WO2021207984A1 - 流量检测方法、装置、服务器以及存储介质 - Google Patents

流量检测方法、装置、服务器以及存储介质 Download PDF

Info

Publication number
WO2021207984A1
WO2021207984A1 PCT/CN2020/084976 CN2020084976W WO2021207984A1 WO 2021207984 A1 WO2021207984 A1 WO 2021207984A1 CN 2020084976 W CN2020084976 W CN 2020084976W WO 2021207984 A1 WO2021207984 A1 WO 2021207984A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
detected
data
traffic
degree
Prior art date
Application number
PCT/CN2020/084976
Other languages
English (en)
French (fr)
Inventor
刘湛卢
Original Assignee
深圳市欢太科技有限公司
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市欢太科技有限公司, Oppo广东移动通信有限公司 filed Critical 深圳市欢太科技有限公司
Priority to PCT/CN2020/084976 priority Critical patent/WO2021207984A1/zh
Priority to CN202080094718.5A priority patent/CN115023926B/zh
Publication of WO2021207984A1 publication Critical patent/WO2021207984A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass

Definitions

  • This application relates to the field of network technology, and more specifically, to a traffic detection method, device, server, and storage medium.
  • this application proposes a traffic detection method, device, server and storage medium to improve the above-mentioned problems.
  • the present application provides a flow detection method, the method includes: obtaining flow data corresponding to a target to be detected within a preset time; performing feature extraction from the flow data to obtain data corresponding to the target to be detected Feature; obtain the degree of matching between the data feature and the target feature; if the degree of matching does not meet the target matching condition, calculate the degree of access confusion corresponding to the target to be detected; if the degree of access confusion meets the threshold condition, determine the The traffic corresponding to the target to be detected is malicious traffic.
  • the present application provides a flow detection device, the device includes: a flow acquisition unit, configured to acquire flow data corresponding to a target to be detected within a preset time; and a feature acquisition unit, configured to obtain data from the flow data Performing feature extraction to obtain the data feature corresponding to the target to be detected; a feature matching unit for obtaining the degree of matching between the data feature and the target feature; and the confusion degree obtaining unit for obtaining the matching degree if the matching degree does not meet the target matching condition, Calculate the degree of access confusion corresponding to the target to be detected; the traffic detection unit is configured to determine that the traffic corresponding to the target to be detected is malicious traffic if the degree of access confusion meets a threshold condition.
  • the present application provides a server including one or more processors and a memory; one or more programs are stored in the memory and configured to be executed by the one or more processors, so The one or more programs are configured to perform the methods described above.
  • the present application provides a computer-readable storage medium having program code executable by a processor, and the program code causes the processor to execute the above-mentioned method.
  • the flow detection method, device, server, and storage medium provided in this application first obtain flow data corresponding to a target to be detected within a preset time, and then perform feature extraction from the flow data to obtain data corresponding to the target to be detected Feature, and then obtain the matching degree between the data feature and the target feature, and then if the matching degree does not meet the target matching condition, then calculate the access confusion level corresponding to the target to be detected, and if the access is confused If the degree satisfies the threshold condition, it is determined that the traffic corresponding to the target to be detected is malicious traffic.
  • the data characteristics of the target to be detected extracted from the data traffic are combined with the degree of access confusion of the detected target to determine whether the traffic corresponding to the target to be detected is malicious traffic, thereby enabling the detection of malicious traffic.
  • the process has better adaptability, accuracy and robustness.
  • Figure 1 shows a flow chart of a flow detection method proposed by this application
  • Figure 2 shows a schematic diagram of an application scenario of a traffic detection method proposed in this application
  • FIG. 3 shows a flow chart of another traffic detection method proposed by this application.
  • FIG. 4 shows a flow chart of yet another method for traffic detection proposed in this application.
  • Fig. 5 shows a flow chart of yet another traffic detection method proposed by the present application
  • Figure 6 shows a flow chart of yet another method for traffic detection proposed in this application.
  • FIG. 7 shows a structural block diagram of a flow detection device proposed by this application.
  • FIG. 8 shows a structural block diagram of another flow detection device proposed by this application.
  • Fig. 9 shows a structural block diagram of an electronic device proposed in this application.
  • FIG. 10 is a storage unit for storing or carrying program code for implementing the flow detection method according to the embodiment of the present application according to an embodiment of the present application.
  • Cyber Attacks also called cyber attacks refer to offensive actions on computer information systems, infrastructure, computer networks, or personal computer equipment. For computers and computer networks, destroying, revealing, modifying, disabling software or services, stealing or accessing data from any computer without authorization will be regarded as attacks on computers and computer networks. .
  • Port scanning is to scan a section of ports or designated ports one by one. Through the scan results, you can know which services are provided on a computer, and then you can attack through the known vulnerabilities of these services provided. Attackers can use port scanning to learn where to find the vulnerability of the attack.
  • the inventor found that it is possible to identify whether there is a malicious port scanning behavior by means of traffic detection. However, the inventor also found that in related traffic detection methods, this is achieved by counting the number of times a fixed port has been accessed within a certain period of time. In this related method, a threshold is specified in advance, and then when the number of accesses of a fixed port in a certain period of time is greater than the threshold, it is determined that there is a port scanning behavior.
  • the threshold value will have a greater impact on the false negatives and false positives of port scanning behavior, and the corresponding service traffic of the ports carrying different services will be different, which will also cause the inability to directly Based on a certain threshold, it is determined whether there is a port scanning behavior, so that the degree of adaptation and accuracy of the relevant malicious traffic detection process need to be improved.
  • the inventor proposes the traffic detection method, device, server and storage medium in this application.
  • the method provided in this application can at least first obtain the traffic data corresponding to the target to be detected within a preset time, and then obtain the Perform feature extraction in the traffic data to obtain the data feature corresponding to the target to be detected, and then obtain the matching degree between the data feature and the target feature, and then if the matching degree does not meet the target matching condition, calculate the The access confusion degree corresponding to the target to be detected, and if the access confusion degree satisfies a threshold condition, it is determined that the traffic corresponding to the target to be detected is malicious traffic.
  • the data characteristics of the target to be detected extracted from the data traffic are combined with the degree of access confusion of the detected target to determine whether the traffic corresponding to the target to be detected is malicious traffic, thereby enabling the detection of malicious traffic.
  • the process has better accuracy and robustness.
  • a traffic detection method provided by this application, the method includes:
  • a device for example, a server
  • network services can be information query, information forwarding, and data storage.
  • the source initiating the access can access the port of the device providing network services through the network to realize information interaction, so as to realize the aforementioned functions of information query, information forwarding, and data storage.
  • the traffic data corresponding to the target to be detected can be understood as data generated during the interaction between the target to be detected and the device providing network services, where the interaction process may include a request process and a corresponding process.
  • the target to be detected can be selected from the source that initiates the access, and in this embodiment, there can be multiple ways to select the target to be detected.
  • the abnormal access behavior includes at least one of the following behaviors: sending the same message content more than a specified number of times; and sending a message in the same time period exceeding the specified number of times.
  • the message sent by the source end initiating the port scan during the scanning process has a certain pattern.
  • the message sent by the source controlled by the attacker usually does not carry information about the business, and for the message sent by the source controlled by the attacker, some private fields will be added to some specific fields.
  • logo In this case, if it is detected that the source end has sent the same message that does not carry business information multiple times within a certain period of time, then it can be determined that the source end has abnormal access behavior, and the source end is determined to be a pending message. Detection target.
  • the message sent by the legitimate visitor will carry a certain business identifier (the aforementioned business information can be understood).
  • the device that provides network services can determine the business expected by the legitimate visitor by detecting the business identifier in the message.
  • the service identifier "storage” can be configured to correspond to the service of storing data
  • the service identifier "infor_query” can be configured to correspond to the service of information query
  • the device providing network services detects that the message carries the service identifier " storage” can determine whether it is necessary to store the business data carried in the message, and if the device providing network services detects that the message carries the business identifier "infor_query", it can be identified that it needs to be based on the message Information query carried by keywords. Therefore, when the device that provides network services detects that the message identified from the traffic data corresponding to the source does not carry the service identifier, and the source also sends the message without the service identifier multiple times Next, identify the source as the target to be detected.
  • each source can be detected in turn, so that the malicious traffic can be scanned and detected more comprehensively, but If the number of all sources identified from all the traffic data is large, each source is still detected in turn, which may cause a large burden of calculation. As a way, in the embodiment of the present application, it is possible to determine which source is currently determined as the target to be detected according to the real-time situation.
  • the source of abnormal access behavior can be detected correspondingly from all the sources including all the traffic data.
  • the end is the target to be detected, or the source identified in the traffic data in the most recent time period is determined as the target to be detected. Among them, the most recent time period can be within a week or within a day.
  • all source ends included in all the traffic data may be used as targets to be detected. Among them, it is possible to determine whether the current business data is peak or trough based on the data throughput per second.
  • the data throughput per second is greater than the first threshold, it is determined that the business carried by the device currently providing network services is in the peak period of business data interaction. If it is detected that the data throughput per second is less than the second threshold, It is determined that the service carried by the device currently providing network service is in a low period of service data interaction, where the second threshold is smaller than the first threshold.
  • S120 Perform feature extraction from the flow data to obtain the data feature corresponding to the target to be detected.
  • the data feature may be a unique identifier in the message sent by the corresponding target to be detected.
  • the unique identifier may be an identifier in at least one of the multiple network layers corresponding to the message.
  • the corresponding multiple network layers may include application layer, transport layer, network layer, and link Floor.
  • the message sent by the source corresponding to the identified malicious traffic can be detected, so as to detect that the message sent by the source corresponding to the identified malicious traffic is compared with the legitimate What is the difference in the message structure of the message sent by the source end or the value of the agreed parameters of the protocol, so as to use the difference as a data feature corresponding to the message sent by the source end that triggers malicious traffic, and then Use the detected data characteristics corresponding to the packets sent by the source that triggers malicious traffic as the target characteristics.
  • the difference is about the difference in the structure of the message or the difference in the value of the protocol agreed parameter of the message, not just the difference in the information transmitted by the message.
  • the communication protocol used in the communication process may be negotiated first, and then the message is generated according to the negotiated communication protocol.
  • the message is generated according to the format defined by the protocol.
  • the adopted communication protocol definition needs to generate the header part, the data part and the end part, then when generating the message, it is necessary to generate the header part, the data part of the message, and the message respectively.
  • the end of the text if it is detected that the message sent by the source corresponding to the identified malicious traffic has only the header part of the message and the data part of the message, but there is no end part of the message, Then the message lacking the end part can be identified as the message structure different from the message sent by the legal source (which will include the header part of the message, the data part of the message, and the end part of the message).
