WO2022100028A1

WO2022100028A1 - Interface traffic anomaly detection method and apparatus, terminal device, and storage medium

Info

Publication number: WO2022100028A1
Application number: PCT/CN2021/091088
Authority: WO
Inventors: 王有金
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-11-16
Filing date: 2021-04-29
Publication date: 2022-05-19
Also published as: CN112383554A; CN112383554B

Abstract

The present application is applicable to the field of artificial intelligence technology, and provides an interface traffic anomaly detection method and apparatus, a terminal device and a storage medium. The method comprises: obtaining traffic data of an interface to be detected and drawing an interface access image according to the traffic data; segmenting the interface access image until each image point is isolated to obtain a segmentation path corresponding to each image point; calculating anomaly indices of corresponding image points according to the length of the segmentation path; if the anomaly index corresponding to any image point is greater than an anomaly threshold, determining that traffic of the interface in a time period corresponding to said image point is abnormal traffic. On the basis of the drawing of the interface access image, the isolation of image points, and the calculation of anomaly indices, the present application can automatically detect an interface traffic anomaly at the interface without relying on human experience to set a traffic detection threshold, which facilitates user operations and improves the accuracy of interface traffic anomaly detection. In addition, the present application also relates to blockchain technology.

Description

Interface traffic anomaly detection method, device, terminal device and storage medium

This application claims the priority of the Chinese patent application filed on November 16, 2020 with the application number 202011281595.4 and the invention titled "Interface Traffic Abnormal Detection Method, Device, Terminal Equipment and Storage Medium", the entire contents of which are obtained through Reference is incorporated in this application.

technical field

The present application relates to the field of artificial intelligence, and in particular, to a method, device, terminal device and storage medium for detecting abnormality of interface traffic.

Background technique

With the advent of the era of massive data, companies have realized the huge advantages brought by data-driven services. The traffic of business systems has reached hundreds of millions per second. The problem of malicious traffic or abnormal traffic is getting more and more attention.

technical problem

To sum up, the inventor realized that the existing interface traffic anomaly detection relies on manual experience to set the traffic detection threshold, and judges whether the interface traffic of the system interface is abnormal traffic based on the traffic detection threshold. Setting the traffic detection threshold will result in cumbersome user operations and low accuracy of interface traffic anomaly detection.

technical solutions

In view of this, the embodiments of the present application provide a method, device, terminal device, and storage medium for detecting an abnormality in interface traffic, so as to solve the problem caused by relying on manual experience to set a traffic detection threshold in the process of detecting traffic abnormality in the prior art. The problem of low accuracy of interface traffic anomaly detection.

A first aspect of the embodiments of the present application provides a method for detecting an abnormality in interface traffic, including:

acquiring traffic data of the interface to be detected, and drawing an interface access image according to the traffic data, where the interface access image includes image points formed between different time periods in the traffic data and corresponding interface traffic;

The interface access image is segmented until each image point is isolated, and a segmentation path corresponding to each image point is obtained, and the length of the segmentation path is used to represent the difficulty of isolating the corresponding image point. degree;

Calculate an anomaly index corresponding to the image point according to the length of the segmentation path, where the anomaly index is used to characterize the degree of anomaly of the image point;

If the abnormality index corresponding to any of the image points is greater than the abnormality threshold, it is determined that the traffic of the interface to be detected in the time period corresponding to the image point is abnormal traffic.

A second aspect of the embodiments of the present application provides an interface traffic anomaly detection device, including:

An access image drawing unit, configured to acquire traffic data of the interface to be detected, and draw an interface access image according to the traffic data, where the interface access image includes images formed between different time periods in the traffic data and corresponding interface traffic point;

The image segmentation unit is used to segment the interface access image until each of the image points is isolated to obtain a segmentation path corresponding to each of the image points, and the length of the segmentation path is used to represent the isolation corresponding to the The difficulty of describing the image point;

an anomaly index calculation unit, configured to calculate an anomaly index corresponding to the image point according to the length of the segmentation path, where the anomaly index is used to characterize the degree of anomaly of the image point;

An abnormality determination unit, configured to determine that the traffic of the interface to be detected in the time period corresponding to the image point is abnormal traffic if the abnormality index corresponding to any of the image points is greater than the abnormality threshold.

A third aspect of the embodiments of the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and running on the terminal device, where the processor implements when executing the computer program:

A fourth aspect of the embodiments of the present application provides a storage medium, where the storage medium stores a computer program, and the computer program is executed by a processor to implement:

beneficial effect

Compared with the prior art, the embodiment of the present application has the beneficial effect that: by acquiring the traffic data of the interface to be detected, and drawing an interface access image according to the traffic data, it is possible to effectively generate a representation of the relationship between the interface to be detected and the interface traffic in different time periods. By dividing the interface access image until each image point is isolated, the segmentation path formed by the process of the isolated image point can be effectively obtained, and different images can be effectively distinguished based on the segmentation path. The difficulty of being isolated between points, by calculating the abnormality index of the corresponding image point according to the segmentation path, based on the abnormality degree of the image point that can be effective based on the abnormality index, if the abnormality index corresponding to any image point is greater than the abnormality threshold, it is determined to be pending. The traffic of the detection interface in the time period corresponding to the image point is abnormal traffic. Based on the drawing of the interface access image, the isolation of the image point, and the calculation of the abnormality index, the embodiment of the present application can automatically detect the abnormal interface traffic of the interface to be detected, without relying on Manual experience sets traffic detection thresholds, which facilitates user operations and improves the accuracy of interface traffic anomaly detection.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present application more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only for the present application. In some embodiments, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without any creative effort.

