WO2024040794A1 - 一种异常流量检测方法、装置、电子设备及存储介质 - Google Patents

一种异常流量检测方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2024040794A1
WO2024040794A1 PCT/CN2022/136983 CN2022136983W WO2024040794A1 WO 2024040794 A1 WO2024040794 A1 WO 2024040794A1 CN 2022136983 W CN2022136983 W CN 2022136983W WO 2024040794 A1 WO2024040794 A1 WO 2024040794A1
Authority
WO
WIPO (PCT)
Prior art keywords
alarm
coefficient
traffic
service
historical
Prior art date
Application number
PCT/CN2022/136983
Other languages
English (en)
French (fr)
Inventor
梁希望
倪魁
韦佳明
Original Assignee
天翼安全科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 天翼安全科技有限公司 filed Critical 天翼安全科技有限公司
Publication of WO2024040794A1 publication Critical patent/WO2024040794A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/04—Processing captured monitoring data, e.g. for logfile generation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876—Network utilisation, e.g. volume of load or congestion level
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Definitions

  • the present application relates to the field of communication technology, and in particular to an abnormal traffic detection method, device, electronic equipment and storage medium.
  • Embodiments of the present application provide an abnormal traffic detection method, device, electronic device and storage medium for identifying the service type of user business traffic and detecting abnormal traffic.
  • an abnormal traffic detection method including:
  • N is an integer greater than or equal to 1;
  • n is an integer greater than or equal to 1 and less than N;
  • the alarm coefficient of the nth business type is determined based on the prediction accuracy of the nth business type in historical alarm information; the historical alarm information is obtained within one or more preset periods, so The prediction accuracy rate is the ratio of the number of times that historical comprehensive service traffic is greater than or equal to the first threshold and the number of one or more preset periods, and the historical comprehensive service traffic is based on the alarm coefficient of the nth business type Determined by the historical service traffic of the nth service type in the historical alarm information within the preset period;
  • alarm information is generated.
  • the above method during the abnormal traffic detection process, accurately identifies the business type of the business traffic input by the user, detects the abnormal traffic in a timely manner, forms a strong protection for the business traffic, and improves the efficiency of abnormal traffic detection.
  • the method also includes:
  • the above method sends alarms to users and receives abnormal traffic protection instructions sent by users, so that alarm information can be processed in a timely manner, and the protection equipment can perform protective operations in a timely manner, thereby improving protection efficiency.
  • the method also includes:
  • a detection chain is generated in order of the priority information from high to low; the detection chain includes the nth service type and the alarm coefficient of the nth service type.
  • the above method determines the priority information of n service types, generates a detection chain, and determines the alarm coefficient of the service type.
  • the alarm coefficients of different business types are updated in the detection chain.
  • the detection chain is generated in order from high to low according to the priority information, including:
  • the kth detection information point is the priority in the detection chain from high to low
  • the nth business type determined by the sequence; k is an integer greater than or equal to 0;
  • the prediction accuracy is the kth detection information point in the historical alarm information prediction accuracy
  • the first warning coefficient is determined as the warning coefficient of the k-th detection information point.
  • the above method determines the first alarm coefficient as the alarm coefficient of the k-th detection information point by comparing the historical comprehensive service traffic with the first threshold, and updates the alarm coefficient of the k-th detection information point.
  • the method also includes:
  • the updated historical comprehensive service traffic is determined.
  • the above method determines the updated historical comprehensive service traffic by updating the first alarm coefficient. It is further determined whether the above alarm coefficient can be used as the alarm coefficient of the kth detection information point.
  • the method also includes:
  • the updated first alarm coefficient reaches the maximum value and the historical comprehensive service traffic is less than the first threshold, or the prediction accuracy is less than the preset probability
  • the k+1th detection information point and the second alarm coefficient of the k+1th detection information point determine the updated historical comprehensive service traffic;
  • the k+1th detection The information point is the n+1th service type determined in order from high to low priority in the detection chain;
  • an updated second alarm coefficient is determined according to the second alarm coefficient and the preset step size.
  • the above method determines the updated historical comprehensive service traffic by updating the second alarm coefficient of the k+1th detection information point. It is further determined whether the above-mentioned first alarm coefficient can be used as the alarm coefficient of the k-th detection information point. Can the above-mentioned second alarm coefficient be used as the alarm coefficient of the k-th detection information point.
  • the method also includes:
  • an updated prediction accuracy rate is determined;
  • the updated prediction accuracy rate is the kth detection information point and the k+th detection information point The prediction accuracy rate of one detection information point in the historical alarm information;
  • the maximum value of the warning coefficient is determined to be the warning coefficient of the k-th detection information point, and the updated second warning coefficient is determined to be the warning coefficient of the kth detection information point.
  • the above method determines the prediction accuracy rate.
  • the maximum value of the alarm coefficient is determined to be the alarm coefficient of the k-th detection information point, and the updated second alarm coefficient is determined to be the k+1th The alarm coefficient of each detection information point.
  • the method also includes:
  • the updated second warning coefficient is determined according to the second warning coefficient and the preset step size.
  • the above method determines the updated second alarm coefficient through the second alarm coefficient and the preset step size. It is further determined whether the above-mentioned first alarm coefficient can be used as the alarm coefficient of the k-th detection information point. Can the above-mentioned second alarm coefficient be used as the alarm coefficient of the k-th detection information point.
