection on a session (for the convenience of description and distinction, it can be referred to as a target session) containing the target packet based on the target packet. It should be noted that performing anomaly detection on the session requires recording information of packets included in the session, and the information needs to be stored in the memory. Considering that recording the information of the packets included in the session will occupy a large amount of memory resources, by multi-level screening, fewer packets are screened, and the information of the packets included in the session that needs to be recorded is reduced, and the memory occupation is reduced.

[0156] In actual application, the network protection device 120 creates a target session based on the target packet without creating the target session, records session information of the target session, starts to perform anomaly detection on the target session, and additionally performs first packet protection; in the case of creating the target session, the session information is updated based on the target packet. It should be noted that after starting to perform anomaly detection on the target session, if a packet included in the target session is received subsequently, the session information of the target session is updated based on the packet.

[0157] Among them, the session information is used to describe information required for session analysis. Exemplarily, the session information includes analysis elements, five-tuples, session start time and other information describing the session. The analysis elements can be elements related to analyzing session behaviors, such as the number of packets transmitted within a preset time period, the length of the packet.

[0158] Subsequently, the network protection device 120 performs analysis of session behaviors based on the session information of the target session for which the anomaly detection has been started, obtains an analysis result, and the analysis result is used to describe an attack source; exemplarily, if a source IP exists multiple sessions for which the anomaly detection has been started, the source IP is the attack source. Among them, the session behaviors are used to describe analysis of a series of interactions of a user on a network within a specific time period, such as regularity of the size of the sent packet, the number of sessions created by the user, the size of the packet of the session, and other analysis.

[0159] Subsequently, the network protection device 120 updates the blacklist and the whitelist based on the analysis result; and based on the blacklist and the whitelist, if the entity of the packet belongs to the blacklist, it is determined that the packet is attack traffic and is discarded directly. For example, if the attack comes from a source IP, the packet containing the source IP can be discarded. The blacklist refers to a list containing prohibited or untrusted sessions, IP addresses, users or other entities. When these entities attempt to establish a connection or perform a session, the system will reject them according to the rules in the blacklist. The whitelist is opposite to the blacklist, and the whitelist is an allowed list containing trusted or allowed entities for performing a session. Only the entities in this list can be accepted and allowed to perform a session by the system.

[0160] In the scheme, the elements in the packet are analyzed step by step to screen out packets that may exist attacks, and abnormality is judged based on the packets that may exist attacks, without judging abnormality based on all packets. On the one hand, the number of packets that need to be recorded can be reduced, and the occupation of storage resources can be reduced; on the other hand, the consumption of computing resources can be reduced, the influence on subsequent packets can be reduced, and user experience can be improved.

[0161] It should be noted that in the embodiments of the present application, the differences between the first element, the second element, the first hash function and the second hash function are not considered, and the first statistical analysis and the second statistical analysis can be the same or different, which can be determined according to actual needs.

[0162] Exemplarily, the first statistical analysis and the second statistical analysis can be the same. Next, the first element and the second element are taken as examples for description.

[0163] In some possible cases A1, the first statistical analysis can be: based on the first hash function, the first element is mapped to a first variable in a first count array; and based on at least the mapping number of the first variable, a result value of the first statistical analysis is determined. Subsequently, in the case where the result value of the first statistical analysis meets a first condition, the next level of screening is started.

[0164] The second statistical analysis can be: based on the second hash function, the second element is mapped to a second variable in a second count array; and based on at least the mapping number of the second variable, a result value of the second statistical analysis is determined. Subsequently, in the case where the result value of the second statistical analysis meets a second condition, abnormality is judged based on the target packet.

[0165] Suppose the first screening rule is that the occurrence frequency of any feature value of the first feature is greater than or equal to a first threshold value, and the second screening rule is that the occurrence frequency of any feature value of the second feature is greater than or equal to a second threshold value. As shown in FIG. 8a, based on the first hash function, the first element in the target packet is mapped to a keyhashvalue in the first counting array; in the case where the Count of the keyhashvalue is greater than or equal to the first threshold value, the next level of screening is started; based on the second hash function, the second element in the target packet is mapped to a keyhashvalue in the second counting array; in the case where the Count of the keyhashvalue meets the condition of being greater than or equal to the second threshold value, the target session containing the target packet is subjected to abnormality judgment.