  • each part defined by the communication protocol will specifically include multiple fields (that is, the protocol agreement parameters), and for some sources that trigger malicious traffic, the triggered messages may lack some
  • the value of a field or some fields is different from the usual agreed value.
  • the first field, the second field, and the third field are agreed upon in the header part of the message, if the header part of the message sent by the source corresponding to the malicious traffic has been identified If there is only the first field and the second field, but not the third field, the lack of the third field in the header part can be used as the difference in the value of the agreed parameter of the protocol.
  • the header part of the message sent by the source corresponding to the malicious traffic that has been identified is only If there is a first field and a third field, but no second field, the lack of the second field in the header part can be used as the difference in the value of the protocol agreed parameter.
  • the feature items specifically included in the defined target feature can be obtained by statistics, and then after the data flow corresponding to the target feature to be detected is obtained, the data flow data corresponding to the target feature to be detected can be obtained based on the feature items specifically included in the target feature. feature.
  • the feature items specifically included in the target feature include three items: the structure of the message lacks the end part, the header part lacks the first field, and the value of the first parameter of the header part is the specified value, then the acquisition After the data flow corresponding to the target to be detected is reached, the degree of satisfaction of these three items can be determined from it, and then the data characteristics corresponding to the target to be detected can be obtained.
  • the degree of matching characterizes the number of feature items that are specifically included in the target feature that is satisfied by the data feature corresponding to the target to be detected. The more the corresponding number of items that are satisfied, the more the data flow corresponding to the target to be detected. The higher the matching degree between the data feature and the target feature.
  • the target matching condition may be a threshold.
  • the target matching condition may be a threshold.
  • the value of the first parameter of the field and the header part is the specified value, and then it can be determined that the matching degree between the data feature of the target to be detected and the target feature is 2. If the target threshold is 3, the target to be detected can be determined The matching degree between the data feature and the target feature does not meet the target matching condition, and if the target threshold is 2, it can be determined that the matching degree between the data feature of the target to be detected and the target feature meets the target matching condition.
  • the characterization cannot directly determine whether the data traffic corresponding to the target to be detected is malicious traffic, and then the degree of access confusion corresponding to the target to be detected can be obtained again, so that Furthermore, it is determined whether the data traffic corresponding to the target to be detected is malicious traffic according to the degree of access confusion corresponding to the target to be detected.
  • the entropy of the data traffic corresponding to the target to be detected may be calculated to determine the degree of access confusion corresponding to the target to be detected.
  • the device that executes the traffic detection method provided in this embodiment may be the device itself that provides network services, or may be executed by a device other than the device that provides network services.
  • the network environment as shown in FIG. 2 includes a source 110 that communicates with each other through a network 140, a device 120 that provides network services, and a detection device 130.
  • execution of the traffic detection method provided in this embodiment may be executed by the device 120 that provides network services, and may also be executed by the detection device 130.
  • the flow detection method provided by this application first obtains the flow data corresponding to the target to be detected within a preset time, then performs feature extraction from the flow data to obtain the data characteristics corresponding to the target to be detected, and then obtains the The degree of matching between the data feature and the target feature, and then if the degree of matching does not meet the target matching condition, the degree of access confusion corresponding to the target to be detected is calculated, and if the degree of access confusion meets the threshold condition, it is determined
  • the traffic corresponding to the target to be detected is malicious traffic.
  • the data characteristics of the target to be detected extracted from the data traffic are combined with the degree of access confusion of the detected target to determine whether the traffic corresponding to the target to be detected is malicious traffic, thereby enabling the detection of malicious traffic.
  • the process has better accuracy and robustness.
  • a traffic detection method provided by the present application, the method includes:
  • S220 Perform feature extraction from the flow data to obtain the data feature corresponding to the target to be detected.
  • certain virtual ports are defined as communication channels in some communication protocols.
  • TCP/IP protocol an IP address and port are used together to determine a communication channel.
  • the target end corresponding to the attacker will detect which ports can be used for network attacks through port scanning. Therefore, in this embodiment, the degree of access confusion corresponding to the target to be detected can be determined based on the access status of the target to the port. In this embodiment, there may be multiple ways to determine the subsequent access confusion degree port corresponding to the target to be detected.
  • the obtaining the ports visited by the target to be detected includes: obtaining the ports visited by the target to be detected within a specified time window.
  • the method further includes: adjusting the length of the specified time window based on the size of the flow data corresponding to the target to be detected; wherein, if it is detected that the flow data is within the specified time window Decrease within and increase the length of the specified time window.
  • the client corresponding to the attacker does not always perform port scans on the equipment that provides network services. Therefore, in order to detect the traffic data corresponding to the detection target more comprehensively, it can be obtained periodically.
  • the port that the target to be detected has visited is then implemented to periodically detect the traffic data corresponding to the target to be detected.
  • the designated time window is a time window corresponding to one period in the detection period.
  • the flow data can be detected once a day respectively, and in this case, the length of the designated time window is 24 hours corresponding to one day.
  • increasing the length of the specified time window includes: if it is detected that the flow data is within a specified time within the specified time window Decrease in the interval, increase the length of the specified time window; if it is detected that the flow data decreases outside the specified time interval within the specified time window, keep the length of the specified time window unchanged.
  • the target to be detected (source) corresponding to the attacker reduces the traffic generated during the port scanning process by itself, for the specified time corresponding to the current period
  • the total traffic data in the window will not have much impact, but if at the beginning of the specified time window, the target to be detected (source) corresponding to the attacker reduces the traffic generated during the port scanning process by itself, then It will be more obvious that the total flow rate in the specified time window corresponding to the current cycle is reduced, so by reducing and increasing the length of the specified time window within the specified time interval within the specified time window, it can be more To effectively realize the regulation of the length of the specified time window.
  • the start time of the specified time interval is the start time of the specified time window
  • the end time of the specified time interval is the middle time of the specified time window.
  • increasing the length of the specified time window includes: if it is detected that the flow data is in the specified time window, Decrease within a specified time window, and obtain the decrease magnitude of the data flow within the specified time window; obtain the corresponding window increase duration based on the decrease magnitude, wherein the window corresponding to the larger the decrease magnitude The length of the increase is longer; the length of the specified time window is increased by the length of the window increase.
  • the obtaining the activity corresponding to each of the accessed ports includes: separately comparing the amount of access data corresponding to each of the accessed ports with the total amount corresponding to the accessed ports.
  • the data volume is compared to obtain the activity corresponding to each of the accessed ports; wherein, the total data volume corresponding to the accessed ports is the sum of the access data volume corresponding to each of the accessed ports .
  • S242 Calculate the degree of access confusion corresponding to the target to be detected based on the activity corresponding to each of the accessed ports.
  • the calculation of the degree of access confusion corresponding to the target to be detected based on the activity corresponding to each of the visited ports includes: comparing the activity corresponding to each of the visited ports with all the The product of the logarithm of the activity is taken as the designated intermediate value corresponding to each of the visited ports; the sum of the designated intermediate value corresponding to each of the visited ports is taken as the activity that characterizes the degree of chaos of the visit entropy.
  • obtaining the set of ports visited by the target to be detected is:
  • a i represents the amount of access data corresponding to the port for which the port activity calculation is currently performed. and It characterizes the sum of the amount of access data corresponding to all ports in the set of accessed ports.
  • the amount of access data is the number of data packets generated by the interaction.
  • the active entropy can be calculated by the following formula:
  • the flow detection method provided by this application first obtains the flow data corresponding to the target to be detected within a preset time, then performs feature extraction from the flow data to obtain the data characteristics corresponding to the target to be detected, and then obtains the The degree of matching between the data feature and the target feature, and then if the degree of matching does not meet the target matching condition, the ports visited by the target to be detected are obtained, and the activity corresponding to each of the visited ports is obtained , And then calculate the degree of access confusion corresponding to the target to be detected based on the activity corresponding to each of the visited ports, and if the degree of access confusion satisfies the threshold condition, it is determined that the traffic corresponding to the target to be detected is malicious flow.
  • the activity corresponding to each of the visited ports is calculated to obtain the degree of access confusion corresponding to the target to be detected.
  • the extracted data characteristics of the target to be detected are combined with the degree of access confusion of the detected target to determine whether the traffic corresponding to the target to be detected is malicious traffic, so that the malicious traffic detection process has better accuracy and robustness .
  • a traffic detection method provided by this application, the method includes:
  • S320 Extract the packet corresponding to the detection target from the data traffic corresponding to the target to be detected.
  • One method is based on multiple network hierarchies, respectively, and extracts the packets of the detection target corresponding to the multiple network hierarchies from the data traffic corresponding to the target to be detected.
  • the network layer includes an application layer and a transport layer.
  • S340 Acquire the degree of matching between the data feature and the target feature.
  • the traffic detection method provided by this application first obtains the data traffic corresponding to the target to be detected from a network adapter, and then extracts the packet corresponding to the detection target from the data traffic corresponding to the target to be detected, and The data feature corresponding to the target to be detected is obtained in the message, and then the matching degree between the data feature and the target feature is obtained, and then if the matching degree does not meet the target matching condition, the The degree of access confusion corresponding to the target to be detected, and if the degree of access confusion satisfies a threshold condition, it is determined that the traffic corresponding to the target to be detected is malicious traffic.
  • the data flow corresponding to the target to be detected can be directly obtained from the network adapter, so that based on the foregoing method, the data characteristics and detection of the target to be detected can be directly extracted from the data flow obtained from the network adapter.
  • the target's access confusion degree is combined to determine whether the traffic corresponding to the target to be detected is malicious traffic, so that the malicious traffic detection process has better accuracy and robustness.
  • data features can be extracted from the message, and data features can be extracted from multiple network layers respectively, thereby making it possible to detect malicious traffic more accurately and comprehensively.
  • a traffic detection method provided by this application, the method includes:
  • S420 Perform feature extraction from the flow data to obtain the data feature corresponding to the target to be detected.
  • S430 Acquire the degree of matching between the data feature and the target feature.
  • the flow detection method provided by this application first obtains the flow data corresponding to the target to be detected within a preset time, then performs feature extraction from the flow data to obtain the data characteristics corresponding to the target to be detected, and then obtains the The degree of matching between the data feature and the target feature, and then if the degree of matching does not meet the target matching condition, the degree of access confusion corresponding to the target to be detected is calculated, and if the degree of access confusion meets the threshold condition, it is determined