  • an abnormal flow detection device including:
  • An identification module used to identify N service types of each service flow; the N is an integer greater than or equal to 1;
  • a processing module configured to determine the comprehensive service flow according to the alarm coefficient of the nth service type and the service flow of the nth service type; the n is an integer greater than or equal to 1 and less than N;
  • the alarm coefficient of the nth business type is determined based on the prediction accuracy of the nth business type in historical alarm information; the historical alarm information is obtained within one or more preset periods, so The prediction accuracy rate is the ratio of the number of times that historical comprehensive service traffic is greater than or equal to the first threshold and the number of one or more preset periods, and the historical comprehensive service traffic is based on the alarm coefficient of the nth business type Determined by the historical service traffic of the nth service type in the historical alarm information within the preset period;
  • a generating module configured to generate alarm information when the comprehensive service traffic is greater than or equal to the second threshold.
  • embodiments of the present application also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor.
  • the processor implements the above Any abnormal traffic detection method in the first aspect.
  • embodiments of the present application further provide a computer-readable storage medium.
  • a computer program is stored in the computer-readable storage medium.
  • the abnormal traffic detection of the first aspect is implemented. method.
  • embodiments of the present application further provide a computer program product, including a computer program that is executed by a processor to implement the abnormal traffic detection method in any one of the above first aspects.
  • Figure 1 is a schematic diagram of an application scenario of an abnormal traffic detection method provided by an embodiment of the present application
  • Figure 2 is a flow chart of an abnormal traffic detection method provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of an alarm SMS prompt interface provided by an embodiment of the present application.
  • Figure 4 is a flow chart of a certain detection chain provided by an embodiment of the present application.
  • Figure 5 is a schematic diagram of a detection chain provided by an embodiment of the present application.
  • Figure 6 is a schematic diagram of another detection chain provided by an embodiment of the present application.
  • Figure 7 is a schematic diagram of another detection chain provided by an embodiment of the present application.
  • Figure 8 is a schematic diagram of another detection chain provided by an embodiment of the present application.
  • Figure 9 is a schematic diagram of another detection chain provided by an embodiment of the present application.
  • Figure 10 is an overall flow chart for detecting abnormal traffic provided by an embodiment of the present application.
  • Figure 11 is a schematic diagram of an abnormal flow detection device provided by an embodiment of the present application.
  • Figure 12 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • N service types of each service flow are identified.
  • N is an integer greater than or equal to 1.
  • the comprehensive service flow is determined based on the alarm coefficient of the nth service type and the service flow of the nth service type.
  • n is an integer greater than or equal to 1 and less than N.
  • the alarm coefficient of the nth business type is determined based on the prediction accuracy of the nth business type in historical alarm information. Historical alarm information is obtained within one or more preset periods.
  • the prediction accuracy is the ratio of the number of times that historical comprehensive service traffic is greater than or equal to the first threshold and the number of one or more preset periods.
  • the historical comprehensive service flow is determined based on the alarm coefficient of the nth service type and the historical service flow of the nth service type in the historical alarm information within a preset period.
  • alarm information is generated.
  • a schematic diagram of the application scenario of an optional abnormal traffic detection method includes a server 100 and a terminal 101.
  • the server 100 and the terminal 101 can realize a communicable connection through the network, so as to Implement the abnormal traffic detection method of this application.
  • the user can use the server 100 to interact with the terminal 101 through the network, such as receiving or sending messages.
  • Various client applications can be installed on the terminal 101, such as programming applications, web browser applications, search applications, etc.
  • the terminal 101 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, desktop computers, and so on.
  • the server 100 is used to identify N service types of each service flow.
  • N is an integer greater than or equal to 1.
  • the comprehensive service flow is determined based on the alarm coefficient of the nth service type and the service flow of the nth service type. Among them, n is an integer greater than or equal to 1 and less than N.
  • the alarm coefficient of the nth business type is determined based on the prediction accuracy of the nth business type in historical alarm information. Historical alarm information is obtained within one or more preset periods.
  • the prediction accuracy rate is the ratio of the number of times that the historical comprehensive service traffic is greater than or equal to the first threshold and the number of one or more preset periods.
  • the historical comprehensive service flow is determined based on the alarm coefficient of the nth service type and the historical service flow of the nth service type in the historical alarm information within a preset period. When the comprehensive service traffic is greater than or equal to the second threshold, alarm information is generated.
  • the server 100 can be implemented as an independent server or a server cluster composed of multiple servers.
  • the flow chart of an abnormal traffic detection method may specifically include the following steps:
  • Step S201 Identify N service types of each service flow; N is an integer greater than or equal to 1;
  • Step S202 Determine the comprehensive service flow according to the alarm coefficient of the nth service type and the service flow of the nth service type; n is an integer greater than or equal to 1 and less than N;
  • Step S203 When the comprehensive service traffic is greater than or equal to the second threshold, generate alarm information.
  • the user starts the client through the operation interface of the terminal and inputs the service traffic. For example, a user can click on a video link on the client to watch the video.
  • step S201 after the user inputs service traffic, the server identifies N service types of the input service flow according to the data packets of the input service flow, and detects whether the user's input service flow is abnormal traffic.
  • N is an integer greater than or equal to 1.
  • An optional implementation method is to use Deep Packet Inspection (DPI) to identify the user's input business traffic after receiving the user's input business traffic.
  • DPI Deep Packet Inspection
  • deploying the DPI device to a key network node can greatly reduce resource consumption on the server side.
  • abnormal traffic is detected in a timely manner through DPI, and in-depth detection is performed for application layer loads of different networks (such as Domain Name System (DNS), Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, HTTP), etc.) .
  • DNS Domain Name System
  • HTTP Hyper Text Transfer Protocol
  • user business traffic and flow trends of different types of user business traffic can be further accurately identified.
  • Statistical analysis based on DPI can guide the control surface to optimize and adjust the configuration of hardware devices. Thereby providing users with better network services and improving user experience.
  • the DPI device identifies the data packets of the user's input service traffic into the service types in Table 1 according to the mainstream Internet service classification table shown in Table 1. By identifying each business type of input business traffic, the level of granularity in controlling input business traffic is improved.