[0166] In some possible case A2, the first statistical analysis can be: determining the occurrence frequency of the category to which the first element belongs; and determining the result value of the first statistical analysis based on the occurrence frequency of the category to which the first element belongs. Subsequently, in the case where the result value of the first statistical analysis meets a first condition, the next level of screening is started.

[0167] The second statistical analysis can be: determining the occurrence frequency of the category to which the second element belongs; and determining the result value of the second statistical analysis based on the occurrence frequency of the category to which the second element belongs. Subsequently, in the case where the result value of the second statistical analysis meets a second condition, the target packet is subjected to abnormality judgment.

[0168] Suppose the first screening rule is that the occurrence frequency of any feature value of the first feature belongs to a feature value interval is greater than or equal to a first threshold value, and the second screening rule is that the occurrence frequency of any feature value of the second feature belongs to a feature value interval is greater than or equal to a second threshold value. As shown in FIG. 8b, the feature value interval in the first feature classification to which the first element in the target packet matches is determined; in the case where the Count of the matched feature value interval is greater than or equal to the first threshold value, the next level of screening is started; the feature value interval in the second feature classification to which the second element in the target packet matches is determined; in the case where the Count of the matched feature value interval is greater than or equal to the second threshold value, the target session containing the target packet is subjected to abnormality judgment.

[0169] Exemplarily, the first statistical analysis and the second statistical analysis can be different.

[0170] In some possible case A3, the first statistical analysis can be: based on the first hash function, the first element is mapped to a first variable in the first counting array; and based on at least the mapping times of the first variable, the result value of the first statistical analysis is determined. Subsequently, in the case where the result value of the first statistical analysis meets a first condition, the next level of screening is started.

[0171] The second statistical analysis can be: determining the occurrence frequency of the category to which the second element belongs; determining the result value of the second statistical analysis based on the occurrence frequency of the category to which the second element belongs. Subsequently, in a case where the result value of the second statistical analysis meets a second condition, performing the anomaly judgment based on the target packet.

[0172] Suppose that the first screening rule is that the occurrence frequency of any feature value of the first feature is greater than or equal to a first threshold value, and the second screening rule is that the occurrence frequency of the feature value interval to which any feature value of the second feature belongs is greater than or equal to a second threshold value. As shown in FIG. 8c, the first element in the target packet is mapped to the keyhashvalue in the first counting array based on the first hash function; in a case where the Count of the keyhashvalue is greater than or equal to the first threshold value, the next level of screening is started; the second element in the target packet is determined to match the feature value interval in the second feature classification; in a case where the Count of the matched feature value interval is greater than or equal to the second threshold value, the target session containing the target packet is subjected to the anomaly judgment.

[0173] In some possible case A4, the first statistical analysis can be: determining the occurrence frequency of the category to which the first element belongs; determining the result value of the first statistical analysis based on the occurrence frequency of the category to which the first element belongs. Subsequently, in a case where the result value of the first statistical analysis meets a first condition, the next level of screening is started.

[0174] The second statistical analysis can be: mapping the second element to the second variable in the second counting array based on the second hash function; determining the result value of the second statistical analysis based on at least the mapping times of the second variable. Subsequently, in a case where the result value of the second statistical analysis meets a second condition, performing the anomaly judgment based on the target packet.

[0175] Suppose that the first screening rule is that the occurrence frequency of any feature value of the first feature is greater than or equal to a first threshold value, and the second screening rule is that the occurrence frequency of the feature value interval to which any feature value of the second feature belongs is greater than or equal to a second threshold value. As shown in FIG. 8d, the first element in the target packet is determined to match the feature value interval in the first feature classification; in a case where the Count of the matched feature value interval is greater than or equal to the first threshold value, the next level of screening is started; the second element in the target packet is mapped to the keyhashvalue in the second counting array based on the second hash function; in a case where the Count of the keyhashvalue meets the condition of being greater than or equal to the second threshold value, the target session containing the target packet is subjected to the anomaly judgment.

[0176] FIG. 9 shows a flow diagram of another anomaly detection method provided by the embodiments of the present application.