  • the traffic corresponding to the target to be detected is malicious traffic. In this way, the data characteristics of the target to be detected extracted from the data traffic are combined with the degree of access confusion of the detected target to determine whether the traffic corresponding to the target to be detected is malicious traffic, thereby enabling the detection of malicious traffic.
  • the process has better accuracy and robustness.
  • the threshold conditions corresponding to the different matching degrees are different, so that the detection of malicious traffic is more flexible and accurate. It should be noted that in the case where the degree of matching between the data feature corresponding to the target to be detected and the target feature does not meet the target matching condition, the feature item included in the target feature satisfied by the data feature corresponding to the target to be detected is more If there are more, then the target to be detected is more likely to trigger malicious traffic. In this case, it can be configured that the higher the matching degree, the lower the value included in the corresponding threshold condition.
  • the flow data in the network adapter can be extracted by means of packet extraction, and a data block can be generated.
  • a corresponding data block can be generated for each target to be detected.
  • feature extraction is performed on the data block, where the feature extraction can be understood as the feature extraction from the flow data in the foregoing embodiment to obtain the data feature corresponding to the target to be detected.
  • feature matching is performed on the extracted data features.
  • the feature matching step in Figure X can be understood as obtaining the degree of matching between the data feature and the target feature in the foregoing embodiment.
  • the detection structure is determined to be a definite feature, and then it is determined that the target to be detected corresponding to the data block from which the data feature originates corresponds to malicious scanning behavior . If it is detected that the extracted data feature does not meet the target matching condition, but the data feature matches at least one of the feature items included in the target feature, it is determined as a suspected feature, and the suspected feature entropy calculation is performed. It is detected that the extracted data feature does not meet the target matching condition, and the data feature does not match the feature items included in the target feature, then the feature-free entropy calculation is performed.
  • the data to be determined from which the data feature originates corresponds to a malicious scanning behavior. Conversely, it is determined that the data access behavior of the target to be detected corresponding to the block to be detected from which the data feature originates is a normal behavior.
  • the calculation process of the suspected feature entropy calculation and the feature-free entropy calculation is the same as the calculation process of the active entropy in the foregoing embodiment, except that the malicious interval corresponding to the suspected feature entropy calculation and the feature-free entropy calculation are different.
  • a flow detection device 500 provided by the present application, the device 500 includes:
  • the flow acquisition unit 510 is configured to acquire flow data corresponding to the target to be detected within a preset time.
  • the feature acquisition unit 520 is configured to perform feature extraction from the flow data to obtain the data feature corresponding to the target to be detected.
  • the feature matching unit 530 is configured to obtain the degree of matching between the data feature and the target feature.
  • the confusion degree acquiring unit 540 is configured to calculate the access confusion degree corresponding to the target to be detected if the matching degree does not meet the target matching condition.
  • the traffic detection unit 550 is configured to determine that the traffic corresponding to the target to be detected is malicious traffic if the degree of access confusion meets a threshold condition.
  • the confusion degree obtaining unit 540 is specifically configured to obtain the ports visited by the target to be detected; obtain the activity corresponding to each of the visited ports; The activity degree is calculated to obtain the degree of access confusion corresponding to the target to be detected.
  • the confusion degree obtaining unit 540 is specifically configured to obtain the ports that the target to be detected has visited within a specified time window.
  • the device further includes a window adjustment unit 541, configured to adjust the length of the designated time window based on the size of the traffic data corresponding to the target to be detected; wherein, if It is detected that the flow data decreases within the specified time window, and the length of the specified time window is increased.
  • the window adjustment unit 541 is specifically configured to increase the length of the specified time window if it is detected that the flow data has decreased within a specified time interval within the specified time window; if the flow data is detected Decrease outside the specified time interval within the specified time window, and keep the length of the specified time window unchanged.
  • the start time of the specified time interval is the start time of the specified time window
  • the end time of the specified time interval is the middle time of the specified time window.
  • the window adjustment unit 541 is specifically configured to, if it is detected that the flow data has decreased within the specified time window, obtain the magnitude of the decrease of the data flow within the specified time window; based on the decrease The corresponding window increase duration is acquired in a small amplitude, wherein the larger the decrease amplitude corresponds to the longer the window increase duration; the length of the specified time window is increased by the window increase duration.
  • the confusion degree obtaining unit 540 is specifically configured to separately compare the amount of access data corresponding to each of the accessed ports with the total amount of data corresponding to the accessed ports to obtain each The activity level corresponding to the accessed port; wherein the total data volume corresponding to the accessed port is the sum of the access data volume corresponding to each of the accessed ports.
  • the confusion degree obtaining unit 540 is specifically configured to use the product of the activity degree corresponding to each of the visited ports and the logarithm of the activity degree as the designated middle corresponding to each of the visited ports. Value; the sum of the designated intermediate values corresponding to each of the visited ports is used as the active entropy that characterizes the degree of chaos of the visit.
  • the traffic acquiring unit 510 is specifically configured to acquire the data traffic corresponding to the target to be detected from the network adapter.
  • the feature acquisition unit 520 is specifically configured to extract the message corresponding to the detection target from the data traffic corresponding to the target to be detected; and obtain the message corresponding to the target to be detected from the message.
  • Data characteristics the feature acquisition unit 520 is specifically configured to extract, from the data traffic corresponding to the target to be detected, the message corresponding to the multiple network layers by the detection target based on multiple network layers, respectively.
  • the network layer includes an application layer and a transport layer.
  • the traffic detection unit 550 is specifically configured to determine that the traffic corresponding to the target to be detected is malicious traffic if the degree of access confusion satisfies the threshold condition corresponding to the matching degree, wherein the matching degree is different The corresponding threshold conditions are different.
  • the traffic detection unit 550 is further configured to determine that the traffic corresponding to the target to be detected is malicious traffic if the matching degree meets the target condition.
  • the flow acquisition unit 510 is also used to acquire all the flow data; all sources included in the all flow data are used as targets to be detected.
  • the traffic acquiring unit 510 is further configured to acquire all traffic data; among all the source terminals included in the traffic data, the source terminal corresponding to the detected abnormal access behavior is used as the target to be detected.
  • the abnormal access behavior includes at least one of the following behaviors: sending the same message content more than a specified number of times; and sending a message in the same time period exceeding the specified number of times.
  • the flow detection device provided by the present application first obtains flow data corresponding to a target to be detected within a preset time, then performs feature extraction from the flow data to obtain the data characteristics corresponding to the target to be detected, and then obtains the The degree of matching between the data feature and the target feature, and then if the degree of matching does not meet the target matching condition, the degree of access confusion corresponding to the target to be detected is calculated, and if the degree of access confusion meets the threshold condition, it is determined
  • the traffic corresponding to the target to be detected is malicious traffic.
  • the data characteristics of the target to be detected extracted from the data traffic are combined with the degree of access confusion of the detected target to determine whether the traffic corresponding to the target to be detected is malicious traffic, thereby enabling the detection of malicious traffic.
  • the process has better accuracy and robustness.
  • an embodiment of the present application also provides another electronic device 200 including a processor 102 that can execute the foregoing short message pushing method.
  • the electronic device 200 further includes a memory 104 and a network module 106.
  • the memory 104 stores a program that can execute the content in the foregoing embodiment, and the processor 102 can execute the program stored in the memory 104.
  • the processor 102 uses various interfaces and lines to connect various parts of the entire electronic device 200, by running or executing instructions, programs, code sets, or instruction sets stored in the memory 104, and calling data stored in the memory 104 , Perform various functions of the electronic device 200 and process data.
  • the processor 102 may use at least one of digital signal processing (Digital Signal Processing, DSP), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA), and Programmable Logic Array (Programmable Logic Array, PLA).
  • DSP Digital Signal Processing
  • FPGA Field-Programmable Gate Array
  • PLA Programmable Logic Array
  • the processor 102 may integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a modem, and the like.
  • the CPU mainly processes the operating system, user interface, and application programs; the GPU is used for rendering and drawing of display content; the modem is used for processing wireless communication. It is understandable that the above-mentioned modem may not be integrated into the processor 102, but may be implemented by a communication chip alone.
  • the memory 104 may include random access memory (RAM) or read-only memory (Read-Only Memory).
  • the memory 104 may be used to store instructions, programs, codes, code sets or instruction sets.
  • the memory 104 may include a storage program area and a storage data area, where the storage program area may store instructions for implementing the operating system and instructions for implementing at least one function (such as touch function, sound playback function, image playback function, etc.) , Instructions used to implement the following various method embodiments, etc.
  • the data storage area can also store data (such as phone book, audio and video data, chat record data) created by the terminal 100 during use.
  • the network module 106 is used to receive and send electromagnetic waves, and realize the mutual conversion between electromagnetic waves and electrical signals, so as to communicate with a communication network or other devices, such as with an audio playback device.
  • the network module 106 may include various existing circuit elements for performing these functions, for example, an antenna, a radio frequency transceiver, a digital signal processor, an encryption/decryption chip, a subscriber identity module (SIM) card, a memory, etc. .
  • SIM subscriber identity module
  • the network module 106 can communicate with various networks, such as the Internet, an intranet, and a wireless network, or communicate with other devices through a wireless network.
  • the aforementioned wireless network may include a cellular telephone network, a wireless local area network, or a metropolitan area network.
  • the network module 106 can exchange information with the base station.
  • the electronic device 200 may be a server that executes the foregoing method embodiments.
  • FIG. 10 shows a structural block diagram of a computer-readable storage medium provided by an embodiment of the present application.
  • the computer-readable medium 1100 stores program code, and the program code can be invoked by a processor to execute the method described in the foregoing method embodiment.
  • the computer-readable storage medium 1100 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM.
  • the computer-readable storage medium 1100 includes a non-transitory computer-readable storage medium.
  • the computer-readable storage medium 1100 has a storage space for executing the program code 810 of any method step in the above-mentioned method. These program codes can be read from or written into one or more computer program products.
  • the program code 1110 may be compressed in an appropriate form, for example.
  • the traffic detection method, device, server, and storage medium provided by the present application first obtain the traffic data corresponding to the target to be detected within a preset time, and then perform feature extraction from the traffic data to obtain the target. Detect the data feature corresponding to the target, and then obtain the matching degree between the data feature and the target feature, and then if the matching degree does not meet the target matching condition, then calculate the access confusion degree corresponding to the target to be detected, and If the degree of access confusion satisfies the threshold condition, it is determined that the traffic corresponding to the target to be detected is malicious traffic.
  • the data characteristics of the target to be detected extracted from the data traffic are combined with the degree of access confusion of the detected target to determine whether the traffic corresponding to the target to be detected is malicious traffic, thereby enabling the detection of malicious traffic.
  • the process has better adaptability, accuracy and robustness.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种流量检测方法、装置、服务器以及存储介质。方法包括：获取预设时间内待检测目标对应的流量数据；从流量数据中进行特征提取得到待检测目标对应的数据特征；获取数据特征与目标特征的匹配程度；若匹配程度不满足目标匹配条件，计算待检测目标对应的访问混乱程度；若访问混乱程度满足阈值条件，确定待检测目标对应的流量为恶意流量。通过将从数据流量中提取出的待检测目标对应的数据特征与待检测目标对应的访问混乱程度相结合的方式来确定待检测目标对应的流量是否为恶意流量，使得恶意流量的检测过程具有更好的自适应性、准确性以及鲁棒性。