  • the service type of the service flow is traditional data service. If the protocol type of the input service flow is text message, then the service type of the service flow is instant messaging service.
  • the protocol type of the business traffic data packet is matched and identified based on the port identification rules, keyword identification rules, and five-tuple matching rules contained in the DPI.
  • the following describes how to specifically identify the protocol type of the input business traffic based on the port identification rules, keyword identification rules, and quintuple matching rules.
  • port identification is based on packet-by-packet matching of business traffic data packet ports based on commonly used business ports. According to Table 2, common port service tables are matched.
  • the protocol type of the business traffic is File Transfer Protocol. If the port number is TCP23, the protocol type of the service traffic is the remote connection command.
  • TCP Transmission Control Protocol
  • the keyword identification is to match the business traffic data packets input by the data user containing the keywords packet by packet according to the keywords in the knowledge base. According to Table 3, common business keyword tables are matched.
  • the protocol type of the business traffic is Hyper Text Transfer Protocol (HTTP).
  • HTTP Hyper Text Transfer Protocol
  • the data packet of the business traffic input by the user includes the 13 and 14 bytes at the beginning of the MAC frame as 0x0800, and the protocol field in the IP header is 0x02, then the protocol type of the business traffic is Internet Control Message Protocol. ICMP).
  • Five-tuple identification that is, Internet Protocol (IP) five-tuple identification, including source address, destination address, protocol type, source port number, and destination port number.
  • IP Internet Protocol
  • a 5-tuple hash table corresponding to the identified 5-tuple and business type. For the business traffic data packets input by the user, extract the quintuple of the data flow packet by packet, use the preset hash algorithm to calculate the hash value based on the quintuple information of the IP message, and use the hash value to search the data in the hash table , thereby matching the service type of the above service traffic.
  • the above-mentioned port identification, keyword identification, and quintuple matching methods have no fixed identification order, and any method is feasible for matching business traffic data packets. After any of the above methods successfully matches the business traffic data packets, other matching methods do not need to match the business traffic data packets again.
  • the data information corresponding to each business type is stored according to different business types. Among them, data information includes traffic data and other information.
  • the service type of the service traffic input by the user is identified according to a preset period.
  • the preset period is set to 5 minutes
  • all inputs between the time point corresponding to the previous preset period and the time point corresponding to this preset period will be identified.
  • N business types of business traffic For example, if the preset period is set to 5 minutes, after the time point corresponding to this preset period arrives, all inputs between the time point corresponding to the previous preset period and the time point corresponding to this preset period will be identified. N business types of business traffic.
  • the service type of the service traffic is identified in real time according to the data packet of the input service traffic.
  • the alarm coefficient of the nth service type is determined based on the prediction accuracy of the nth service type in the historical alarm information.
  • Historical alarm information is obtained within one or more preset periods.
  • the prediction accuracy rate is the ratio of the number of times that the historical comprehensive service traffic is greater than or equal to the first threshold and the number of one or more preset periods.
  • the historical comprehensive service flow is determined based on the alarm coefficient of the nth service type and the historical service flow of the nth service type in the historical alarm information within a preset period.
  • n is an integer greater than or equal to 1 and less than N.
  • n takes an integer from 1 to N.
  • the comprehensive service flow is calculated based on the sum of the products of the alarm coefficients of the N service types and the service flows of the N service types.
  • the alarm coefficient of the first service type is 1.5.
  • the service traffic of the first service type is 20 Gigabyte (G).
  • the alarm coefficient of the second service type is 1.1.
  • the service traffic of the second service type is 15G.
  • the alarm coefficient of the service type can be a real number, such as 0, 1, 1.5, 2, etc.
  • the alarm coefficient is updated based on historical alarm data and will be introduced later.
  • step S203 in an optional implementation, when the comprehensive service traffic is greater than or equal to the second threshold, alarm information is generated.
  • the comprehensive service traffic is greater than or equal to the second threshold, it means that abnormal traffic is detected, and alarm information needs to be generated at this time.
  • the alarm information includes the address information, packet length, Uniform Resource Identifier (URI) information, traffic data and other information of the business traffic input by the user.
  • URI Uniform Resource Identifier
  • the second threshold in the embodiment of the present application is determined based on the maximum value of the total business traffic model input by the user within the preset period, combined with the misjudgment tolerance to prevent business traffic jitter.
  • the second threshold represents the maximum value of the input business traffic within the normal range within the preset period.
  • the second threshold can also be an empirical value preset by those skilled in the art, and the second threshold can be reasonably set according to specific application scenarios.
  • the user connects with the online security knowledge base based on the business type, uses a big data analysis engine to establish a local security knowledge base, and converts the Internet Protocol (Internet Protocol) in the business traffic input by the user. IP) equipment, traffic, traffic behavior and other information are compared with the local knowledge base to determine whether there is alarm information.
  • IP Internet Protocol
  • the above-mentioned local security knowledge base can be updated according to user needs.
  • an alarm is sent to the user.
  • Receive the abnormal traffic protection instructions sent by the user issue the abnormal traffic protection instructions to the protection device, and perform the operations corresponding to the abnormal traffic protection instructions.
  • an alarm text message will be sent to the user.
  • the user replies with a text message indicating specific protection instructions.
  • the abnormal traffic protection instruction is sent to the protection device according to the abnormal traffic protection instruction, and the operation corresponding to the abnormal traffic protection instruction is performed.
  • the detection period includes one or more preset periods.
  • the detection period, preset period, and preset value in the embodiment of the present application can be empirical values preset by those skilled in the art, and the detection period, preset period, and preset value can be reasonably set according to specific application scenarios.
  • the service traffic input by the user will be detected every 5 minutes.
  • the detection cycle is 1 hour.
  • the default value is 5.
  • an alarm text message will be sent to the user.
  • the alarm text message indicates that the abnormal traffic has exceeded the preset value during the detection period.