[0177] As shown in FIG. 9, on the basis of steps 301 to 306 shown in FIG. 3, in the embodiment of the present application, at least the following steps are further included:

[0178] Step 901, the network device 120 determines the memory occupation of the network protection device 120.

[0179] In a specific implementation, the network protection device 120 can periodically check the memory occupation of the network protection device 120 at a preset time interval.

[0180] Step 902, the network protection device 120 updates the first filtering rule and / or the second filtering rule when the memory occupation exceeds the third threshold.

[0181] It should be noted that when the memory occupation exceeds the third threshold, it means that the memory occupation is high, and the number of messages filtered by the first filtering rule and the second filtering rule is large, so the filtering rule needs to be updated to reduce the filtered messages.

[0182] The network protection device 120 can feedback to the user that the memory occupation is high under the first filtering rule and the second filtering rule, prompting the user to update the first filtering rule and / or the second filtering rule. It should be noted that the user updating the first filtering rule and the second filtering rule is only an example, and in actual application, the network protection device 120 can automatically update the first filtering rule and / or the second filtering rule in combination with an artificial intelligence model.

[0183] If the first filtering rule needs to be updated, in the case that the first filtering rule is based on the first hash function for filtering, the first hash function can be changed to a hash function with a lower conflict rate. In the case that the first filtering rule is used to indicate that the result value of the first statistical analysis on any characteristic value of the first characteristic needs to satisfy the first condition, on the one hand, the first statistical analysis method can be changed: for example, from counting the frequency of occurrence of any characteristic value of the first characteristic to counting the proportion of the frequency of occurrence of any characteristic value of the first characteristic in the total frequency of occurrence; on the other hand, the first condition can be changed: for example, in the case that the first condition is greater than or equal to the first threshold, the first threshold can be increased.

[0184] If the second filtering rule needs to be updated, the way to update the second filtering rule can refer to the first filtering rule, which will not be described again.

[0185] It should be noted that the first filtering rule and the second filtering rule shown in FIG. 3 are only examples, and in actual application, more filtering rules can be designed, at this time, at least part of the filtering rules can be selected for updating according to the actual situation, and the updating method can refer to the updating of the first filtering rule.

[0186] In the scheme, the screening rules are continuously adjusted according to the memory occupation, so that the messages screened by the screening rules do not occupy too much memory resource, thereby reducing the memory occupation.

[0187] It should be noted that in the embodiments of the present application, the first threshold, the second threshold and the third threshold are only a possible naming and do not constitute a specific limitation. For example, the first threshold, the second threshold and the third threshold can also be referred to as the second threshold, the third threshold and the first threshold.

[0188] In addition, before step 303, at least one of the following steps can also be included in the embodiments of the present application:

[0189] Step B1, the network protection device 120 determines that the destination IP address in the target message is abnormal.

[0190] Step B2, the network protection device 120 determines that the message transmission rate of the N sessions is abnormal.

[0191] Step B3, the network protection device 120 determines that the region of the destination IP address in the target message is the pre-set region.

[0192] Step B4, the network protection device 120 determines that the operator to which the destination IP address in the target message belongs is the pre-set operator.

[0193] In step B1, by pre-selecting the message with an abnormal destination IP address, the possibility of screening the message that may exist attack can be improved, and the network security can be improved. In some possible embodiments, the network protection device 120 starts multi-level screening for the message with an abnormal target IP address, for example, sequentially screens according to the n screening rules shown in FIG. 2, and for example, sequentially screens according to the first screening rule and the second screening rule. In some possible implementation manners, the network protection device 120 can count the occurrence frequency of the destination IP in all received messages (similar to the occurrence frequency of the first element), and determine that the destination IP is abnormal when the occurrence frequency of the destination IP reaches a pre-set threshold.

[0194] In step B2, the message transmission rate is used to indicate the number of messages accepted by the network protection device 120 per unit time; in the embodiments of the present application, multi-level screening is started in the case of abnormal message transmission rate, for example, sequentially screening according to the n screening rules shown in FIG. 2, and for example, sequentially screening according to the first screening rule and the second screening rule, so that the possibility of screening the message that may exist attack can be improved, and the network security can be improved; in some possible implementation manners, the network device 120 determines that the message transmission rate is abnormal when the message transmission rate is greater than or equal to a pre-set threshold.