Description

流量检测方法、装置、服务器以及存储介质 技术领域
本申请涉及网络技术领域，更具体地，涉及一种流量检测方法、装置、服务器以及存储介质。
背景技术
随着网络技术的发展，出现了网络攻击者利用网络中的一些漏洞进行网络攻击。在相关的预防网络攻击的方式中，可以通过进行恶意流量的检测的方式来进行网络攻击的预警，然而在相关的恶意流量的检测过程的自适应程度以及准确性都有待提升。
发明内容
鉴于上述问题，本申请提出了一种流量检测方法、装置、服务器以及存储介质，以改善上述问题。
第一方面，本申请提供了一种流量检测方法，所述方法包括：获取预设时间内待检测目标对应的流量数据；从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征；获取所述数据特征与目标特征的匹配程度；若所述匹配程度不满足目标匹配条件，计算所述待检测目标对应的访问混乱程度；若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。
第二方面，本申请提供了一种流量检测装置，所述装置包括：流量获取单元，用于获取预设时间内待检测目标对应的流量数据；特征获取单元，用于从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征；特征匹配单元，用于获取所述数据特征与目标特征的匹配程度；混乱度获取单元，用于若所述匹配程度不满足目标匹配条件，计算所述待检测目标对应的访问混乱程度；流量检测单元，用于若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。
第三方面，本申请提供了一种服务器，包括一个或多个处理器以及存储器；一个或多个程序被存储在所述存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序配置用于执行上述的方法。
第四方面，本申请提供了一种具有处理器可执行的程序代码的计算机可读存储介质，所述程序代码使所述处理器执行上述的方法。
本申请提供的一种流量检测方法、装置、服务器以及存储介质，先获取预设时间内待检测目标对应的流量数据，然后从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征，进而再获取所述数据特征与目标特征的匹配程度，然后若所述匹配程度不满足目标匹配条件的情况下，再计算所述待检 测目标对应的访问混乱程度，并且若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。从而通过前述方式实现了将从数据流量中提取出的待检测目标的数据特征与检测目标的访问混乱程度相结合的方式来确定待检测目标对应的流量是否为恶意流量，从而使得恶意流量的检测过程具有更好的自适应性、准确性以及鲁棒性。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示出了本申请提出的一种流量检测方法的流程图；
图2示出了本申请提出的一种流量检测方法的应用场景示意图；
图3示出了本申请提出的另一种流量检测方法的流程图；
图4示出了本申请提出的再一种流量检测方法的流程图；
图5示出了本申请提出的又一种流量检测方法的流程图；
图6示出了本申请提出的又一种流量检测方法的流程图；
图7示出了本申请提出的一种流量检测装置的结构框图；
图8示出了本申请提出的另一种流量检测装置的结构框图；
图9示出了本申请提出的一种电子设备的结构框图。
图10是本申请实施例的用于保存或者携带实现根据本申请实施例的流量检测方法的程序代码的存储单元。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
网络攻击(Cyber Attacks，也称赛博攻击)是指针对计算机信息系统、基础设施、计算机网络或个人计算机设备的进攻动作。对于计算机和计算机网络来说，破坏、揭露、修改、使软件或服务失去功能、在没有得到授权的情况下偷取或访问任何一计算机的数据，都会被视为于计算机和计算机网络中的攻击。
发明人在对网络攻击的研究中发现，在网络攻击之前可能会存在一定的端口扫描。端口扫描，顾名思义，就是逐个对一段端口或指定的端口进行扫描。通过扫描结果可以知道一台计算机上都提供了哪些服务，然后就可以通过所提供的这些服务的己知漏洞就可进行攻击。攻击者可以通过端口扫描了解到从哪里可探寻到攻击弱点。
而为了应对端口扫描行为，发明人发现可以通过流量检测的方式来识别 到是否有恶意的端口扫描行为。但是，发明人还发现在相关的流量检测方式中，是通过统计固定端口在一定时间内的访问次数来实现的。在这种相关的方式中会预先指定一个阈值，然后在固定端口在一定时间内的访问次数大于该阈值的情况下就确定存在端口扫描行为。然而在这种方式中，阈值的高低对于端口扫描行为的漏报以及误报都会产生较大的影响，并且承载不同业务的端口本身对应的业务流量就会有所不同，继而也会造成无法直接基于某个阈值就确定是否存在端口扫描行为，从而造成相关的恶意流量的检测过程的自适应程度以及准确性都有待提升。
因此，为了改善上述问题，发明人提出了本申请中的流量检测方法、装置、服务器以及存储介质，本申请提供的方法至少可以先获取预设时间内待检测目标对应的流量数据，然后从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征，进而再获取所述数据特征与目标特征的匹配程度，然后若所述匹配程度不满足目标匹配条件的情况下，再计算所述待检测目标对应的访问混乱程度，并且若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。从而通过前述方式实现了将从数据流量中提取出的待检测目标的数据特征与检测目标的访问混乱程度相结合的方式来确定待检测目标对应的流量是否为恶意流量，从而使得恶意流量的检测过程具有更好的准确性以及鲁棒性。
下面将结合附图具体描述本申请的各实施例。
请参阅图1，本申请提供的一种流量检测方法，所述方法包括：
S110：获取预设时间内待检测目标对应的流量数据。
需要说明的是，在本申请实施例中可以将提供网络服务的设备(例如，服务器)理解为主机设备。其中，网络服务可以为信息查询、信息转发以及数据存储等。在这种情况下，发起访问的源端可以通过网络访问提供网络服务的设备的端口进而实现信息的交互，以实现前述指出的信息查询、信息转发以及数据存储等功能。在本实施例中，待检测目标对应的流量数据可以理解为待检测目标与提供网络服务的设备的交互过程中所产生的数据，其中，交互过程可以包括请求过程以及相应过程。可选的，在本实施例中可以从发起访问的源端中选择待检测目标，并且在本实施例中可以有多种的进行待检测目标选择的方式。
作为一种方式，获取所有的流量数据，将所述所有的流量数据包括的所有源端均作为待检测目标。在这种方式中，会对所有的源端的流量数据均进行检测，进而将所有的源端均作为待检测目标。
作为另外一种方式，获取所有的流量数据，将所述所有的流量数据包括的所有源端中对应检测到异常访问行为的源端作为待检测目标。在这种方式中，可以从所有的源端中筛选出部分的源端作为待检测目标。并且，在这种方式下，所述异常访问行为包括以下行为中的至少一个：超过指定次数发送相同的报文内容；以及超过指定次数在同一时间段发送报文。
需要说明的是，对于进行端口扫描的攻击者而言，可能更大概率会在夜间控制源端发起端口扫描。并且，发明人在研究中还发现发起端口扫描的源端在扫描过程中所发送的报文是具有一定规律的。例如，攻击者所控制的源端所发 送的报文通常是不会携带关于业务的信息，并且对于攻击者所控制的源端所发送的报文还会在一些特定的字段中加入一些私有的标识。在这种情况下，若检测到源端在一定时间内多次发送相同的且并不携带业务信息的报文，那么就可以确定该源端存在异常访问行为，进而将该源端确定为待检测目标。
作为一种方式，为了识别合法访问者所需要进行的业务需求，合法访问者所发送的报文中会携带一定的业务标识(可以理解前述的业务信息)。在这种方式下，提供网络服务的设备可以通过检测报文中的业务标识来确定合法访问者所期望进行的业务。示例性的，可以配置业务标识“storage”对应于存储数据的业务，可以配置业务标识“infor_query”对应于信息查询的业务，那么当提供网络服务的设备在检测到报文中携带有业务标识“storage”就可以确定是需要将报文中所携带的业务数据进行存储，而若当提供网络服务的设备在检测到报文中携带有业务标识“infor_query”，就可以识别到是需要基于报文中所携带的关键词进行信息查询。因此，当提供网络服务的设备在检测到从源端对应的流量数据中所识别出的报文中并未携带业务标识，且该源端还多次发送该未携带业务标识的报文的情况下，将该源端识别为待检测目标。
需要说明的是，若直接将所述所有的流量数据包括的所有源端均作为待检测目标，那么可以对每个源端均进行依次检测，进而可以更加全面的进行恶意流量的扫描检测，但是若在从所有的流量数据中所识别出的所有的源端的数量较多的情况下，依然对每个源端均进行依次检测，就可能会造成较大的计算量负担。作为一种方式，在本申请实施例中可以根据实时情况确定当前具体是将哪些源端确定为待检测目标。
可选的，若检测到当前提供网络服务的设备所承载的业务处于业务数据交互的高峰期，那么就可以从将所述所有的流量数据包括的所有源端中对应检测到异常访问行为的源端作为待检测目标，或者是将最近时间段内的流量数据中所识别出的源端确定为待检测目标。其中，最近时间段可以为一周时间内，或者是一天时间内。可选的，若检测到当前提供网络服务的设备所承载的业务处于业务数据交互的低谷期，那么就可以将所述所有的流量数据包括的所有源端均作为待检测目标。其中，可以基于每秒钟内的数据吞吐量来确定当前是业务数据的高峰期还是低谷期。若每秒钟内的数据吞吐量大于第一阈值，则确定当前提供网络服务的设备所承载的业务处于业务数据交互的高峰期，若检测到每秒钟内的数据吞吐量小于第二阈值，则确定当前提供网络服务的设备所承载的业务处于业务数据交互的低谷期，其中，第二阈值小于该第一阈值。
S120：从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征。
可选的，在本实施例中数据特征可以为对应的待检测目标所发送的报文中特有的标识。其中，该特有的标识可以为报文所对应的多个网络分层中至少一个网络分层中的标识。可选的，若待检测目标与提供网络服务的设备之间为基于TCP/IP协议进行通信，那么该所对应的多个网络分层就可以包括有应用层、传输层、网络层以及链路层。
S130：获取所述数据特征与目标特征的匹配程度。
可选的，可以对已经被识别出的恶意流量所对应的源端所发送的报文进行检测，从而检测出该已经识别出的恶意流量所对应的源端所发送的报文相比于合法源端所发送的报文在报文结构上或者关于协议约定参数的取值方面会有什么区别，以将该区别作为一种会触发恶意流量的源端所发送报文对应的数据特征，进而将所检测出的所有会触发恶意流量的源端所发送的报文对应的数据特征作为目标特征。
需要说明的是，该区别是关于报文的结构上的区别或者是在报文的关于协议约定参数的取值方面的区别，而不仅仅是关于报文所传输的信息的区别。可选的，对于通信的双方而言，可以先协商在通信过程中所采用的通信协议，进而根据所协商的通信协议来进行报文的生成。其中，在生成报文的过程中会根据协议所定义的格式来进行报文的生成。
示例性的，若所采用的通信协议定义需要生成头部部分、数据部分以及结尾部分，那么在进行报文的生成时，就需要分别生成报文的头部部分、报文的数据部分以及报文的结尾部分。在这种情况下，若检测到已经被识别出的恶意流量所对应的源端所发送的报文中仅仅只有报文的头部部分以及报文的数据部分，但是没有报文的结尾部分，那么就可以将缺乏结尾部分的报文识别为与合法源端所发送的报文(会包括报文的头部部分、报文的数据部分以及报文的结尾部分)在报文结构存在区别。类似的，若检测到已经被识别出的恶意流量所对应的源端所发送的报文中仅仅只有报文的头部部分以及报文的结尾部分，但是没有报文的数据部分，那么就可以将缺乏数据部分的报文识别为与合法源端所发送的报文(会包括报文的头部部分、报文的数据部分以及报文的结尾部分)在报文结构存在区别。