FIG. 1 is a flowchart of an implementation of a method for detecting an abnormality in interface traffic provided by an embodiment of the present application;

FIG. 2 is an implementation flowchart of a method for detecting an abnormality in interface traffic provided by another embodiment of the present application;

3 is a schematic structural diagram of an interface access image provided by the embodiment of FIG. 2;

FIG. 4 is an implementation flowchart of a method for detecting an abnormality in interface traffic provided by still another embodiment of the present application;

5 is a structural block diagram of a device for detecting an abnormality in interface traffic provided by an embodiment of the present application;

FIG. 6 is a structural block diagram of a terminal device provided by an embodiment of the present application.

Embodiments of the present invention

In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the present application will be described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application.

The interface traffic anomaly detection method involved in the embodiment of the present application may be executed by a control device or a terminal (hereinafter referred to as a "mobile terminal").

Please refer to FIG. 1. FIG. 1 shows an implementation flowchart of a method for detecting an abnormality in interface traffic provided by an embodiment of the present application, including:

In step S10, traffic data of the interface to be detected is acquired, and an interface access image is drawn according to the traffic data.

Among them, the traffic data is obtained by acquiring the daily access traffic of the interface to be detected within a preset time, and the preset time can be set according to requirements, for example, the preset time can be set to 3 days, 10 days, 20 days or 60 days etc.

In this step, when the preset time is set to 3 days, the access traffic of the interface to be detected within 3 days before the current time is acquired, and the traffic data is obtained.

Specifically, in this step, the interface access image includes image points formed between different time periods in the traffic data and the corresponding interface traffic, and the time period is obtained by dividing a preset time interval.

Optionally, in this step, traffic data of multiple different interfaces to be detected may be acquired at the same time, and an interface access image corresponding to the interface to be detected may be drawn according to the traffic data.

Specifically, in this step, the drawing of the interface access image according to the traffic data includes:

Divide the time parameter in the traffic data according to the preset time interval to obtain different time periods, and obtain the interface traffic corresponding to the same time period on different dates respectively;

For the same time period, draw the coordinate points corresponding to the acquired interface traffic as the ordinate value and the date corresponding to the interface traffic as the abscissa value to obtain the image point;

The preset time interval can be set according to requirements. For example, when the preset time interval is set to 12 hours, the time period includes 0:00 to 12:00 and 12:00 to 24:00, and the preset time interval is set to 6 hours, the time period includes 0:00 to 6:00, 6:00 to 12:00, 12:00 to 18:00, and 18:00 to 24:00.

Specifically, in this step, by separately obtaining the interface traffic corresponding to the same time period in different dates, the drawing of corresponding image points in different time periods is effectively guaranteed, so as to generate interface access images corresponding to different time periods. The traffic data of the detection interface includes the access traffic on January 1 and January 2. When the preset time interval is set to 12 hours, the corresponding data from 0:00 to 12:00 and 12:00 to 24:00 on January 1 are obtained. Interface traffic, obtain interface traffic a1 and interface traffic a2, obtain the interface traffic corresponding to 0:00 to 12:00 and 12:00 to 24:00 on January 2, and obtain interface traffic a3 and interface traffic a4, and for the time period 0:00 to 24:00 At 12:00, take the interface traffic a1 as the ordinate value and the date January 1st as the abscissa value to draw the coordinate points to obtain the image point b1, take the interface traffic a3 as the ordinate value, and the date January 2nd as the abscissa value. The coordinate point is drawn to obtain the image point b2, and the image formed by the image point b1 and the image point b2 is the interface access image c1 corresponding to the time period 0:00 to 12:00;

Further, for the time period from 12:00 to 24:00, take the interface flow a2 as the ordinate value and the date January 1st as the abscissa value to draw the coordinate points to obtain the image point b3, and take the interface flow a4 as the ordinate value and date. On January 2, coordinate points are drawn for the abscissa value to obtain image point b4, and the image formed by the image point b3 and image point b4 is the interface access image c2 corresponding to the time period 12:00 to 24:00.

Step S20, segment the interface access image until each of the image points is isolated, and obtain a segmentation path corresponding to each of the image points.

Among them, the length of the segmentation path is used to represent the difficulty of isolating the corresponding image point. When the length of the segmentation path is longer, the number of segmentations to isolate the image point is more, and the image point is more difficult to isolate, that is, in the interface The closer the distance between the image point and other image points in the access image, the more normal the interface traffic of the interface accessing the image in the time period corresponding to the image point;

In this step, when the length of the segmentation path is shorter, the number of times to isolate the image point is less, and the image point is more easily isolated, that is, the distance between the image point and other image points in the interface access image is greater. The farther the distance is, the more abnormal the interface traffic of the interface to access the image in the time period corresponding to the image point.

Specifically, in this step, the interface is continuously divided to access the image, and the segmentation of the interface to access the image is stopped until each image point is isolated. Optionally, this step can be based on the isolation forest algorithm (iForest ) to construct an anomaly detection model, and according to the anomaly detection model, the segmentation path corresponding to each image point can be directly obtained.

Step S30, calculating an anomaly index corresponding to the image point according to the length of the segmentation path.

Among them, the abnormality index is used to represent the abnormality of the image point. For example, when the image point b1 is isolated after being divided by the segmentation path d1, the abnormality index e1 corresponding to the image point b1 is calculated according to the length of the segmentation path d1. The larger the abnormality index e1 is, the greater the abnormality of the interface traffic of the interface to be detected in the time period corresponding to the image point b1, that is, the abnormality of the interface traffic of the interface to be detected from 0:00 to 12:00 in January 1st the greater the degree.

