Container-Specific Traffic Detection for Abnormal Access Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional unified security strategies for network traffic detection in container environments result in low detection accuracy, leading to false negatives and false positives due to the specific business meanings of each container, which handle single business-related network requests, making it difficult to identify unknown risks effectively.
Innovation Solution
A traffic detection method that involves obtaining network traffic, parsing it for state information, and invoking a pre-trained traffic identification model specific to the target business container to detect abnormal access, using IP five-tuple information, URL addresses, and request body parameters to form a feature matrix and confidence intervals for accurate detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a unified security strategy is used for all containers, then the detection system is simple to implement, but the detection accuracy is low leading to false positives and negatives
Solution Approach 1:
The patent divides the container environment into multiple business container groups based on business information, with each group having its own specialized traffic identification model. This segmentation allows the system to detect traffic patterns specific to each business type, significantly improving detection accuracy while maintaining manageable complexity through automated model selection.
Solution Approach 2:
The patent implements local quality by creating specialized detection models for different business container groups. Each model is trained on traffic data specific to its business domain, allowing the system to apply the most appropriate detection criteria locally to each container type, thereby improving overall detection accuracy without requiring a completely complex custom system for each container.
2Reliability
If conventional generic defense rules are used, then the system is easy to deploy, but it cannot identify unknown risks in container environments
Solution Approach 1:
The patent performs preliminary action by pre-training multiple traffic identification models for different business container groups before deployment. These models are trained on historical traffic data specific to each business type, enabling the system to identify both known and unknown risks more reliably when actual traffic is detected, while the pre-prepared models simplify the deployment process.
Solution Approach 2:
The patent applies parameter changes by adapting the detection approach to different business container groups through their respective trained models. Each model has learned specific traffic patterns and parameters for its business domain, allowing the system to reliably identify various risks including unknown ones, while the automated model selection and invocation process maintains ease of deployment.
3Measurement precision
If a single detection model is used for all containers, then the system is simple to maintain, but it produces many false positives due to invalid filtering
Solution Approach 1:
The patent implements universality by creating a multi-functional detection system where a single unified security apparatus can handle multiple business container groups. Each group has its own specialized model, but the system provides a universal interface for model selection and invocation, reducing false positives through business-specific detection while maintaining simple maintenance through centralized model management.
Data Source
AI summary
The present disclosure provides a traffic detection method, apparatus, device and storage medium. Network traffic can be obtained and parsed to obtain network state information related to the network traffic; according to the network state information, a target business container associated with the network traffic is searched, and a target traffic identification model corresponding to the target business container is invoked from a pre-trained traffic identification model set, and whether the network traffic is abnormal access network traffic is detected based on the invoked target traffic identification model; and the abnormal access network traffic is intercepted.