再者，对于通信协议所定义的每个部分又会具体包括多个字段(即关于协议约定参数)，而对于一些会触发恶意流量的源端而言，所触发的报文中可能会缺乏一些字段或者是一些字段的值与通常所约定的值不同。示例性的，在报文的头部部分约定有第一字段、第二字段以及第三字段的情况下，若已经被识别出的恶意流量所对应的源端所发送的报文的头部部分仅有第一字段和第二字段，而没有第三字段，那么就可以将头部部分缺乏第三字段作为关于协议约定参数的取值方面的区别。再例如，在报文的头部部分约定有第一字段、第二字段以及第三字段的情况下，若已经被识别出的恶意流量所对应的源端所发送的报文的头部部分仅有第一字段和第三字段，而没有第二字段，那么就可以将头部部分缺乏第二字段作为关于协议约定参数的取值方面的区别。
基于前述方式，可以统计得到所定义的目标特征具体包括的特征项，进而在获取到待检测目标对应的数据流量后可以基于目标特征具体包括的特征项来获取待检测目标对应的数据流量的数据特征。示例性的，若目标特征具体包括的特征项包括报文的结构缺乏结结尾部分，头部部分缺乏第一字段以及头部部分的第一参数的值为指定值等这三项，那么在获取到待检测目标对应的数据流量后，就可以从中确定对于这三项的满足程度进而得到待检测目标对应的数据特征。在这种情况下，匹配程度表征的是待检测目标对应的数据特征所满足的目标特征具体包括的特征项的项数，对应的所满足的项数越多，那么待检测目 标对应的数据流量的数据特征与目标特征的匹配程度就越高。
S140：若所述匹配程度不满足目标匹配条件，计算所述待检测目标对应的访问混乱程度。
需要说明的是，在匹配程度表征的是待检测目标对应的数据特征所匹配的目标特征具体包括的特征项的项数的情况下，目标匹配条件可以为一个阈值。可选的，依然以目标特征具体包括的特征项包括报文的结构缺乏结结尾部分，头部部分缺乏第一字段以及头部部分的第一参数的值为指定值等这三项为例，检测到待检测目标对应的数据流量满足头部部分缺乏第一字段以及头部部分的第一参数的值为指定值的情况下，可以得到待检测目标对应的数据特征包括头部部分缺乏第一字段以及头部部分的第一参数的值为指定值，继而就可以确定待检测目标的数据特征与目标特征的匹配程度为2，若在目标阈值为3的情况下，就可以确定待检测目标的数据特征与目标特征的匹配程度不满足目标匹配条件，而若在目标阈值为2的情况下，就可以确定待检测目标的数据特征与目标特征的匹配程度满足目标匹配条件。
那么在基于前述方式确定匹配程度不满足目标匹配条件的情况下，则表征还无法直接确定待检测目标对应的数据流量是否为恶意流量，进而就可以再获取待检测目标对应的访问混乱程度，以便进一步的再根据待检测目标对应的访问混乱程度来确定待检测目标对应的数据流量是否为恶意流量。
需要说明的是，发明人在对恶意流量和非恶意流量的研究中发现，恶意流量和非恶意流量在数据访问规律方面存在着区别。作为一种方式，在本申请实施例中可以通过计算待检测目标对应的数据流量的熵来确定待检测目标对应的访问混乱程度。
S150：若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。
S160：若所述匹配程度满足目标条件，确定所述待检测目标对应的流量为恶意流量。
需要说明的是，执行本实施例提供的流量检测方法的设备可以为提供网络服务的设备本身，也可以由独立于提供网络服务的设备以外的设备来执行。示例性的，如图2所示的网络环境中，包括有相互通过网络140进行通信的源端110、提供网络服务的设备120以及检测设备130。在这种情况下，执行本实施例提供的流量检测方法可以由提供网络服务的设备120执行，也可以由检测设备130执行。
本申请提供的一种流量检测方法，先获取预设时间内待检测目标对应的流量数据，然后从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征，进而再获取所述数据特征与目标特征的匹配程度，然后若所述匹配程度不满足目标匹配条件的情况下，再计算所述待检测目标对应的访问混乱程度，并且若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。从而通过前述方式实现了将从数据流量中提取出的待检测目标的数据特征与检测目标的访问混乱程度相结合的方式来确定待检测目标对应的流量是否为恶意流量，从而使得恶意流量的检测过程具有更好的准确性以及鲁棒性。
请参阅图3，本申请提供的一种流量检测方法，所述方法包括：
S210：获取预设时间内待检测目标对应的流量数据。
S220：从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征。
S230：获取所述数据特征与目标特征的匹配程度。
S240：若所述匹配程度不满足目标匹配条件，获取所述待检测目标访问过的端口。
需要说明的是，在一些通信协议中会定义一定的虚拟端口作为通信通道。例如，在TCP/IP协议中会以及IP地址以及端口共同来确定一个通信通道。在这种情况下，攻击者所对应的目标端会通过端口扫描的方式来检测哪些端口是可以被利用以进行网络攻击的。所以在本实施例中，可以通过待检测目标对端口的访问情况来确定待检测目标对应的访问混乱程度。在本实施例中，可以有多种方式来确定后续作为待检测目标对应的访问混乱程度的端口。
作为一种方式，所述获取所述待检测目标访问过的端口，包括：获取所述待检测目标在指定时间窗口内访问过的端口。在这种方式下，所述方法还包括：基于所述待检测目标对应的所述流量数据的大小调整所述指定时间窗口的长度；其中，若检测到所述流量数据在所述指定时间窗口内减少，增大所述指定时间窗口的长度。需要说明的是，攻击者对应的客户端并不是随时都会在对提供网络服务的设备进行端口扫描的，因此，为了可以更为全面的对待检测目标对应的流量数据进行检测，可以周期性的获取待检测目标访问过的端口，进而实现对待检测目标对应的流量数据进行周期性的检测。可选的，指定时间窗口为检测周期中一个周期所对应的时间窗口。可选的，可以每天分别进行一次流量数据的检测，进而在这种情况下，指定时间窗口的长度就为一天所对应的24小时。
需要说明的是，一些攻击者为了能够逃避流量检测，可能会减小自身每次所进行端口扫描过程中所产生的流量，进而使得不易识别出攻击者所在源端的访问混乱程度。而为了改善该问题，可以在检测到所述流量数据在所述指定时间窗口内减少时，增大所述指定时间窗口的长度。在这种情况下，即时攻击者减小自身所进行端口扫描过程中所产生的流量，但是通过增大指定时间窗口的长度，使得依然可以收集到足够多的待检测目标对应的流量数据，以便于可以准确的识别到待检测目标对应的访问混乱程度。
可选的，所述若检测到所述流量数据在所述指定时间窗口内减少，增大所述指定时间窗口的长度包括：若检测到所述流量数据在所述指定时间窗口内的指定时间区间内减少，增大所述指定时间窗口的长度；若检测到所述流量数据在所述指定时间窗口内的指定时间区间外减少，保持所述指定时间窗口的长度不变。可以理解的是，若是在指定时间窗口的要结束的时刻，攻击者所对应的待检测目标(源端)减小自身所进行端口扫描过程中所产生的流量，对于当前周期所对应的指定时间窗口内的总的流量数据影响并不会太大，但是若是在指定时间窗口的初期，攻击者所对应的待检测目标(源端)减小自身所进行端口扫描过程中所产生的流量，则会较为明显的使得当前周期所对应的指定时间窗 口内的总的流量数减小，所以通过在所述指定时间窗口内的指定时间区间内减少并增大所述指定时间窗口的长度，可以更为有效的实现指定时间窗口的长度的调控。其中，作为一种方式，所述指定时间区间的开始时刻为所述指定时间窗口的开始时刻，所述指定时间区间的结束时刻为所述指定时间窗口的中间时刻。
作为一种调用指定时间窗口长度的方式，所述若检测到所述流量数据在所述指定时间窗口内减少，增大所述指定时间窗口的长度包括：若检测到所述流量数据在所述指定时间窗口内减少，获取所述数据流量在所述指定时间窗口内的减小幅度；基于所述减小幅度获取对应的窗口增大时长，其中，所述减小幅度越大所对应的窗口增大时长越长；将所述指定时间窗口的长度增大所述窗口增大时长。
S241：获取每个所述访问过的端口对应的活跃度。
作为一种方式，所述获取每个所述访问过的端口对应的活跃度，包括：分别将每个所述访问过的端口所对应的访问数据量与所述访问过的端口对应的总的数据量相比，得到每个所述访问过的端口对应的活跃度；其中，所述访问过的端口对应的总的数据量为每个所述访问过的端口所对应的访问数据量之和。
S242：基于每个所述访问过的端口对应的活跃度计算得到所述待检测目标对应的访问混乱程度。
作为一种方式，所述基于每个所述访问过的端口对应的活跃度计算得到所述待检测目标对应的访问混乱程度，包括：将每个所述访问过的端口对应的活跃度与所述活跃度的对数的乘积作为每个所述访问过的端口对应的指定中间值；将每个所述访问过的端口对应的所述指定中间值之和作为表征所述访问混乱程度的活跃熵。
S250：若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。
可选的，获取所述待检测目标访问过的端口的集合为：
X＝(x 1，x 2，…，x i，…，x n)
而获取每个所述访问过的端口对应的活跃度为：
Figure PCTCN2020084976-appb-000001
其中，a i表征当前进行端口活跃度计算的端口所对应的访问数据量。而
Figure PCTCN2020084976-appb-000002
表征的是访问过的端口的集合中所有的端口所对应的访问数据量之和。可选的，该访问数据量为交互所产生的数据包的数量。在这种情况下可以通过下列公式来计算得到活跃熵：
Figure PCTCN2020084976-appb-000003
本申请提供的一种流量检测方法，先获取预设时间内待检测目标对应的流量数据，然后从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征，进而再获取所述数据特征与目标特征的匹配程度，然后若所述匹配程度不满足目标匹配条件的情况下，再获取所述待检测目标访问过的端口，以及获 取每个所述访问过的端口对应的活跃度，进而基于每个所述访问过的端口对应的活跃度计算得到所述待检测目标对应的访问混乱程度，并且若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。从而通过获取所访问过的端口的活跃度的方式，来实现基于每个所述访问过的端口对应的活跃度计算得到所述待检测目标对应的访问混乱程度，进而实现了将从数据流量中提取出的待检测目标的数据特征与检测目标的访问混乱程度相结合的方式来确定待检测目标对应的流量是否为恶意流量，从而使得恶意流量的检测过程具有更好的准确性以及鲁棒性。
请参阅图4，本申请提供的一种流量检测方法，所述方法包括：
S310：从网络适配器中获取到所述待检测目标对应的数据流量。
S320：从所述待检测目标对应的数据流量中提取所述检测目标对应的报文。
对于攻击者而言，在控制其所对应的源端发送用于进行端口扫描的报文时，可能会在不同的网络分层中添加特有的标识，为了能够更加全面的识别到恶意流量，作为一种方式，分别基于多个网络分层，从所述待检测目标对应的数据流量中提取所述检测目标对应于所述多个网络分层的报文。
可选的，所述网络分层包括应用层以及传输层。
S330：从所述报文中获取到所述待检测目标对应的数据特征。
S340：获取所述数据特征与目标特征的匹配程度。
S350：若所述匹配程度不满足目标匹配条件，计算所述待检测目标对应的访问混乱程度。
S360：若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。
本申请提供的一种流量检测方法，先从网络适配器中获取到所述待检测目标对应的数据流量，然后从所述待检测目标对应的数据流量中提取所述检测目标对应的报文，从所述报文中获取到所述待检测目标对应的数据特征，进而再获取所述数据特征与目标特征的匹配程度，然后若所述匹配程度不满足目标匹配条件的情况下，再计算所述待检测目标对应的访问混乱程度，并且若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。从而实现了可以直接从网络适配器中获取到所述待检测目标对应的数据流量，以便基于前述方式实现了可以直接对网络适配器中获取到的数据流量中提取出的待检测目标的数据特征与检测目标的访问混乱程度相结合的方式来确定待检测目标对应的流量是否为恶意流量，从而使得恶意流量的检测过程具有更好的准确性以及鲁棒性。并且，在本实施例中可以从报文中提取数据特征，并且可以从多个网络分层中分别提取数据特征，进而使得可以更加准确以及全面得进行恶意流量的检测。
请参阅图5，本申请提供的一种流量检测方法，所述方法包括：
S410：获取预设时间内待检测目标对应的流量数据。