  • Reply 2 indicates firewall hardening. If the user sends 1, the abnormal traffic protection instruction sent by the user will be received. Send the abnormal traffic protection command to the protection device and perform the operations corresponding to the abnormal traffic protection command.
  • the alarm coefficient of the nth service type is updated based on historical alarm information. Users can also set the alarm coefficient appropriately according to specific application scenarios.
  • FIG. 4 is an exemplary flow chart of a method for generating a detection chain in an embodiment of the present application, which may include the following operations:
  • Step S401 Determine the historical comprehensive service traffic according to the maximum value of the alarm coefficient and the historical business traffic of N business types in a preset period within the historical alarm information;
  • Step S402 Determine the prediction accuracy of the nth business type based on the ratio of the number of times that the historical comprehensive service traffic is greater than or equal to the first threshold and the number of all preset periods in the historical alarm information;
  • Step S403 Determine the priority information of N business types based on the prediction accuracy of the nth business type
  • Step S404 Determine the historical comprehensive service traffic based on the k-th detection information point and the first alarm coefficient of the k-th detection information point; the k-th detection information point is the first detection information point determined in order from high to low priority in the detection chain.
  • n business types; k is an integer greater than or equal to 0;
  • Step S405 Determine whether the historical comprehensive service traffic is less than the first threshold; if so, execute step S406; if not, execute step S410;
  • Step S406 Determine whether the first alarm coefficient is less than the maximum alarm coefficient. If so, execute step S408; if not, execute step S407;
  • Step S407 Determine the updated historical comprehensive service traffic based on the kth detection information point and the maximum alarm coefficient, the k+1th detection information point and the second alarm coefficient of the k+1th detection information point; the k+1th detection information point and the second alarm coefficient of the k+1th detection information point are determined;
  • One detection information point is the n+1th service type determined in order from high to low priority in the detection chain; return to step S405;
  • Step S408 Determine the updated first alarm coefficient according to the first alarm coefficient and the preset step size
  • Step S409 Determine the updated historical comprehensive service traffic based on the k-th detection information point and the updated first alarm coefficient; return to step S405;
  • Step S410 Determine the prediction accuracy of the k-th detection information point in the historical alarm information
  • Step S411 Determine whether the prediction accuracy is less than the preset probability; if yes, return to step S406; if not, execute step S412;
  • Step S412 Determine the first alarm coefficient as the alarm coefficient of the k-th detected information point.
  • step S401 in an optional implementation, the maximum value of the alarm coefficient and the historical service traffic of the nth service type in a preset period within the historical alarm information are used to determine the historical comprehensive service of the nth service type. flow. Based on the maximum value of the alarm coefficient and the historical service traffic of N service types in a preset period within the historical alarm information, the historical comprehensive service flow of N service types in a preset period is determined.
  • the maximum value of the alarm coefficient can be an empirical value preset by those skilled in the art, and the maximum value of the alarm coefficient can be reasonably set according to specific application scenarios, such as 1.4, 1.5 or 2, etc.
  • the historical service traffic of the nth service type in different preset periods is not necessarily the same, the historical comprehensive service traffic of different service types in different preset periods is not necessarily the same.
  • the first thresholds in different preset periods may be the same or different.
  • the historical service traffic of the instant messaging service is 20G.
  • the maximum value of the alarm coefficient is 1.5. Multiply the historical business traffic 20G of the instant messaging service by the maximum alarm coefficient of 1.5 to obtain the historical comprehensive business traffic 30G.
  • the first threshold in the embodiment of the present application is the maximum value of the total business traffic determined based on the total business traffic model input by the user within the preset period, combined with the misjudgment tolerance to prevent business traffic jitter.
  • the first threshold represents the maximum value of the input service traffic within the normal range within the preset period.
  • the first threshold may also be an empirical value preset by those skilled in the art, and the first threshold may be reasonably set according to specific application scenarios.
  • the historical comprehensive service traffic is determined based on the maximum value of the alarm coefficient and the historical service traffic of N service types in a preset period within the historical alarm information.
  • the historical comprehensive service traffic of the nth service type in a preset period is greater than or equal to the first threshold, it means that the detection of the service type is successful once.
  • the nth service type is calculated based on the historical service traffic and the maximum alarm coefficient in each preset period. Set the historical comprehensive service traffic within the period and compare it with the first threshold in each preset period. Record the number of times that historical comprehensive service traffic is greater than or equal to the first threshold. The ratio of the number of times that the historical comprehensive service traffic is greater than or equal to the first threshold and the preset period is used as the prediction accuracy of the nth service type.
  • the method of calculating the prediction accuracy of the n+1th business type can be implemented by referring to the method of calculating the prediction accuracy of the nth business type, which will not be described again here.
  • using the maximum alarm coefficient can increase the number of times that the historical comprehensive service traffic of the nth business type is greater than or equal to the first threshold in the historical alarm information, and increase the number of Forecast accuracy by business type.
  • step S403 in an optional implementation, after determining the prediction accuracy of the N service types, determine the priority information of the N service types based on the prediction accuracy of the nth service type.
  • the priority information of the prediction accuracy of the nth business type among the N business types is determined.
  • the order of priority information from high to low is determined according to the relationship between prediction accuracy.
  • the order of priority information from high to low is: instant messaging service, streaming media service, traditional data service, and P2P service.
  • the two business types with the same prediction accuracy can be sorted according to the priority order of business types preset by those skilled in the art, and the pre-set The priority order of the set business types can be set appropriately according to the specific application scenarios.
  • a detection chain is generated in order of priority information from high to low.
  • the detection chain includes the nth service type and the alarm coefficient of the nth service type.
  • the historical service traffic of the k-th detection information point is multiplied by the first alarm coefficient of the k-th detection information point to determine the historical comprehensive service traffic.