Specifically, in this step, the calculation formula used to calculate the abnormality index corresponding to the image point according to the length of the segmentation path is:

Among them, E(h(x)) is the length of the segmentation path corresponding to the xth image point, C(Ψ) is the length of the preset segmentation path, and Score(x) is the anomaly index corresponding to the xth image point.

Step S40, if the abnormality index corresponding to any of the image points is greater than the abnormality threshold, it is determined that the traffic of the interface to be detected in the time period corresponding to the image point is abnormal traffic.

The abnormality threshold can be set as required, and the abnormality threshold is used to determine whether the traffic in the time period corresponding to the image point is abnormal traffic. When the abnormality index corresponding to the image point is greater than the abnormality threshold, it is determined that the interface to be detected is at the image point. The traffic in the corresponding time period is abnormal traffic.

Optionally, in this step, if it is detected that the interface to be detected has abnormal traffic in the time period corresponding to any image point, a traffic abnormality prompt is generated according to the time period corresponding to the image point, and the corresponding interface of the to-be-detected interface is queried. Abnormal prompt address;

Send the abnormal traffic prompt to the abnormal prompt address corresponding to the interface to be detected, and promptly remind the corresponding staff that the interface to be detected is abnormal in the corresponding time period; optionally, in this step, the abnormal traffic prompt can be Remind staff by voice, text or image.

In this embodiment, by acquiring the traffic data of the interface to be detected, and drawing the interface access image according to the traffic data, the interface access image representing the corresponding relationship between the interface to be detected and the interface traffic in different time periods can be effectively generated. Access the image for segmentation until each image point is isolated, and the segmentation path formed by the process of the isolated image point can be effectively obtained. Calculate the abnormality index of the corresponding image point according to the segmentation path, and based on the abnormality degree of the image point that can be effective based on the abnormality index, if the abnormality index corresponding to any image point is greater than the abnormality threshold, the traffic of the interface to be detected in the time period corresponding to the image point is determined. It is abnormal traffic. Based on the drawing of the interface access image, the isolation of image points, and the calculation of the abnormality index, the embodiment of the present application can automatically detect the abnormal interface traffic on the interface to be detected, and does not need to rely on manual experience to set the traffic detection threshold, which is convenient for users. This improves the accuracy of interface traffic anomaly detection.

Please refer to FIG. 2. FIG. 2 is an implementation flowchart of a method for detecting an abnormality in interface traffic provided by another embodiment of the present application. Compared with the embodiment corresponding to FIG. 1 , the method for detecting abnormality of interface traffic provided in this embodiment is a further refinement of step S20 in the embodiment corresponding to FIG. 1 , including:

Step S21: Calculate the total interface traffic of the interface to be detected, and calculate the average traffic corresponding to the time period according to the total interface traffic.

The total traffic of the interface is the sum of traffic of the interfaces to be detected in the same time period on different dates.

For example, when the traffic data of the interface to be detected includes the access traffic on January 1st and January 2nd, and the preset time interval is set to 12 hours, obtain the data from 0:00 to 20:00 on January 1st and January 2nd. The sum of the interface traffic corresponding to 12:00 is obtained to obtain the total interface traffic f1, and the sum of the corresponding interface traffic from 12:00 to 24:00 on January 1 and January 2 is obtained to obtain the total interface traffic f2.

Specifically, in this step, the quotients between the total interface traffic f1, the total interface traffic f2 and the number of time periods are calculated respectively, and the average value of the traffic is obtained, that is, since the preset time interval is set to 12 hours, the number of time periods If it is 2, then calculate the quotient between the total interface flow f1, the total interface flow f2 and the value 2 respectively, and obtain the average flow value g1 corresponding to the interface to be detected from 0:00 to 12:00 in the time period and from 12:00 to 12:00 in the time period. The flow average value g2 corresponding to 24 points.

It can be understood that when the preset time interval is set to 6 hours, the number of time periods is 4. Therefore, calculate the quotient between the total interface traffic f1, the total interface traffic f2 and the value 4, respectively, to obtain the interface to be detected. The average traffic flow over the corresponding time period.

Step S22 , generating an image segmentation line of the interface access image according to the traffic average value, and performing image segmentation on the interface access image according to the image segmentation line to obtain an access segmentation image.

3, it is a schematic structural diagram of the interface access image provided by the embodiment of FIG. 2, the image dividing line L is parallel to the abscissa X in the interface access image, and the interface access image includes image point a, image point b and The image point c, the image dividing line L is used to isolate the image point a, the image point b and the image point c in the interface access image. In this step, the flow average value and the ordinate parameter value are drawn parallel to the abscissa split line to get the split line for this image.

In this step, image segmentation is performed on the interface access image according to the image segmentation line to obtain two access segmented images. When the number of the interface access images is n, the total number of obtained access segmented images is 2n.

Specifically, in this step, after performing image segmentation on the interface access image according to the image segmentation line to obtain the access segmented image, the method further includes:

respectively acquiring the number of image points in the access segmented image, and judging whether the number of image points in the access segmented image is greater than a number threshold;

If the number of image points in the accessed segmented image is greater than the number threshold, step S23 is executed, and if the number of image points in the accessed segmented image is less than or equal to the number threshold, the segmentation of the accessed segmented image is stopped.

Step S23: Calculate the sum of the interface traffic corresponding to different time periods in the access segmented image respectively, and calculate the average traffic of the access segmented image according to the sum of the interface traffic corresponding to different time segments in the access segmented image.