S420：从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征。
S430：获取所述数据特征与目标特征的匹配程度。
S440：若所述匹配程度不满足目标匹配条件，计算所述待检测目标对应的访问混乱程度。
S450：若所述访问混乱程度满足所述匹配程度所对应的阈值条件，确定所述待检测目标对应的流量为恶意流量，其中，所述匹配程度不同所对应的所述阈值条件不同。
S460：若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。
本申请提供的一种流量检测方法，先获取预设时间内待检测目标对应的流量数据，然后从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征，进而再获取所述数据特征与目标特征的匹配程度，然后若所述匹配程度不满足目标匹配条件的情况下，再计算所述待检测目标对应的访问混乱程度，并且若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。从而通过前述方式实现了将从数据流量中提取出的待检测目标的数据特征与检测目标的访问混乱程度相结合的方式来确定待检测目标对应的流量是否为恶意流量，从而使得恶意流量的检测过程具有更好的准确性以及鲁棒性。并且，在本实施例中所述匹配程度不同所对应的所述阈值条件不同，从而使得对于恶意流量的检测更为灵活准确。需要说明的是，在所述待检测目标对应的数据特征与目标特征的匹配程度不满足目标匹配条件的情况下，所述待检测目标对应的数据特征所满足的目标特征所包括的特征项越多，那么待检测目标就越有可能触发恶意流量，在这种情况下可以配置匹配程度越高那么所对应的阈值条件所包括的值越低。
下面在通过图6对本申请实施例所涉及的流量检测方法进行说明。
如图6所示，对于网络适配器中的流量数据可以通过包萃取的方式提取出来，并生成数据块。可选的，可以针对每个待检测目标分别生成一个对应的数据块。然后再针对数据块进行特征提取，其中，该特征提取可有理解为前述实施例中的从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征。然后再针对所提取出的数据特征进行特征匹配，可选的，图X中的特征匹配步骤可以理解为前述实施例中的获取所述数据特征与目标特征的匹配程度。在这种情况下，若检测到所提取出的数据特征满足目标匹配条件，则判定检测结构为确定特征，继而判定数据特征所来源的待数据块所对应的待检测目标对应有恶意扫描的行为。若检测到所提取出的数据特征不满足目标匹配条件，但是数据特征与目标特征所包括的特征项中至少有一个特征项匹配，则判定为疑似特征，进而进行疑似特征熵计算，对应的若检测到所提取出的数据特征不满足目标匹配条件，且数据特征与目标特征所包括的特征项均不匹配，则进行无特征熵计算。进一步的，在检测到基于疑似特征熵计算所计算得到的熵值或者基于无特征熵计算所计算得到的熵值在恶意区间(即满足阈值条件)的情况下，判定数据特征所来源的待数据块所对应的待检测目标对应有恶意扫描的行为，反之，确定数据特征所来源的待数据块所对应的待检测目标的数据访问行为为正常行为。
需要说明的是，其中的疑似特征熵计算和无特征熵计算的计算过程与前述 实施例中的活跃熵的计算过程相同，只是疑似特征熵计算和无特征熵计算各自所对应的恶意区间不同。
请参阅图7，本申请提供的一种流量检测装置500，所述装置500包括：
流量获取单元510，用于获取预设时间内待检测目标对应的流量数据。
特征获取单元520，用于从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征。
特征匹配单元530，用于获取所述数据特征与目标特征的匹配程度。
混乱度获取单元540，用于若所述匹配程度不满足目标匹配条件，计算所述待检测目标对应的访问混乱程度。
流量检测单元550，用于若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。
作为一种方式，混乱度获取单元540，具体用于获取所述待检测目标访问过的端口；获取每个所述访问过的端口对应的活跃度；基于每个所述访问过的端口对应的活跃度计算得到所述待检测目标对应的访问混乱程度。在这种方式下，混乱度获取单元540，具体用于获取所述待检测目标在指定时间窗口内访问过的端口。在这种方式下，如图8所示，所述装置还包括窗口调整单元541，用于基于所述待检测目标对应的所述流量数据的大小调整所述指定时间窗口的长度；其中，若检测到所述流量数据在所述指定时间窗口内减少，增大所述指定时间窗口的长度。可选的，窗口调整单元541，具体用于若检测到所述流量数据在所述指定时间窗口内的指定时间区间内减少，增大所述指定时间窗口的长度；若检测到所述流量数据在所述指定时间窗口内的指定时间区间外减少，保持所述指定时间窗口的长度不变。其中，可选的，所述指定时间区间的开始时刻为所述指定时间窗口的开始时刻，所述指定时间区间的结束时刻为所述指定时间窗口的中间时刻。
作为一种方式，窗口调整单元541，具体用于若检测到所述流量数据在所述指定时间窗口内减少，获取所述数据流量在所述指定时间窗口内的减小幅度；基于所述减小幅度获取对应的窗口增大时长，其中，所述减小幅度越大所对应的窗口增大时长越长；将所述指定时间窗口的长度增大所述窗口增大时长。
作为一种方式，混乱度获取单元540，具体用于分别将每个所述访问过的端口所对应的访问数据量与所述访问过的端口对应的总的数据量相比，得到每个所述访问过的端口对应的活跃度；其中，所述访问过的端口对应的总的数据量为每个所述访问过的端口所对应的访问数据量之和。
作为一种方式，混乱度获取单元540，具体用于将每个所述访问过的端口对应的活跃度与所述活跃度的对数的乘积作为每个所述访问过的端口对应的指定中间值；将每个所述访问过的端口对应的所述指定中间值之和作为表征所述访问混乱程度的活跃熵。
作为一种方式，流量获取单元510，具体用于从网络适配器中获取到所述待检测目标对应的数据流量。在这种方式下，特征获取单元520，具体用于从所述待检测目标对应的数据流量中提取所述检测目标对应的报文；从所述报文中获取到所述待检测目标对应的数据特征。可选的，特征获取单元520，具体用于分 别基于多个网络分层，从所述待检测目标对应的数据流量中提取所述检测目标对应于所述多个网络分层的报文。其中，所述网络分层包括应用层以及传输层。
作为一种方式，流量检测单元550，具体用于若所述访问混乱程度满足所述匹配程度所对应的阈值条件，确定所述待检测目标对应的流量为恶意流量，其中，所述匹配程度不同所对应的所述阈值条件不同。
再者，流量检测单元550，还用于若所述匹配程度满足目标条件，确定所述待检测目标对应的流量为恶意流量。
作为一种方式，流量获取单元510，还用于获取所有的流量数据；将所述所有的流量数据包括的所有源端均作为待检测目标。可选的，流量获取单元510，还用于获取所有的流量数据；将所述所有的流量数据包括的所有源端中对应检测到异常访问行为的源端作为待检测目标。其中，所述异常访问行为包括以下行为中的至少一个：超过指定次数发送相同的报文内容；以及超过指定次数在同一时间段发送报文。
本申请提供的一种流量检测装置，先获取预设时间内待检测目标对应的流量数据，然后从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征，进而再获取所述数据特征与目标特征的匹配程度，然后若所述匹配程度不满足目标匹配条件的情况下，再计算所述待检测目标对应的访问混乱程度，并且若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。从而通过前述方式实现了将从数据流量中提取出的待检测目标的数据特征与检测目标的访问混乱程度相结合的方式来确定待检测目标对应的流量是否为恶意流量，从而使得恶意流量的检测过程具有更好的准确性以及鲁棒性。
下面将结合图9对本申请提供的一种电子设备进行说明。
请参阅图9，基于上述的短信推送方法，本申请实施例还提供的另一种包括可以执行前述短信推送方法的处理器102的电子设备200。电子设备200还包括存储器104、以及网络模块106。其中，该存储器104中存储有可以执行前述实施例中内容的程序，而处理器102可以执行该存储器104中存储的程序。
其中，处理器102利用各种接口和线路连接整个电子设备200内的各个部分，通过运行或执行存储在存储器104内的指令、程序、代码集或指令集，以及调用存储在存储器104内的数据，执行电子设备200的各种功能和处理数据。可选地，处理器102可以采用数字信号处理(Digital Signal Processing，DSP)、现场可编程门阵列(Field－Programmable Gate Array，FPGA)、可编程逻辑阵列(Programmable Logic Array，PLA)中的至少一种硬件形式来实现。处理器102可集成中央处理器(Central Processing Unit，CPU)、图像处理器(Graphics Processing Unit，GPU)和调制解调器等中的一种或几种的组合。其中，CPU主要处理操作系统、用户界面和应用程序等；GPU用于负责显示内容的渲染和绘制；调制解调器用于处理无线通信。可以理解的是，上述调制解调器也可以不集成到处理器102中，单独通过一块通信芯片进行实现。
存储器104可以包括随机存储器(Random Access Memory，RAM)，也可以包括只读存储器(Read-Only Memory)。存储器104可用于存储指令、程序、代码、代码集或指令集。存储器104可包括存储程序区和存储数据区，其中， 存储程序区可存储用于实现操作系统的指令、用于实现至少一个功能的指令(比如触控功能、声音播放功能、图像播放功能等)、用于实现下述各个方法实施例的指令等。存储数据区还可以存储终端100在使用中所创建的数据(比如电话本、音视频数据、聊天记录数据)等。
所述网络模块106用于接收以及发送电磁波，实现电磁波与电信号的相互转换，从而与通讯网络或者其他设备进行通讯，例如和音频播放设备进行通讯。所述网络模块106可包括各种现有的用于执行这些功能的电路元件，例如，天线、射频收发器、数字信号处理器、加密/解密芯片、用户身份模块(SIM)卡、存储器等等。所述网络模块106可与各种网络如互联网、企业内部网、无线网络进行通讯或者通过无线网络与其他设备进行通讯。上述的无线网络可包括蜂窝式电话网、无线局域网或者城域网。例如，网络模块106可以与基站进行信息交互。
可选的，电子设备200可以为执行前述方法实施例的服务器。
请参考图10，其示出了本申请实施例提供的一种计算机可读存储介质的结构框图。该计算机可读介质1100中存储有程序代码，所述程序代码可被处理器调用执行上述方法实施例中所描述的方法。
计算机可读存储介质1100可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。可选地，计算机可读存储介质1100包括非易失性计算机可读介质(non-transitory computer-readable storage medium)。计算机可读存储介质1100具有执行上述方法中的任何方法步骤的程序代码810的存储空间。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。程序代码1110可以例如以适当形式进行压缩。
综上所述，本申请提供的一种流量检测方法、装置、服务器以及存储介质，先获取预设时间内待检测目标对应的流量数据，然后从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征，进而再获取所述数据特征与目标特征的匹配程度，然后若所述匹配程度不满足目标匹配条件的情况下，再计算所述待检测目标对应的访问混乱程度，并且若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。从而通过前述方式实现了将从数据流量中提取出的待检测目标的数据特征与检测目标的访问混乱程度相结合的方式来确定待检测目标对应的流量是否为恶意流量，从而使得恶意流量的检测过程具有更好的自适应性、准确性以及鲁棒性。
最后应说明的是：以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不驱使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (20)