  • the k-th detection information point is the k-th service type determined in order from high to low priority in the detection chain. k is an integer greater than or equal to 0.
  • the first alarm coefficient can be an empirical value preset by those skilled in the art, and the first alarm coefficient can be reasonably set according to the specific application scenario, such as 0, 1 or 2, etc.
  • the first service type determined according to the priority order from high to low is the instant messaging service
  • the first detection information point is the instant messaging service.
  • the first alarm coefficient is 1.0.
  • the historical business traffic of the instant messaging service is 20G. Then multiply the historical business traffic of the instant messaging service by 20G by the first alarm coefficient 1.0 to obtain the historical comprehensive business traffic.
  • step S405 it is determined whether the historical comprehensive service traffic is less than a first threshold. If the historical comprehensive service traffic is less than the first threshold, step S406 is executed to determine whether the first alarm coefficient is less than the maximum alarm coefficient. If the historical comprehensive service traffic is not less than the first threshold, step S410 is executed to determine the prediction accuracy of the k-th detection information point in the historical alarm information.
  • step S406 in an optional implementation, it is determined whether the first warning coefficient is less than the maximum value of the warning coefficient. If the first warning coefficient is less than the maximum value of the warning coefficient, step S408 is executed to determine an updated first warning coefficient according to the first warning coefficient and the preset step size.
  • step S407 is executed.
  • the k+1th detection information point and the second value of the k+1th detection information point are The alarm coefficient determines the updated historical comprehensive business traffic.
  • the k+1th detection information point is the n+1th service type determined in order from high to low priority in the detection chain.
  • step S407 in an optional implementation, the historical service traffic of the kth detection information point is multiplied by the maximum alarm coefficient of the kth detection information point.
  • the historical service traffic of the k+1th detection information point is multiplied by the second alarm coefficient of the k+1th detection information point.
  • the k+1th detection information point is the n+1th service type determined in order from high to low priority in the detection chain.
  • the second alarm coefficient can be an empirical value preset by those skilled in the art, and the second alarm coefficient can be reasonably set according to the specific application scenario, such as 0, 1 or 2, etc.
  • the updated prediction accuracy is determined. According to the kth detection information point and the maximum alarm coefficient of the kth detection information point, the k+1th detection information point and the second alarm coefficient of the k+1th detection information point, determine the historical alarm information The number of times the historical comprehensive service traffic in other preset periods is greater than or equal to the first threshold.
  • the update time of the k-th detection information point and the k+1-th detection information point in the historical alarm information is determined. Prediction accuracy.
  • the maximum value of the warning coefficient is determined to be the warning coefficient of the k-th detected information point.
  • the updated second alarm coefficient is determined to be the alarm coefficient of the k+1th detection information point.
  • the updated second warning coefficient is determined according to the second warning coefficient and the preset step size.
  • the updated historical comprehensive service traffic is determined based on the kth detection information point and the maximum value of the alarm coefficient, the k+1th detection information point and the updated second alarm coefficient of the k+1th detection information point.
  • the k+1-th detection information point and the maximum alarm coefficient of the k+1-th detection information point determine the updated historical comprehensive service traffic.
  • the k+2th detection information point is the n+2th service type determined in order from high to low priority in the detection chain.
  • step S408 in an optional implementation, when the historical comprehensive service traffic is less than the first threshold and the first alarm coefficient is less than the maximum alarm coefficient, the system is configured according to the first alarm coefficient and the preset step size. Determine the updated first alarm coefficient.
  • the updated historical comprehensive service traffic is determined based on the k-th detection information point and the updated first alarm coefficient of the k-th detection information point.
  • the preset step size can be an empirical value preset by those skilled in the art, and the preset step size can be reasonably set according to specific application scenarios. If the preset step size is too small, after the alarm coefficient is adjusted, the changes in historical comprehensive business traffic, prediction accuracy and other information will not be obvious. If the preset step size is too large, after the alarm coefficient is adjusted, the changes in historical comprehensive business traffic, prediction accuracy and other information will be unreasonable.
  • the first detection information point is the instant messaging service.
  • the first alarm coefficient is 1.0.
  • the historical business traffic of the instant messaging service is 20G.
  • the initial value of the alarm coefficient 1.0 is updated according to the preset step size 0.1, and the updated The first alarm coefficient is 1.1.
  • step S409 the updated historical comprehensive service traffic is determined based on the k-th detection information point and the updated first alarm coefficient. Step S405 is then executed to determine whether the updated historical comprehensive service traffic is less than the first threshold.
  • step S410 in an optional implementation, when the historical comprehensive service traffic determined based on the k-th detection information point and the first alarm coefficient of the k-th detection information point is greater than or equal to the first threshold Next, determine the number of times that the historical comprehensive service traffic is greater than or equal to the first threshold within the preset period of the historical alarm information. The prediction accuracy is determined based on the ratio of the number of times that the historical comprehensive service traffic is greater than or equal to the first threshold and the number of one or more preset periods.
  • the preset probability in the embodiment of the present application can be an empirical value preset by those skilled in the art, and the preset probability can be reasonably set according to specific application scenarios.
  • the prediction accuracy of the detection chain represents the prediction accuracy of the detection information points included in the detection chain in the historical alarm information.
  • the detection chain can contain one or more detection information points. For example, there are multiple detection information points such as 1 detection information point, 2 detection information points, or 3 detection information points. Taking two detection information points in the detection chain as an example, within a preset period of obtaining historical alarm information, calculate the product of the alarm coefficient of the first detection information point and the historical business flow of the first detection information point, And the product of the alarm coefficient of the second detection information point and the historical business traffic of the second detection information point. The above two products are summed to determine the historical comprehensive service flow in the preset period. Compare the above historical comprehensive service traffic with the first threshold of the preset period.