[0195] In step B3, the network protection device 120 can pre-store the relationship between the IP address and the locality, and configure the region for multi-level screening; subsequently, the network protection device 120 can determine the locality of the destination IP address in the target packet based on the relationship between the IP address and the locality, and when the locality of the destination IP address in the target packet is the pre-set region, start the multi-level screening, for example, sequentially screen according to the n screening rules shown in FIG. 2, and for example, sequentially screen according to the first screening rule and the second screening rule. It should be noted that the packet screening for the specified locality improves the possibility of screening the attack traffic that may exist in the specified region.

[0196] In step B4, the network protection device 120 can pre-store the relationship between the IP address and the operator, and configure the operator for multi-level screening; subsequently, the network protection device 120 can determine the operator to which the destination IP address in the target packet belongs based on the relationship between the IP address and the operator, and when the operator to which the destination IP address in the target packet belongs is the pre-set operator, start the multi-level screening, for example, sequentially screen according to the n screening rules shown in FIG. 2, and for example, sequentially screen according to the first screening rule and the second screening rule. It should be noted that the screening of the traffic of the specified operator improves the possibility of screening the attack traffic of the specified operator.

[0197] Based on the above-provided abnormality detection method, the specific application of the abnormality detection method is described.

[0198] As shown in FIG. 10a, after receiving the packet, the network protection device 120 judges whether the destination IP traffic in the packet is abnormal, and if not, forwards the packet, and if yes, performs n-level screening based on the packet, which can be referred to FIG. 2; and performs abnormality judgment based on the packet that meets the n-level screening.

[0199] As shown in FIG. 10b, after receiving the packet, the network protection device 120 performs n-level screening based on the packet, and the process of n-level screening is as follows: first, judge whether the occurrence frequency of the feature value of the feature A in the packet meets condition 1, if not, forward the packet; if yes, start the next level of screening, judge whether the occurrence frequency of the feature value of the feature B in the packet meets condition 2, if not, forward the packet; if yes, start the next level of screening; and so on, if the occurrence frequency of the feature value of the feature n in the packet meets condition n, perform abnormality judgment based on the packet that meets the n-level screening. It should be noted that different features are used to achieve more flexible and refined packet screening, and improve the possibility of screening the packet that may exist attack.

[0200] As shown in FIG. 10c, the network protection device 120 receives the packet, and performs n-level screening based on the feature value of the feature A in the packet. The process of the n-level screening is as follows: firstly, it is judged whether the appearance frequency of the feature value of the feature A counted by the algorithm 1 meets the condition 1. If the condition 1 is not met, the packet is forwarded. If the condition 1 is met, the next level screening is started, and it is judged whether the appearance frequency of the feature value of the feature A counted by the algorithm 2 meets the condition 2. If the condition 2 is not met, the packet is forwarded. If the condition 2 is met, the next level screening is started. In this way, if the appearance frequency of the feature value of the feature A counted by the algorithm n meets the condition n, the packet meeting the n-level screening is subjected to abnormality judgment. It should be noted that the algorithm 1, …, the algorithm n can be a hash algorithm, and the collision rate of the hash functions used by the algorithm 1, …, the algorithm n is decreased in turn, so as to realize more refined packet screening and improve the possibility of the packet possibly existing attack screened out.

[0201] The present application also provides an abnormality detection device, as shown in FIG. 11, comprising:

[0202] a receiving module configured to receive a target packet included in the network traffic, the target packet being any one of N packets included in the network traffic, wherein N is a positive integer greater than or equal to 1, and the target packet comprises a first element and a second element;

[0203] a first screening module configured to determine whether the target packet meets the first screening rule, wherein the first screening rule is used to screen according to the appearance frequency of the first element;

[0204] a second screening module configured to determine whether the target packet meets the second screening rule in the case that the target packet meets the first screening rule, wherein the second screening rule is used to screen according to the appearance frequency of the second element;

[0205] an abnormality detection module configured to perform abnormality detection based on the target packet in the case that the target packet meets the second screening rule.

[0206] The receiving module, the first screening module, the second screening module and the abnormality detection module can be implemented by software or by hardware. For example, the implementation of the receiving module is introduced as follows. Similarly, the implementation of the first screening module, the second screening module and the abnormality detection module can refer to the implementation of the receiving module.