  1. 一种流量检测方法，其特征在于，所述方法包括：
    获取预设时间内待检测目标对应的流量数据；
    从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征；
    获取所述数据特征与目标特征的匹配程度；
    若所述匹配程度不满足目标匹配条件，计算所述待检测目标对应的访问混乱程度；
    若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量。
  2. 根据权利要求1所述的方法，其特征在于，所述计算所述待检测目标对应的访问混乱程度，包括：
    获取所述待检测目标访问过的端口；
    获取每个所述访问过的端口对应的活跃度；
    基于每个所述访问过的端口对应的活跃度计算得到所述待检测目标对应的访问混乱程度。
  3. 根据权利要求2所述的方法，其特征在于，所述获取所述待检测目标访问过的端口，包括：
    获取所述待检测目标在指定时间窗口内访问过的端口。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    基于所述待检测目标对应的所述流量数据的大小调整所述指定时间窗口的长度；其中，若检测到所述流量数据在所述指定时间窗口内减少，增大所述指定时间窗口的长度。
  5. 根据权利要求4所述的方法，其特征在于，所述若检测到所述流量数据在所述指定时间窗口内减少，增大所述指定时间窗口的长度包括：
    若检测到所述流量数据在所述指定时间窗口内的指定时间区间内减少，增大所述指定时间窗口的长度；
    若检测到所述流量数据在所述指定时间窗口内的指定时间区间外减少，保持所述指定时间窗口的长度不变。
  6. 根据权利要求5所述的方法，其特征在于，所述指定时间区间的开始时刻为所述指定时间窗口的开始时刻，所述指定时间区间的结束时刻为所述指定时间窗口的中间时刻。
  7. 根据权利要求5所述的方法，其特征在于，所述若检测到所述流量数据在所述指定时间窗口内减少，增大所述指定时间窗口的长度包括：
    若检测到所述流量数据在所述指定时间窗口内减少，获取所述数据流量在所述指定时间窗口内的减小幅度；
    基于所述减小幅度获取对应的窗口增大时长，其中，所述减小幅度越大所对应的窗口增大时长越长；
    将所述指定时间窗口的长度增大所述窗口增大时长。
  8. 根据权利要求2-7任一所述的方法，其特征在于，所述获取每个所述访问过的端口对应的活跃度，包括：
    分别将每个所述访问过的端口所对应的访问数据量与所述访问过的端口对应的总的数据量相比，得到每个所述访问过的端口对应的活跃度；其中，所述访问过的端口对应的总的数据量为每个所述访问过的端口所对应的访问数据量之和。
  9. 根据权利要求2-8任一所述的方法，其特征在于，所述基于每个所述访问过的端口对应的活跃度计算得到所述待检测目标对应的访问混乱程度，包括：
    将每个所述访问过的端口对应的活跃度与所述活跃度的对数的乘积作为每个所述访问过的端口对应的指定中间值；
    将每个所述访问过的端口对应的所述指定中间值之和作为表征所述访问混乱程度的活跃熵。
  10. 根据权利要求1-9任一所述的方法，其特征在于，所述获取预设时间内待检测目标对应的流量数据，包括：
    从网络适配器中获取到所述待检测目标对应的数据流量；
    所述从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征，包括：
    从所述待检测目标对应的数据流量中提取所述检测目标对应的报文；
    从所述报文中获取到所述待检测目标对应的数据特征。
  11. 根据权利要求10所述的方法，其特征在于，所述从所述待检测目标对应的数据流量中提取所述检测目标对应的报文，包括：
    分别基于多个网络分层，从所述待检测目标对应的数据流量中提取所述检测目标对应于所述多个网络分层的报文。
  12. 根据权利要求11所述的方法，其特征在于，所述网络分层包括应用层以及传输层。
  13. 根据权利要求1-12任一所述的方法，其特征在于，若所述访问混乱程度满足阈值条件，确定所述待检测目标对应的流量为恶意流量，包括：
    若所述访问混乱程度满足所述匹配程度所对应的阈值条件，确定所述待检测目标对应的流量为恶意流量，其中，所述匹配程度不同所对应的所述阈值条件不同。
  14. 根据权利要求1-13任一所述的方法，其特征在于，所述方法还包括：
    若所述匹配程度满足目标条件，确定所述待检测目标对应的流量为恶意流量。
  15. 根据权利要求1-14任一所述的方法，其特征在于，所述方法还包括：
    获取所有的流量数据；
    将所述所有的流量数据包括的所有源端均作为待检测目标。
  16. 根据权利要求1-14任一所述的方法，其特征在于，所述方法还包括：
    获取所有的流量数据；
    将所述所有的流量数据包括的所有源端中对应检测到异常访问行为的源端作为待检测目标。
  17. 根据权利要求16所述的方法，其特征在于，所述异常访问行为包括以下行为中的至少一个：
    超过指定次数发送相同的报文内容；以及
    超过指定次数在同一时间段发送报文。
  18. 一种流量检测装置，其特征在于，所述装置包括：
    流量获取单元，用于获取预设时间内待检测目标对应的流量数据；
    特征获取单元，用于从所述流量数据中进行特征提取得到所述待检测目标对应的数据特征；
    特征匹配单元，用于获取所述数据特征与目标特征的匹配程度；
    混乱度获取单元，用于若所述匹配程度不满足目标匹配条件，计算所述待检测目标对应的访问混乱程度；
    流量检测单元，用于若所述访问混乱程度满足阈值条件，确定所述待检测 目标对应的流量为恶意流量。
  19. 一种服务器，其特征在于，包括一个或多个处理器以及存储器；
    一个或多个程序被存储在所述存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序配置用于执行权利要求1-17任一所述的方法。
  20. 一种具有处理器可执行的程序代码的计算机可读存储介质，其特征在于，所述程序代码使所述处理器执行权利要求1-17任一所述的方法。
PCT/CN2020/084976 2020-04-15 2020-04-15 流量检测方法、装置、服务器以及存储介质 WO2021207984A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2020/084976 WO2021207984A1 (zh) 2020-04-15 2020-04-15 流量检测方法、装置、服务器以及存储介质
CN202080094718.5A CN115023926B (zh) 2020-04-15 2020-04-15 流量检测方法、装置、服务器以及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/084976 WO2021207984A1 (zh) 2020-04-15 2020-04-15 流量检测方法、装置、服务器以及存储介质