Among them, by separately calculating the sum of the interface traffic corresponding to different time periods in the access segmented image, and calculating the average traffic flow of the access segmented image according to the sum of the corresponding interface traffic in different time periods in the access segmented image, to obtain the image segmentation corresponding to the different access segmented images The ordinate parameter value of the line, thereby improving the accuracy of subsequent segmentation of the access segmentation image.

Step S24, generating an image segmentation line corresponding to the access segmented image according to the traffic average value of the access segmented image, and performing image segmentation on the access segmented image according to the image segmentation line in the access segmented image to obtain a segmented image. subimage.

Wherein, the image dividing line in the access segmented image is generated in the same way as the image dividing line in the interface access image, both are based on the traffic average value to generate the corresponding image dividing line, and the image dividing line generated in the access segmented image It is used to segment the access segmented image to obtain segmented sub-images, that is, the image segment line generated in the access segmented image is used to segment and isolate the image points in the access segmented image.

Step S25, if the number of the image points in the segmented sub-image is greater than the number threshold, calculate the sum of the interface traffic corresponding to different time periods in the segmented sub-image respectively, and according to the different time periods in the segmented sub-image A traffic average value of the segmented sub-image is calculated corresponding to the sum of the interface traffic.

The quantity threshold can be set according to requirements. In this embodiment, the quantity threshold is set to 1, that is, in this step, if the number of image points in the segmented sub-image is greater than 1, the image points in the segmented sub-image are not In the isolated state, the image points in the segmented sub-image need to be segmented again. When there is only one image point in the segmented sub-image, the image point is in an isolated state, and the segmentation of the corresponding segmented sub-image is stopped.

In this step, by separately calculating the sum of the interface traffic corresponding to different time periods in the segmented sub-image, and calculating the average traffic of the segmented sub-image according to the sum of the interface traffic corresponding to different time periods in the segmented sub-image, to ensure that the segmented sub-image The re-segmentation operation of the mid-image point.

Step S26 , generating image segmentation lines corresponding to the segmented sub-images according to the average flow of the segmented sub-images, and performing image segmentation on the segmented sub-images according to the image segmentation lines in the segmented sub-images.

The image segmentation line in the corresponding segmented sub-image is generated according to the flow average value of the segmented sub-image, and the segmented sub-image is segmented according to the image segmentation line in the segmented sub-image, so as to achieve the image point in the segmented sub-image. The effect of splitting isolation again.

In this step, if the number of the image points in the segmented sub-image after segmentation is greater than the number threshold, return to step S26 until the number of the image points in the segmented sub-image after segmentation is less than or equal to the number threshold.

Step S27, if the number of the image points in the segmented sub-image is less than or equal to a number threshold, stop the segmentation of the segmented sub-image.

Wherein, if the number of image points in the segmented sub-image is less than or equal to the number threshold, it is determined that the image points in the segmented sub-image are in an isolated state, and the segmented sub-image does not need to be segmented again.

Step S28, generating the segmentation path corresponding to the image point according to the image segmentation line.

Specifically, in this step, generating the segmentation path corresponding to the image point according to the image segmentation line includes:

Obtaining the image dividing line for isolating the image point, and performing vector merging on the obtained image dividing line to obtain the dividing path, wherein by performing vector merging on the obtained image dividing line to obtain the Get the segmentation path of the isolated corresponding image points.

For example, when the image point b1 is in an isolated state after being divided by the image dividing line h1, the image dividing line h2 and the image dividing line h3, the image dividing line h1, the image dividing line h2 and the image dividing line h3 are vector combined to obtain The segmentation path corresponding to the image point b1.

In this embodiment, by calculating the traffic average value corresponding to the time period according to the total traffic of the interface, and generating the image segmentation line of the interface access image according to the traffic average value, the image segmentation of the interface access image is effectively guaranteed, so as to achieve the interface access image segmentation. The isolated segmentation operation of the image points in the access image, by generating the image segmentation line in the corresponding access segmented image according to the traffic average value of the access segmented image, and performing image segmentation on the access segmented image according to the image segmentation line in the access segmented image, effectively The image segmentation of the access segmented image is guaranteed, so as to achieve the isolated segmentation operation of the image points in the access segmented image. By generating the segmentation path corresponding to the image point according to the image segmentation line, the calculation of the abnormal index corresponding to the image point is effectively guaranteed.

Please refer to FIG. 4. FIG. 4 is an implementation flowchart of a method for detecting an abnormality in interface traffic provided by another embodiment of the present application. With respect to the embodiment corresponding to FIG. 1 , after step S40, the interface traffic anomaly detection method provided in this embodiment includes:

Step S50: Acquire a request object corresponding to the abnormal traffic, and mark the acquired request object as abnormal.

The request object is the access user corresponding to the abnormal traffic. In this step, by marking the acquired request object with abnormality, the accuracy of subsequent prohibition of address access to the request object is effectively improved.

Step S60, if the number of abnormal marking times of the requesting object within a preset time is greater than the number of thresholds, obtain the access address corresponding to the abnormal traffic, and prohibit the requesting object from accessing the access address within a preset time interval. access.

Wherein, the preset time, the number of times threshold and the preset time interval can be set according to requirements, for example, the preset time can be set to 1 hour, 10 hours or 1 day, etc., the number of times threshold can be set to 5 times, 10 times times or 20 times, etc., the preset time interval can be set to 1 hour, 10 hours or 1 day, etc.

Specifically, in this step, if the number of abnormal marks of the request object within the preset time is greater than the number of times threshold, it is determined that the request object is an abnormal access object, and the access address corresponding to the abnormal traffic is obtained by obtaining the access address and prohibiting it within the preset time interval. The access of the request object to the access address effectively prevents the network attack of the abnormal access object on the access address corresponding to the abnormal traffic, and improves the security of data access on the interface to be detected.