  • the detection chain prediction is successful once. Record the number of times that historical comprehensive service traffic is greater than or equal to the first threshold during all preset periods in which historical alarm information is obtained. The ratio of the number of times that the historical comprehensive service traffic is greater than or equal to the first threshold and the number of preset periods is used as the prediction accuracy of the detection chain.
  • the first detection information point is the instant messaging service.
  • the first detection information point is the instant messaging service.
  • step S411 in an optional implementation, it is determined whether the prediction accuracy of the k-th detection information point in the historical alarm information is less than a preset probability.
  • step S406 By judging whether the first alarm coefficient is less than the maximum value of the alarm coefficient, it is determined whether to update the first alarm coefficient. Or, determine the updated historical comprehensive service traffic based on the k-th detection information point and the maximum alarm coefficient, the k+1-th detection information point, and the second alarm coefficient of the k+1-th detection information point.
  • the updated first warning coefficient is determined according to the first warning coefficient and the preset step size. Based on the k-th detection information point and the updated first alarm coefficient, the updated historical comprehensive service traffic is determined. Determine again whether the updated historical comprehensive service traffic is greater than the first threshold. Whether the updated prediction accuracy is less than the preset probability.
  • step S412 in an optional implementation, when the prediction accuracy is greater than or equal to the preset probability, the first warning coefficient is determined as the warning coefficient of the k-th detection information point.
  • the embodiment shown in FIG. 4 will be described below.
  • the first threshold is 30G.
  • each service type can be sorted in descending order of prediction accuracy.
  • the historical service traffic of the instant messaging service is 20G, and it is assumed that the maximum alarm coefficient is 1.5.
  • the first threshold is 40G.
  • the historical business traffic of instant messaging service is 30G.
  • the maximum value of the alarm coefficient is 1.5.
  • the total number of times that the historical comprehensive service traffic of the instant messaging service is greater than or equal to the first threshold is 1,800 times.
  • the prediction accuracy of instant messaging business is 90%.
  • the prediction accuracy rate of streaming media business is determined to be 60%.
  • the prediction accuracy of P2P business is 50%.
  • the priority information is determined to be instant messaging business, streaming media business, and P2P business. Therefore, the first detection information point in the detection chain is the instant messaging service.
  • the first alarm coefficient is 1.0.
  • the preset step size is 0.1.
  • the first alarm coefficient 1.0 is less than the maximum alarm coefficient 1.5.
  • the first alarm coefficient is updated to 1.0 according to the preset step size of 0.1, and the updated first alarm coefficient is 1.1.
  • multiply the historical service traffic 20G of the instant messaging service by the updated first alarm coefficient 1.1 to obtain a new historical comprehensive service traffic 22G.
  • the updated historical comprehensive service traffic is less than the first threshold, it is determined whether the updated first alarm coefficient 1.1 is less than the maximum alarm coefficient 1.5.
  • the updated historical comprehensive service traffic is less than the first threshold, and the first alarm coefficient 1.1 is less than the maximum alarm coefficient 1.5, continue to update the first alarm coefficient until the historical comprehensive service traffic is greater than or equal to the first threshold. Assuming that when the first alarm coefficient is 1.3, the historical comprehensive service traffic is greater than or equal to the first threshold, then it can be determined whether the prediction accuracy of the detection chain is greater than or equal to the preset probability.
  • a detection chain as shown in Figure 6 can be generated.
  • a second detection can be added Information point.
  • the second detection information point may be a service type with second priority, such as streaming media service.
  • the first detection information point in the detection chain that is, the alarm coefficient of the instant messaging service is 1.5
  • the second detection information point in the detection chain that is, the alarm coefficient of the streaming media service
  • the initial value such as 1.0, such as As shown in Figure 7.
  • the updated historical comprehensive service traffic can be determined based on the alarm coefficient of the instant messaging service, the traffic of the instant messaging service, the alarm coefficient of the streaming media service and the flow of the streaming media service.
  • the alarm coefficient of the streaming media service can be updated.
  • the method of updating the alarm coefficient of the streaming media service can be implemented by referring to the method of updating the alarm coefficient of the instant messaging service, which will not be described again here.
  • a third detection can be added information points, and so on, until the historical comprehensive service traffic is greater than or equal to the first threshold or the prediction accuracy of the detection chain is greater than or equal to the preset probability.
  • the detection chain shown in Figure 8 can be generated.
  • the alarm coefficient of the instant messaging service is 1.5
  • the alarm coefficient of the streaming media service is 1.5
  • the alarm coefficient of the P2P service is 1.1.
  • all detection chains whose prediction accuracy reaches a preset probability are calculated and stored. If the user needs it, the alarm coefficient can be selected according to the set rules.
  • Each detection chain has an accuracy rate. Therefore, the detection chain can be selected based on accuracy as a set rule.
  • the length of each detection chain is not consistent, including the first detection information point to the nth detection information point. The shorter the detection chain selected by the user, the higher the efficiency of detecting abnormal traffic, but the prediction accuracy will decrease accordingly. The longer the detection chain selected by the user, the efficiency of detecting abnormal traffic will decrease accordingly, but the prediction accuracy will increase accordingly. Therefore, the detection chain can be selected based on the length of the detection chain as a set rule.
  • the nth service type and the alarm coefficient of the nth service type in different detection chains may be the same or different. Therefore, the detection chain can be selected based on the alarm coefficient of the nth service type as a set rule. It should be noted that in the detection chain, the closer the alarm coefficient is to 1, the closer it is to the true value of the traffic of this service type, and the higher the detection accuracy.
  • the first principle is to achieve a prediction rate of 99%
  • the second principle is to keep the prediction chain as short as possible
  • the third principle is to keep each alarm judgment coefficient as close to 1 as possible.
  • detection chain 1 is excluded.