[0207] As an example of a software functional unit, the receiving module can include code running on a compute instance. The compute instance can include at least one of a physical host (computing device), a virtual machine, a container, and the like. The compute instance can be implemented as the network security device 120, for example. Further, the compute instance can be one or more. For example, the interface providing module can include code running on multiple hosts / virtual machines / containers. It is noted that the multiple hosts / virtual machines / containers running the code can be distributed in the same region, or in different regions. Further, the multiple hosts / virtual machines / containers running the code can be distributed in the same availability zone (AZ), or in different AZs. Each AZ can include one data center or multiple data centers in close geographical proximity. Typically, one region can include multiple AZs.

[0208] Similarly, the multiple hosts / virtual machines / containers running the code can be distributed in the same virtual private cloud (VPC), or in multiple VPCs. Typically, one VPC is set up in one region. Intercommunication between two VPCs in the same region, or between VPCs in different regions, requires a communication gateway to be set up in each VPC, and the interconnection between the VPCs is achieved via the communication gateway.

[0209] As an example of a hardware functional unit, the receiving module can include at least one computing device, such as a server, and the like. Alternatively, the receiving module can include part of the components in the network security device 120. Alternatively, the receiving module can be implemented using an application-specific integrated circuit (ASIC), or a programmable logic device (PLD), and the like. The PLD can be implemented as a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0210] It should be noted that in other embodiments, the receiving module can be configured to perform any of the steps of the anomaly detection method, the first screening module can be configured to perform any of the steps of the anomaly detection method, the second screening module can be configured to perform any of the steps of the anomaly detection method, the anomaly detection module can be configured to perform any of the steps of the anomaly detection method, and the steps performed by the receiving module, the first screening module, the second screening module, and the anomaly detection module can be specified as needed, and the receiving module, the first screening module, the second screening module, and the anomaly detection module respectively implement different steps of the anomaly detection method to achieve the overall function of the anomaly detection device.

[0211] The present application also provides a computing device 1200, which can be used as a network protection device 120, for example. As shown in FIG. 12, the computing device 1200 includes a bus 1202, a processor 1204, a memory 1206, and a communication interface 1208. The processor 1204, the memory 1206, and the communication interface 1208 communicate with each other through the bus 1202. The computing device 1200 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computing device 1200.

[0212] The bus 1202 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one line is shown in FIG. 12, but it does not mean that there is only one bus or only one type of bus. The bus 1202 can include a path for transmitting information between various components (e.g., the memory 1206, the processor 1204, the communication interface 1208) of the computing device 1200.

[0213] The processor 1204 can include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP), etc.

[0214] The memory 1206 can include volatile memory (volatile memory), such as random access memory (RAM). The processor 1204 can also include non-volatile memory (non-volatile memory), such as read-only memory (ROM), flash memory, a hard disk drive (HDD) or a solid state drive (SSD).

[0215] The executable program code stored in the memory 1206 is executed by the processor 1204 to realize the functions of the aforementioned receiving module, first screening module, second screening module and anomaly detection module, respectively, so as to realize the anomaly detection method. That is, the memory 1206 has instructions for executing the anomaly detection method.

[0216] The communication interface 1208 uses a transceiver module such as, but not limited to, a network interface card and a transceiver to realize the communication between the computing device 1200 and other network devices or communication networks, and the function of forwarding packets.

[0217] The embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device.

[0218] As shown in FIG. 13, the computing device cluster includes at least one computing device 1200. The memory 1206 in each computing device 1200 in the computing device cluster can store the same instructions for executing the anomaly detection method.

[0219] In some possible implementations, the memory 1206 of one or more computing devices 1200 in the computing device cluster can also store partial instructions for executing the anomaly detection method, respectively. In other words, the combination of one or more computing devices 1200 can collectively execute the instructions for executing the anomaly detection method.

[0220] It should be noted that the memories 1206 in different computing devices 1200 in the computing device cluster can store different instructions for executing part of the functions of the anomaly detection apparatus, respectively. That is, the instructions stored in the memories 1206 in different computing devices 1200 can realize the functions of one or more of the interface providing module, the obtaining module, the conversion module and the arrangement module.