Optionally, for step S20 in FIG. 1 , the interface access image is segmented until each of the image points is isolated, and after the segmentation path corresponding to each of the image points is obtained, the method further includes:

calculating the arithmetic mean and standard deviation of the lengths of the divided paths, and standardizing the divided paths according to the calculated arithmetic mean and standard deviation;

The standardization formula used to perform standardization processing on the segmentation path according to the arithmetic mean and the standard deviation is:

A=(B-C)/D;

Wherein, A is the length of the divided path after normalization, B is the length of the divided path before normalization, C is the arithmetic mean, and D is the standard deviation.

In this embodiment, by acquiring the request object corresponding to the abnormal traffic, and marking the acquired request object as abnormal, the accuracy of prohibiting address access to the request object is improved. If the number of times is greater than the threshold, by obtaining the access address corresponding to the abnormal traffic, and prohibiting the request object from accessing the access address within a preset time interval, the network attack of the abnormal access object on the access address corresponding to the abnormal traffic is effectively prevented.

In all the embodiments of the present application, the abnormality index of the image point is obtained based on the segmentation path, and specifically, the abnormality index of the image point is obtained by the segmentation path. Uploading the anomaly index of image points to the blockchain ensures its security and fairness and transparency to users. The user equipment can download the abnormal index of the image point from the blockchain, so as to verify whether the abnormal index of the image point has been tampered with. The blockchain referred to in this example is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain, essentially a decentralized database, is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information to verify its Validity of information (anti-counterfeiting) and generation of the next block. The blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.

Please refer to FIG. 5 . FIG. 5 is a structural block diagram of an apparatus 100 for detecting an abnormality in interface traffic provided by an embodiment of the present application. In this embodiment, each unit included in the device 100 for detecting an abnormality in interface traffic is used to execute each step in the embodiment corresponding to FIG. 1 , FIG. 2 , and FIG. 4 . For details, please refer to the related descriptions in FIG. 1 , FIG. 2 , FIG. 4 and the embodiments corresponding to FIG. 1 , FIG. 2 , and FIG. 4 . For convenience of description, only the parts related to this embodiment are shown. Referring to FIG. 5 , the interface traffic abnormality detection device 100 includes: an access image drawing unit 10, an image segmentation unit 11, an abnormality index calculation unit 12, and an abnormality determination unit 13, wherein:

The access image drawing unit 10 is configured to acquire the traffic data of the interface to be detected, and draw the interface access image according to the traffic data, and the interface access image includes the data formed between different time periods in the traffic data and the corresponding interface traffic. image point.

The access image drawing unit 10 is further configured to: segment the time parameters in the traffic data according to preset time intervals to obtain different time periods, and respectively acquire the interface traffic corresponding to the same time period in different dates ;

For the same time period, draw the coordinate points corresponding to the acquired interface traffic as the ordinate value and the date corresponding to the interface traffic as the abscissa value to obtain the image point.

The image segmentation unit 11 is configured to segment the interface access image until each of the image points is isolated to obtain a segmentation path corresponding to each of the image points, and the length of the segmentation path is used to represent the isolated correspondence The difficulty level of the image point.

Wherein, the image segmentation unit 11 is further configured to: calculate the total interface traffic of the interface to be detected, where the total interface traffic is the sum of the corresponding interface traffic of the interface to be detected in the same time period in different dates;

Calculate the average traffic corresponding to the time period according to the total traffic of the interface;

Generate an image segmentation line of the interface access image according to the traffic average value, and perform image segmentation on the interface access image according to the image segmentation line to obtain an access segmentation image;

Calculate the sum of the interface traffic corresponding to different time periods in the access segmented image respectively, and calculate the traffic average value of the access segmented image according to the sum of the interface traffic corresponding to different time periods in the access segmented image;

Generate image segmentation lines corresponding to the access segmented images according to the traffic average value of the access segmented images, and perform image segmentation on the access segmented images according to the image segmentation lines in the access segmented images to obtain segmented sub-images;

If the number of the image points in the segmented sub-image is greater than the number threshold, the sum of the interface traffic corresponding to different time periods in the segmented sub-image is calculated respectively, and the interface traffic corresponding to the different time periods in the segmented sub-image is calculated according to the and calculate the flow average of the segmented sub-images;

Generate image segmentation lines corresponding to the segmented sub-images according to the flow average value of the segmented sub-images, and perform image segmentation on the segmented sub-images according to the image segmentation lines in the segmented sub-images;

If the number of the image points in the segmented sub-image is less than or equal to the number threshold, stop the segmentation of the segmented sub-image;

If the number of the image points in the divided sub-image after division is greater than the number threshold, continue to perform image segmentation on the divided sub-image after division until the number of the image points in the divided sub-image after division less than or equal to the quantity threshold;

The segmentation path corresponding to the image point is generated according to the image segmentation line.

Optionally, the image segmentation unit 11 is further configured to: acquire the image segmentation line used to isolate the image point, and perform vector combination of the acquired image segmentation lines to obtain the segmentation path.

Further, the image segmentation unit 11 is further configured to: calculate the arithmetic mean and standard deviation of the length of the segmented path, and perform standardization processing on the segmented path according to the calculated arithmetic mean and the standard deviation;

The normalization formula used for performing the normalization processing on the segmentation path according to the arithmetic mean and the standard deviation is:

A=(B-C)/D;

The abnormality index calculation unit 12 is configured to calculate the abnormality index corresponding to the image point according to the length of the segmentation path, where the abnormality index is used to represent the abnormality degree of the image point.