  • detection chain 3 among detection chain 2, detection chain 3, and detection chain 4, detection chain 4 is excluded.
  • the third principle because in detection chain 2 and detection chain 3, the alarm coefficients of the instant messaging service and the streaming media service are both 1.5.
  • the alarm coefficient 1.3 of the traditional data service in detection chain 2 is smaller than the alarm coefficient 1.4 of the traditional data service in detection chain 3, which is closer to 1. So, select detection chain 2.
  • 1.5 is determined as the alarm coefficient for the instant messaging service
  • 1.5 is determined as the alarm coefficient for the streaming media service
  • 1.3 is determined as the alarm coefficient for the traditional data service.
  • the embodiment of the present application determines the alarm coefficient based on the detection chain method, which is simpler to implement and more convenient than other methods. Update the alarm coefficient through historical alarm information to improve the detection accuracy of alarm traffic and the detection efficiency of abnormal traffic.
  • this embodiment of the present application provides an overall flow chart for detecting abnormal traffic.
  • Step S1001 Identify N service types of each service flow; N is an integer greater than or equal to 1;
  • Step S1002 Determine the priority information of N business types based on the prediction accuracy of the nth business type
  • Step S1003 Determine the historical comprehensive service traffic based on the k-th detection information point and the first alarm coefficient of the k-th detection information point; the k-th detection information point is the first detection information point determined in order from high to low priority in the detection chain. n business types;
  • Step 1004 When the historical comprehensive service traffic is greater than the first threshold, determine the prediction accuracy of the k-th detection information point in the historical alarm information;
  • Step 1005 When the prediction accuracy is greater than or equal to the preset probability, determine the first alarm coefficient as the alarm coefficient of the k-th detection information point; k is an integer greater than or equal to 0;
  • Step 1006 Determine the comprehensive service flow according to the alarm coefficient of the nth service type and the service flow of the nth service type; n is an integer greater than or equal to 1 and less than N;
  • Step S1007 When the comprehensive service traffic is greater than or equal to the second threshold, generate alarm information
  • Step S1008 When the alarm information reaches the preset value, send an alarm to the user;
  • Step S1009 Receive the abnormal traffic protection instruction sent by the user
  • Step S1010 Send the abnormal traffic protection instruction to the protection device to execute the operation of the abnormal traffic protection instruction.
  • the embodiment of the present application provides an abnormal traffic detection device, as shown in Figure 11.
  • the device includes: an identification module 1101, a processing module 1102, and a generation module 1103, wherein:
  • the identification module 1101 is used to identify N service types of each service flow; the N is an integer greater than or equal to 1;
  • the processing module 1102 is configured to determine the comprehensive service flow according to the alarm coefficient of the nth service type and the service flow of the nth service type; the n is an integer greater than or equal to 1 and less than N;
  • the alarm coefficient of the nth business type is determined based on the prediction accuracy of the nth business type in historical alarm information; the historical alarm information is obtained within one or more preset periods, so The prediction accuracy rate is the ratio of the number of times that historical comprehensive service traffic is greater than or equal to the first threshold and the number of one or more preset periods, and the historical comprehensive service traffic is based on the alarm coefficient of the nth business type Determined by the historical service traffic of the nth service type in the historical alarm information within the preset period;
  • Generating module 1103, configured to generate alarm information when the comprehensive service traffic is greater than or equal to the second threshold.
  • processing module 1102 is also used to:
  • processing module 1102 is also used to:
  • a detection chain is generated in order of the priority information from high to low; the detection chain includes the nth service type and the alarm coefficient of the nth service type.
  • processing module 1102 is also used to:
  • the kth detection information point is the priority in the detection chain from high to low
  • the nth business type determined by the sequence; k is an integer greater than or equal to 0;
  • the prediction accuracy is the kth detection information point in the historical alarm information prediction accuracy
  • the first warning coefficient is determined as the warning coefficient of the k-th detection information point.
  • processing module 1102 is also used to:
  • the updated historical comprehensive service traffic is determined.
  • processing module 1102 is also used to:
  • the updated first alarm coefficient reaches the maximum value and the historical comprehensive service traffic is less than the first threshold, or the prediction accuracy is less than the preset probability
  • the k+1th detection information point and the second alarm coefficient of the k+1th detection information point determine the updated historical comprehensive service traffic;
  • the k+1th detection The information point is the n+1th service type determined in order from high to low priority in the detection chain;
  • an updated second alarm coefficient is determined according to the second alarm coefficient and the preset step size.
  • processing module 1102 is also used to:
  • an updated prediction accuracy rate is determined;
  • the updated prediction accuracy rate is the kth detection information point and the k+th detection information point The prediction accuracy rate of one detection information point in the historical alarm information;
  • the maximum value of the warning coefficient is determined to be the warning coefficient of the k-th detection information point, and the updated second warning coefficient is determined to be the warning coefficient of the kth detection information point.
  • processing module 1102 is also used to:
  • the updated second warning coefficient is determined according to the second warning coefficient and the preset step size.
  • the electronic device 120 is embodied in the form of a general electronic device.
  • the components of the electronic device 120 may include, but are not limited to: the above-mentioned at least one processor 121, the above-mentioned at least one memory 122, and a bus 123 connecting different system components (including the memory 122 and the processor 121).
  • Bus 123 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus structures.
  • Memory 122 may include readable media in the form of volatile memory, such as random access memory (RAM) 1221 and/or cache memory 1222 , and may further include read only memory (ROM) 1223 .
  • RAM random access memory
  • ROM read only memory
  • Memory 122 may also include a program/utility 1225 having a set of (at least one) program modules 1224 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, which Each of the examples, or some combination thereof, may include the implementation of a network environment.
  • program/utility 1225 having a set of (at least one) program modules 1224 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, which Each of the examples, or some combination thereof, may include the implementation of a network environment.