[0221] In some possible implementation manners, one or more computing devices in the cluster of computing devices can be connected through a network. The network can be a wide area network or a local area network, etc. FIG. 14 shows a possible implementation manner. As shown in FIG. 14, two computing devices 1200A and 1200B are connected through a network. Specifically, the computing devices are connected to the network through communication interfaces in the computing devices. In this kind of possible implementation manner, the memory 1206 in the computing device 1200A stores instructions for implementing the functions of the receiving module. Meanwhile, the memory 1206 in the computing device 1200B stores instructions for implementing the functions of the first screening module, the second screening module, and the anomaly detection module.

[0222] The connection manner between the cluster of computing devices shown in FIG. 14 can be that, considering that the anomaly detection method provided in the present application needs to receive a large number of packets, it is considered that the functions implemented by the receiving module are executed by the computing device 1200A alone, and the functions implemented by the first screening module, the second screening module, and the anomaly detection module are executed by the computing device 1200B alone.

[0223] It should be understood that the functions of the computing device 1200A shown in FIG. 14 can also be completed by multiple computing devices 1200. Similarly, the functions of the computing device 1200B can also be completed by multiple computing devices 1200.

[0224] The embodiments of the present application also provide a computer program product containing instructions. The computer program product can be software or a program product containing instructions, which can run on a computing device or be stored in any available medium. When the computer program product runs on at least one computing device, the at least one computing device is caused to execute the anomaly detection method.

[0225] The embodiments of the present application also provide a computer readable storage medium. The computer readable storage medium can be any available medium that a computing device can store or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk), etc. The computer readable storage medium contains instructions, which instruct the computing device to execute the anomaly detection method.

[0226] It should be understood that the size of the serial number of each step in the above embodiments does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0227] The above describes the basic principles of the present application in combination with specific embodiments, but it should be noted that the advantages, benefits, effects and the like mentioned in the present application are only examples and are not limiting, and these advantages, benefits, effects and the like cannot be considered as necessary for each embodiment of the present application. In addition, the above specific details of the disclosure are only for the purpose of example and understanding, and are not limiting, and the above details do not limit the disclosure to be necessarily implemented with the above specific details.

[0228] The block diagrams of the devices, apparatuses, equipment, systems involved in the present disclosure are only illustrative examples and are not intended to require or imply the connection, arrangement, configuration as shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, equipment, systems can be connected, arranged, configured in any manner. Words such as "include", "contain", "have" and the like are open-ended words, which mean "including but not limited to", and can be used interchangeably. The words "or" and "and" used herein mean the word "and / or", and can be used interchangeably unless the context clearly indicates otherwise. The word "such as" used herein means the phrase "such as but not limited to", and can be used interchangeably.

[0229] It should also be noted that in the devices, apparatuses and methods of the present disclosure, each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions of the present disclosure.

[0230] The above description has been given for the purpose of illustration and description. Furthermore, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

[0231] It can be understood that the various numerical numbers involved in the embodiments of the present application are only for the purpose of differentiation for convenience of description, and are not used to limit the scope of the embodiments of the present application.

Claims

1. An anomaly detection method characterized by, The method is applied to a network protection device configured to filter packets included in network traffic according to at least two filtering rules, the at least two filtering rules including a first filtering rule and a second filtering rule, and the method includes: receiving a target packet included in the network traffic, the target packet being any one of N packets included in the network traffic, where N is a positive integer greater than or equal to 1, the target packet including a first element and a second element; determining whether the target packet meets the first filtering rule, where the first filtering rule is configured to filter according to a frequency of occurrence of the first element; in a case where the target packet meets the first filtering rule, determining whether the target packet meets the second filtering rule, where the second filtering rule is configured to filter according to a frequency of occurrence of the second element; in a case where the target packet meets the second filtering rule, performing anomaly detection based on the target packet.

2. The method of claim 1, wherein, The first element or the second element includes at least one of the following: at least one element of a five-tuple, a routing hop count, a packet length, a service level, a network protocol, where the first element and the second element are different.

3. The method according to claim 1 or 2, characterized in that, The method further includes: determining a memory usage of the network protection device; in a case where the memory usage exceeds a first threshold, updating at least one of the at least two filtering rules.