Wherein, the calculation formula used to calculate the abnormality index corresponding to the image point according to the length of the segmentation path is:

The abnormality determination unit 13 is configured to determine that the traffic of the interface to be detected in the time period corresponding to the image point is abnormal traffic if the abnormality index corresponding to any of the image points is greater than the abnormality threshold.

Wherein, the abnormality determination unit 13 is further configured to: acquire the request object corresponding to the abnormal traffic, and mark the acquired request object abnormally;

If the number of abnormal marking times of the requesting object within a preset time is greater than the number of thresholds, the access address corresponding to the abnormal traffic is obtained, and the access of the requesting object to the access address is prohibited within a preset time interval.

FIG. 6 is a structural block diagram of a terminal device 2 provided by another embodiment of the present application. As shown in FIG. 6 , the terminal device 2 of this embodiment includes: a processor 20, a memory 21, and a computer program 22 stored in the memory 21 and running on the processor 20, such as a method for detecting abnormality in interface traffic program of. When the processor 20 executes the computer program 23, it implements the steps in the various embodiments of the above-mentioned methods for detecting abnormal interface traffic, such as S10 to S40 shown in FIG. 1 , or S21 to S28 shown in FIG. 2 , or shown in FIG. 4 . S50 to S60. Alternatively, when the processor 20 executes the computer program 22, the functions of the units in the embodiment corresponding to FIG. 5 are implemented, for example, the functions of the units 10 to 13 shown in FIG. 5, please refer to the corresponding implementation in FIG. 6 for details. The relevant descriptions in the examples will not be repeated here.

Exemplarily, the computer program 22 may be divided into one or more units, and the one or more units are stored in the memory 21 and executed by the processor 20 to complete the present application. The one or more units may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program 22 in the terminal device 2 . For example, the computer program 22 can be divided into accessing the image rendering unit 10, the image segmentation unit 11, the abnormality index calculation unit 12 and the abnormality determination unit 13, and the specific functions of each unit are as described above.

The terminal device may include, but is not limited to, the processor 20 and the memory 21 . Those skilled in the art can understand that FIG. 6 is only an example of the terminal device 2, and does not constitute a limitation on the terminal device 2, and may include more or less components than those shown in the figure, or combine some components, or different components For example, the terminal device may further include an input and output device, a network access device, a bus, and the like.

The so-called processor 20 may be a central processing unit (Central Processing Unit, CPU), or other general-purpose processors, digital signal processors (Digital Signal Processors, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), Off-the-shelf programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 21 may be an internal storage unit of the terminal device 2 , such as a hard disk or a memory of the terminal device 2 . The memory 21 can also be an external storage device of the terminal device 2, such as a plug-in hard disk equipped on the terminal device 2, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, Flash Card, etc. Further, the memory 21 may also include both an internal storage unit of the terminal device 2 and an external storage device. The memory 21 is used to store the computer program and other programs and data required by the terminal device. The memory 21 can also be used to temporarily store data that has been output or will be output.

An embodiment of the present application further provides a storage medium, where a computer program is stored in the storage medium, and when the computer program is executed by a processor, implements each step of the method for detecting an abnormality in interface traffic provided by any of the above solutions, and the storage medium may As a computer-readable storage medium, the computer-readable storage medium may be non-volatile or volatile.

The above-mentioned embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the above-mentioned embodiments, those of ordinary skill in the art should understand that: it can still be used for the above-mentioned implementations. The technical solutions described in the examples are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions in the embodiments of the application, and should be included in the within the scope of protection of this application.

Claims

A method for detecting anomaly in interface traffic, comprising:

acquiring traffic data of the interface to be detected, and drawing an interface access image according to the traffic data, where the interface access image includes image points formed between different time periods in the traffic data and corresponding interface traffic;

The interface access image is segmented until each image point is isolated, and a segmentation path corresponding to each image point is obtained, and the length of the segmentation path is used to represent the difficulty of isolating the corresponding image point. degree;

Calculate an anomaly index corresponding to the image point according to the length of the segmentation path, where the anomaly index is used to characterize the degree of anomaly of the image point;

If the abnormality index corresponding to any of the image points is greater than the abnormality threshold, it is determined that the traffic of the interface to be detected in the time period corresponding to the image point is abnormal traffic.
The method for detecting anomaly in interface traffic according to claim 1, wherein the drawing an interface access image according to the traffic data comprises:

Divide the time parameter in the traffic data according to the preset time interval to obtain different time periods, and obtain the interface traffic corresponding to the same time period on different dates respectively;

For the same time period, draw the coordinate points corresponding to the acquired interface traffic as the ordinate value and the date corresponding to the interface traffic as the abscissa value to obtain the image point.
The method for detecting anomaly in interface traffic according to claim 1, wherein the interface access image is segmented until each image point is isolated, and a segmentation path corresponding to each image point is obtained, comprising: :

Calculate the total interface traffic of the interface to be detected, where the total interface traffic is the sum of the corresponding interface traffic between the same time period of the interface to be detected in different dates;

Calculate the average traffic corresponding to the time period according to the total traffic of the interface;

Generate an image segmentation line of the interface access image according to the traffic average value, and perform image segmentation on the interface access image according to the image segmentation line to obtain an access segmentation image;

Calculate the sum of the interface traffic corresponding to different time periods in the access segmented image respectively, and calculate the traffic average value of the access segmented image according to the sum of the interface traffic corresponding to different time periods in the access segmented image;

Generate image segmentation lines corresponding to the access segmented images according to the traffic average value of the access segmented images, and perform image segmentation on the access segmented images according to the image segmentation lines in the access segmented images to obtain segmented sub-images;