Publications (1)

Publication Number Publication Date
WO2021207984A1 true WO2021207984A1 (zh) 2021-10-21

Family

ID=78083526

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/084976 WO2021207984A1 (zh) 2020-04-15 2020-04-15 流量检测方法、装置、服务器以及存储介质

Country Status (2)

Country Link
CN (1) CN115023926B (zh)
WO (1) WO2021207984A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114124563A (zh) * 2021-12-02 2022-03-01 湖北天融信网络安全技术有限公司 一种异常流量检测方法、装置、电子设备及存储介质
CN114172721A (zh) * 2021-12-06 2022-03-11 北京天融信网络安全技术有限公司 恶意数据防护方法、装置、电子设备及存储介质
CN116595529A (zh) * 2023-07-18 2023-08-15 山东溯源安全科技有限公司 一种信息安全检测方法、电子设备及存储介质
CN116723138A (zh) * 2023-08-10 2023-09-08 杭银消费金融股份有限公司 一种基于流量探针染色的异常流量监控方法及系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20050048019A (ko) * 2003-11-18 2005-05-24 한국전자통신연구원 통계적 분석을 이용한 네트워크 수준에서의 이상 트래픽감지 방법
CN105429977A (zh) * 2015-11-13 2016-03-23 武汉邮电科学研究院 基于信息熵度量的深度包检测设备异常流量监控方法
CN106790050A (zh) * 2016-12-19 2017-05-31 北京启明星辰信息安全技术有限公司 一种异常流量检测方法及检测系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108833437A (zh) * 2018-07-05 2018-11-16 成都康乔电子有限责任公司 一种基于流量指纹和通信特征匹配的apt检测方法
CN109005157B (zh) * 2018-07-09 2020-07-10 华中科技大学 一种软件定义网络中DDoS攻击检测与防御方法与系统
CN110225037B (zh) * 2019-06-12 2021-11-30 广东工业大学 一种DDoS攻击检测方法和装置
CN110661781B (zh) * 2019-08-22 2022-05-17 中科创达软件股份有限公司 一种DDoS攻击检测方法、装置、电子设备和存储介质

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20050048019A (ko) * 2003-11-18 2005-05-24 한국전자통신연구원 통계적 분석을 이용한 네트워크 수준에서의 이상 트래픽감지 방법
CN105429977A (zh) * 2015-11-13 2016-03-23 武汉邮电科学研究院 基于信息熵度量的深度包检测设备异常流量监控方法
CN106790050A (zh) * 2016-12-19 2017-05-31 北京启明星辰信息安全技术有限公司 一种异常流量检测方法及检测系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
XU YU-HUA, SUN ZHI-XIN: "Research Development of Abnormal Traffic Detection in Software Defined Networking", JOURNAL OF SOFTWARE, vol. 31, no. 1, 1 January 2020 (2020-01-01), pages 183 - 207, XP055857164, ISSN: 1000-9825, DOI: 10.13328/j.cnki.jos.005879 *

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114124563A (zh) * 2021-12-02 2022-03-01 湖北天融信网络安全技术有限公司 一种异常流量检测方法、装置、电子设备及存储介质
CN114124563B (zh) * 2021-12-02 2024-03-15 湖北天融信网络安全技术有限公司 一种异常流量检测方法、装置、电子设备及存储介质
CN114172721A (zh) * 2021-12-06 2022-03-11 北京天融信网络安全技术有限公司 恶意数据防护方法、装置、电子设备及存储介质
CN114172721B (zh) * 2021-12-06 2024-01-23 北京天融信网络安全技术有限公司 恶意数据防护方法、装置、电子设备及存储介质
CN116595529A (zh) * 2023-07-18 2023-08-15 山东溯源安全科技有限公司 一种信息安全检测方法、电子设备及存储介质
CN116595529B (zh) * 2023-07-18 2023-09-19 山东溯源安全科技有限公司 一种信息安全检测方法、电子设备及存储介质
CN116723138A (zh) * 2023-08-10 2023-09-08 杭银消费金融股份有限公司 一种基于流量探针染色的异常流量监控方法及系统
CN116723138B (zh) * 2023-08-10 2023-10-20 杭银消费金融股份有限公司 一种基于流量探针染色的异常流量监控方法及系统

Also Published As

Publication number Publication date
CN115023926A (zh) 2022-09-06
CN115023926B (zh) 2024-09-27

Similar Documents

Publication Publication Date Title
WO2021207984A1 (zh) 流量检测方法、装置、服务器以及存储介质
CN111181932B (zh) Ddos攻击检测与防御方法、装置、终端设备及存储介质
US20210051164A1 (en) Methods, systems, and media for detecting new malicious activity from iot devices
US10581915B2 (en) Network attack detection
US8695095B2 (en) Mobile malicious software mitigation
US10659492B2 (en) Mobile botnet mitigation
US11671402B2 (en) Service resource scheduling method and apparatus
US20150229669A1 (en) Method and device for detecting distributed denial of service attack
US20150180997A1 (en) Herd based scan avoidance system in a network environment
EP2723034A1 (en) System for Detection of Mobile Applications Network Behavior - Netwise
Guerber et al. Machine Learning and Software Defined Network to secure communications in a swarm of drones
JP2014527762A (ja) 疑わしい無線アクセスポイントの検出
CN107666473B (zh) 一种攻击检测的方法及控制器
US11411990B2 (en) Early detection of potentially-compromised email accounts
CN108092970B (zh) 一种无线网络维护方法及其设备、存储介质、终端
WO2020156256A1 (zh) 数据包转发方法、装置、移动终端及存储介质
US10187428B2 (en) Identifying data usage via active data
CN109547427B (zh) 黑名单用户识别方法、装置、计算机设备及存储介质
US12069077B2 (en) Methods for detecting a cyberattack on an electronic device, method for obtaining a supervised random forest model for detecting a DDoS attack or a brute force attack, and electronic device configured to detect a cyberattack on itself
Doshi et al. Game theoretic modeling of gray hole attacks in wireless ad hoc networks
US8661102B1 (en) System, method and computer program product for detecting patterns among information from a distributed honey pot system
Lu et al. Client-side evil twin attacks detection using statistical characteristics of 802.11 data frames
CN109257384B (zh) 基于访问节奏矩阵的应用层DDoS攻击识别方法
Johnson et al. Sms botnet detection for android devices through intent capture and modeling
TW202102051A (zh) 非法ap之檢測抑制裝置、方法及電腦可讀取存儲介質

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20931165

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 14/03/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20931165

Country of ref document: EP

Kind code of ref document: A1