4. The method according to any one of claims 1 to 3, characterized in that, The first filtering rule is configured to filter based on a first hash function, and the method further includes: mapping the first element to a first variable in a first count array based on the first hash function; determining the frequency of occurrence of the first element based on a number of mappings of the first variable in the first count array. The second filtering rule is configured to filter based on a second hash function, and the method further includes: mapping the second variable value to a second variable in a second count array based on the second hash function; determining the frequency of occurrence of the second element based on a number of mappings of the second variable in the second count array.

5. The method of claim 4, wherein, The collision rate of the first hash function is less than the collision rate of the second hash function.

6. The method according to claim 4 or 5, characterized in that, The determining whether the target packet meets the first filtering rule includes: in a case where the frequency of occurrence of the first element is greater than or equal to a second threshold, determining that the target packet meets the first filtering rule. The determining whether the target packet meets the second filtering rule includes: in a case where the frequency of occurrence of the second element is greater than or equal to a third threshold, determining that the target packet meets the second filtering rule.

7. The method according to any one of claims 1 to 6, characterized in that, The performing anomaly detection based on the target packet includes: performing anomaly detection on a session including the target packet based on the target packet.

8. An abnormality detection device characterized by comprising: The apparatus is applied to a network protection device configured to filter packets included in network traffic according to at least two filtering rules, the at least two filtering rules including a first filtering rule and a second filtering rule, and the apparatus includes: The receiving module is configured to receive a target packet included in the network traffic, the target packet being any one of N packets included in the network traffic, where N is a positive integer greater than or equal to 1, and the target packet including a first element and a second element; The first screening module is configured to determine whether the target packet meets the first screening rule, where the first screening rule is configured to screen according to a frequency of occurrence of the first element; The second screening module is configured to, in a case where the target packet meets the first screening rule, determine whether the target packet meets the second screening rule, where the second screening rule is configured to screen according to a frequency of occurrence of the second element; The anomaly detection module is configured to, in a case where the target packet meets the second screening rule, perform anomaly detection based on the target packet.

9. The apparatus of claim 8, wherein, The first element or the second element includes at least one of the following: at least one element in a five-tuple, a routing hop count, a packet length, a service level, and a network protocol, where the first element and the second element are different.

10. The apparatus of claim 8 or 9, wherein, The apparatus further includes: The updating module is configured to determine a memory usage of the network protection device, and update at least one of the at least two screening rules when the memory usage exceeds a first threshold.

11. The apparatus of claims 8-10, wherein, The first screening rule is configured to be based on a first hash function, and the first screening module is further configured to map the first element to a first variable in a first counting array based on the first hash function, and determine the frequency of occurrence of the first element based on a number of mappings of the first variable in the first counting array. The second screening rule is configured to be based on a second hash function, and the second screening module is further configured to map the second variable value to a second variable in a second counting array based on the second hash function, and determine the frequency of occurrence of the second element based on a number of mappings of the second variable in the second counting array.

12. The apparatus of claim 11, wherein, The collision rate of the first hash function is less than the collision rate of the second hash function.

13. The apparatus of claim 11 or 12, wherein, The first screening module is configured to determine that the target packet meets the first screening rule in a case where the frequency of occurrence of the first element is greater than or equal to a second threshold. The second screening module is configured to determine that the target packet meets the second screening rule in a case where the frequency of occurrence of the second element is greater than or equal to a third threshold.

14. The apparatus of any one of claims 8 to 13, wherein, The anomaly detection module is configured to perform anomaly detection on a session including the target packet based on the target packet.

15. A cluster of computing devices, characterized in that, The computing device cluster includes at least one computing device, and each computing device includes a processor and a memory: The memory is configured to store instructions; The processor is configured to execute the instructions to cause the computing device cluster to perform the method of any one of claims 1 to 7.

16. A computer program product comprising instructions, characterized in that, The instructions, when executed by the computing device cluster, cause the computing device cluster to perform the method of any one of claims 1 to 7.

17. A computer readable storage medium characterized by: The computer program instructions, when executed by the computing device cluster, cause the computing device cluster to perform the method of any one of claims 1 to 7.

Images