If the number of the image points in the segmented sub-image is greater than the number threshold, the sum of the interface traffic corresponding to different time periods in the segmented sub-image is calculated respectively, and the interface traffic corresponding to the different time periods in the segmented sub-image is calculated according to the and calculate the flow average of the segmented sub-images;

Generate image segmentation lines corresponding to the segmented sub-images according to the flow average value of the segmented sub-images, and perform image segmentation on the segmented sub-images according to the image segmentation lines in the segmented sub-images;

If the number of the image points in the segmented sub-image is less than or equal to the number threshold, stop the segmentation of the segmented sub-image;

If the number of the image points in the divided sub-image after division is greater than the number threshold, continue to perform image segmentation on the divided sub-image after division until the number of the image points in the divided sub-image after division less than or equal to the quantity threshold;

The segmentation path corresponding to the image point is generated according to the image segmentation line.
The interface traffic anomaly detection method according to claim 3, wherein the generating the segmentation path corresponding to the image point according to the image segmentation line comprises:

Obtaining the image dividing line for isolating the image point, and performing vector combination of the obtained image dividing line to obtain the dividing path.
The interface traffic abnormality detection method according to claim 1, wherein after determining that the traffic of the interface to be detected in the time period corresponding to the image point is abnormal traffic, the method further comprises:

Obtain the request object corresponding to the abnormal traffic, and mark the obtained request object with exception;

If the number of abnormal marking times of the requesting object within a preset time is greater than the number of thresholds, the access address corresponding to the abnormal traffic is obtained, and the access of the requesting object to the access address is prohibited within a preset time interval.
The interface traffic anomaly detection method according to claim 1, wherein the calculation formula used for calculating the anomaly index corresponding to the image point according to the length of the segmented path is:

Among them, E(h(x)) is the length of the segmentation path corresponding to the xth image point, C(Ψ) is the length of the preset segmentation path, and Score(x) is the anomaly index corresponding to the xth image point.
The method for detecting anomaly in interface traffic according to claim 1, wherein the interface access image is segmented until each of the image points is isolated, and after a segmentation path corresponding to each of the image points is obtained, Also includes:

calculating the arithmetic mean and standard deviation of the lengths of the divided paths, and standardizing the divided paths according to the calculated arithmetic mean and standard deviation;

The normalization formula used for performing the normalization processing on the segmentation path according to the arithmetic mean and the standard deviation is:

A=(B-C)/D;

Wherein, A is the length of the divided path after normalization, B is the length of the divided path before normalization, C is the arithmetic mean, and D is the standard deviation.
An interface traffic abnormality detection device, comprising:

An access image drawing unit, configured to acquire traffic data of the interface to be detected, and draw an interface access image according to the traffic data, where the interface access image includes images formed between different time periods in the traffic data and corresponding interface traffic point;

The image segmentation unit is used to segment the interface access image until each of the image points is isolated to obtain a segmentation path corresponding to each of the image points, and the length of the segmentation path is used to represent the isolation corresponding to the The difficulty of describing the image point;

an anomaly index calculation unit, configured to calculate an anomaly index corresponding to the image point according to the length of the segmentation path, where the anomaly index is used to characterize the degree of anomaly of the image point;

An abnormality determination unit, configured to determine that the traffic of the interface to be detected in the time period corresponding to the image point is abnormal traffic if the abnormality index corresponding to any of the image points is greater than an abnormality threshold.
A terminal device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements when the processor executes the computer program:

acquiring traffic data of the interface to be detected, and drawing an interface access image according to the traffic data, where the interface access image includes image points formed between different time periods in the traffic data and corresponding interface traffic;

The interface access image is segmented until each image point is isolated, and a segmentation path corresponding to each image point is obtained, and the length of the segmentation path is used to represent the difficulty of isolating the corresponding image point. degree;

Calculate an anomaly index corresponding to the image point according to the length of the segmentation path, where the anomaly index is used to characterize the degree of anomaly of the image point;

If the abnormality index corresponding to any of the image points is greater than the abnormality threshold, it is determined that the traffic of the interface to be detected in the time period corresponding to the image point is abnormal traffic.
The terminal device according to claim 9, wherein the drawing an interface access image according to the traffic data comprises:

Divide the time parameter in the traffic data according to the preset time interval to obtain different time periods, and obtain the interface traffic corresponding to the same time period on different dates respectively;

For the same time period, the corresponding acquired interface traffic is the ordinate value, and the date corresponding to the interface traffic is the abscissa value, and coordinate points are drawn to obtain the image points.
The terminal device according to claim 9, wherein the dividing the interface access image until each of the image points is isolated, and obtaining a segmentation path corresponding to each of the image points, comprising:

Calculate the total interface traffic of the interface to be detected, where the total interface traffic is the sum of the corresponding interface traffic between the same time period of the interface to be detected in different dates;

Calculate the average traffic corresponding to the time period according to the total traffic of the interface;

Generate an image segmentation line of the interface access image according to the traffic average value, and perform image segmentation on the interface access image according to the image segmentation line to obtain an access segmentation image;

Calculate the sum of the interface traffic corresponding to different time periods in the access segmented image respectively, and calculate the traffic average value of the access segmented image according to the sum of the interface traffic corresponding to different time periods in the access segmented image;

Generate image segmentation lines corresponding to the access segmented images according to the traffic average value of the access segmented images, and perform image segmentation on the access segmented images according to the image segmentation lines in the access segmented images to obtain segmented sub-images;

If the number of the image points in the segmented sub-image is greater than the number threshold, the sum of the interface traffic corresponding to different time periods in the segmented sub-image is calculated respectively, and the interface traffic corresponding to the different time periods in the segmented sub-image is calculated according to the and calculate the flow average of the segmented sub-images;

Generate image segmentation lines corresponding to the segmented sub-images according to the flow average value of the segmented sub-images, and perform image segmentation on the segmented sub-images according to the image segmentation lines in the segmented sub-images;

If the number of the image points in the segmented sub-image is less than or equal to the number threshold, stop the segmentation of the segmented sub-image;

If the number of the image points in the divided sub-image after division is greater than the number threshold, continue to perform image segmentation on the divided sub-image after division until the number of the image points in the divided sub-image after division less than or equal to the quantity threshold;

The segmentation path corresponding to the image point is generated according to the image segmentation line.
The terminal device according to claim 11, wherein the generating the segmentation path corresponding to the image point according to the image segmentation line comprises:

Obtaining the image dividing line for isolating the image point, and performing vector combination of the obtained image dividing line to obtain the dividing path.
The terminal device according to claim 9, wherein after determining that the traffic of the interface to be detected in the time period corresponding to the image point is abnormal traffic, the method further comprises:

Obtain the request object corresponding to the abnormal traffic, and mark the obtained request object with exception;

If the number of abnormal marking times of the requesting object within a preset time is greater than the number of thresholds, the access address corresponding to the abnormal traffic is obtained, and the access of the requesting object to the access address is prohibited within a preset time interval.
The terminal device according to claim 9, wherein the calculation formula used for calculating the abnormality index corresponding to the image point according to the length of the segmentation path is:

Among them, E(h(x)) is the length of the segmentation path corresponding to the xth image point, C(Ψ) is the length of the preset segmentation path, and Score(x) is the anomaly index corresponding to the xth image point.
A storage medium storing a computer program, wherein the computer program is implemented when executed by a processor:

acquiring traffic data of the interface to be detected, and drawing an interface access image according to the traffic data, where the interface access image includes image points formed between different time periods in the traffic data and corresponding interface traffic;

The interface access image is segmented until each image point is isolated, and a segmentation path corresponding to each image point is obtained, and the length of the segmentation path is used to represent the difficulty of isolating the corresponding image point. degree;

Calculate an anomaly index corresponding to the image point according to the length of the segmentation path, where the anomaly index is used to characterize the degree of anomaly of the image point;

If the abnormality index corresponding to any of the image points is greater than the abnormality threshold, it is determined that the traffic of the interface to be detected in the time period corresponding to the image point is abnormal traffic.
The storage medium according to claim 15, wherein the drawing an interface access image according to the traffic data comprises:

Divide the time parameter in the traffic data according to the preset time interval to obtain different time periods, and obtain the interface traffic corresponding to the same time period on different dates respectively;

For the same time period, draw the coordinate points corresponding to the acquired interface traffic as the ordinate value and the date corresponding to the interface traffic as the abscissa value to obtain the image point.
The storage medium according to claim 15, wherein the dividing the interface access image until each of the image points is isolated, and obtaining a division path corresponding to each of the image points, comprising:

Calculate the total interface traffic of the interface to be detected, where the total interface traffic is the sum of the corresponding interface traffic between the same time period of the interface to be detected in different dates;

Calculate the average traffic corresponding to the time period according to the total traffic of the interface;

Generate an image segmentation line of the interface access image according to the traffic average value, and perform image segmentation on the interface access image according to the image segmentation line to obtain an access segmentation image;

Calculate the sum of the interface traffic corresponding to different time periods in the access segmented image respectively, and calculate the traffic average value of the access segmented image according to the sum of the interface traffic corresponding to different time periods in the access segmented image;

Generate image segmentation lines corresponding to the access segmented images according to the traffic average value of the access segmented images, and perform image segmentation on the access segmented images according to the image segmentation lines in the access segmented images to obtain segmented sub-images;

If the number of the image points in the segmented sub-image is greater than the number threshold, the sum of the interface traffic corresponding to different time periods in the segmented sub-image is calculated respectively, and the interface traffic corresponding to the different time periods in the segmented sub-image is calculated according to the and calculate the flow average of the segmented sub-images;

Generate image segmentation lines corresponding to the segmented sub-images according to the flow average value of the segmented sub-images, and perform image segmentation on the segmented sub-images according to the image segmentation lines in the segmented sub-images;

If the number of the image points in the segmented sub-image is less than or equal to the number threshold, stop the segmentation of the segmented sub-image;

If the number of the image points in the divided sub-image after division is greater than the number threshold, continue to perform image segmentation on the divided sub-image after division until the number of the image points in the divided sub-image after division less than or equal to the quantity threshold;

The segmentation path corresponding to the image point is generated according to the image segmentation line.
The storage medium according to claim 17, wherein the generating the segmentation path corresponding to the image point according to the image segmentation line comprises:

Obtaining the image dividing line for isolating the image point, and performing vector combination of the obtained image dividing line to obtain the dividing path.
The storage medium according to claim 15, wherein after determining that the traffic of the interface to be detected in the time period corresponding to the image point is abnormal traffic, the method further comprises:

Obtain the request object corresponding to the abnormal traffic, and mark the obtained request object with exception;

If the number of abnormal marking times of the requesting object within a preset time is greater than the number of thresholds, the access address corresponding to the abnormal traffic is obtained, and the access of the requesting object to the access address is prohibited within a preset time interval.
The storage medium according to claim 15, wherein the calculation formula used for calculating the abnormality index corresponding to the image point according to the length of the segmentation path is:

Among them, E(h(x)) is the length of the segmentation path corresponding to the xth image point, C(Ψ) is the length of the preset segmentation path, and Score(x) is the anomaly index corresponding to the xth image point.