  • Electronic device 120 may also communicate with one or more external devices 124 (e.g., keyboard, pointing device, etc.), may also communicate with one or more devices that enable a user to interact with electronic device 120, and/or with one or more devices that enable the electronic device 120 to 120 Any device (eg, router, modem, etc.) capable of communicating with one or more other electronic devices. This communication may occur through input/output (I/O) interface 125.
  • the electronic device 120 may also communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through the network adapter 126 . As shown, network adapter 126 communicates with other modules for electronic device 120 via bus 123 .
  • network adapter 126 communicates with other modules for electronic device 120 via bus 123 .
  • a computer-readable storage medium including instructions such as a memory 122 including instructions, is also provided, and the instructions can be executed by the processor 121 to complete the above abnormal traffic detection method.
  • the storage medium may be a non-transitory computer-readable storage medium.
  • the non-transitory computer-readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc. .
  • a computer program product including a computer program, which when executed by the processor 121 implements any of the abnormal traffic detection methods provided by this application.
  • various aspects of an abnormal traffic detection method provided by this application can also be implemented in the form of a program product, which includes program code.
  • the program product is run on a computer device, the program code is used to The computer device is caused to execute the steps in the abnormal traffic detection method according to various exemplary embodiments of the present application described above in this specification.
  • the Program Product may take the form of one or more readable media in any combination.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may include, for example, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: electrical connection with one or more conductors, portable disk, hard disk, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • the program product for the abnormal flow detection method can adopt a portable compact disk read-only memory (CD-ROM) and include the program code, and can be run on an electronic device.
  • CD-ROM portable compact disk read-only memory
  • the program product of the present application is not limited thereto.
  • a readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus or device.
  • the readable signal medium may include a data signal propagated in baseband or as part of a carrier wave carrying readable program code therein. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above.
  • a readable signal medium may also be any readable medium other than a readable storage medium that can send, propagate, or transport the program for use by or in connection with an instruction execution system, apparatus, or device.
  • Program code embodied on a readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical cable, RF, etc., or any suitable combination of the foregoing.
  • the program code for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages, such as Java, C++, etc., and also includes conventional procedural programming. language, such as "C" or a similar programming language.
  • the program code may execute entirely on the user's electronic device, partly on the user's electronic device, as a stand-alone software package, partly on the user's electronic device and partly on a remote electronic device, or entirely on the remote electronic device or service Executed on the terminal.
  • the remote electronic devices may be connected to the user electronic device through any kind of network, such as a local area network (LAN) or a wide area network (WAN), or may be connected to an external electronic device, such as provided by an Internet service. Business comes via Internet connection.
  • LAN local area network
  • WAN wide area network
  • embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable image scaling device to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means, the instructions
  • the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable image scaling device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Environmental & Geological Engineering (AREA)
  • Data Mining & Analysis (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种异常流量检测方法、装置、电子设备及存储介质，属于通信技术领域。该方法包括：识别各个业务流量的N个业务类型；N为大于或等于1的整数；根据第n 个业务类型的告警系数以及第n 个业务类型的业务流量，确定综合业务流量；n为大于或等于1，且小于N的整数；在综合业务流量大于或等于第二阈值的情况下，生成告警信息。上述方案能够在异常流量检测过程中，精准识别用户输入的业务流量的业务类型；根据业务类型的告警系数及时检测异常流量，对业务流量形成有力防护，提高异常流量检测效率。

Description

一种异常流量检测方法、装置、电子设备及存储介质
相关申请的交叉引用
本申请要求在2022年08月23日提交中国专利局、申请号为202211011554.2、申请名称为“一种异常流量检测方法、装置、电子设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种异常流量检测方法、装置、电子设备及存储介质。
背景技术
异常网络流量是由各种网络攻击引起，它可以影响网络的性能。因此，随着网络流量趋于海量、复杂化，检测和分析网络流量已经成为网络安全领域重要的挑战和研究。随着信息化不断发展，基本所有企业都需要通过网站、应用程序等对外提供服务、宣传产品、树立品牌。为了提供稳定优质服务，企业的信息化设施必须做好有关于异常流量识别和防护，保证数据安全和系统可用性。
如何检测异常流量成为亟待解决的问题。
发明内容
本申请实施例提供一种异常流量检测方法、装置、电子设备及存储介质，用于识别用户业务流量的业务类型，检测异常流量。
第一方面，本申请实施例提供一种异常流量检测方法，包括：
识别各个业务流量的N个业务类型；所述N为大于或等于1的整数；
根据第n个业务类型的告警系数以及所述第n个业务类型的业务流量，确定综合业务流量；所述n为大于或等于1，且小于N的整数；
其中，所述第n个业务类型的告警系数根据所述第n个业务类型在历史告警信息中的预测准确率确定；所述历史告警信息是在一个或多个预设周期内获得的，所述预测准确率为历史综合业务流量大于或等于第一阈值的次数与所述一个或多个预设周期的数量的比值，所述历史综合业务流量是根据所述第n个业务类型的告警系数和一个所述预设周期内所述历史告警信息中所述第n个业务类型的历史业务流量确定的；
在所述综合业务流量大于或等于第二阈值的情况下，生成告警信息。
上述方法，在异常流量检测过程中，精准识别用户输入的业务流量的业务类型，及时检测异常流量，对业务流量形成有力防护，提高异常流量检测效率。
可选的，所述方法还包括：
在所述告警信息达到预设值的情况下，向用户发送告警；
接收用户发送的异常流量防护指令；
将所述异常流量防护指令下发给防护设备执行所述异常流量防护指令对应的操作。
上述方法通过向用户发送告警，接收用户发送的异常流量防护指令，使告警信息能够得到及时处理，防护设备及时执行防护操作，提高防护效率。
可选的，所述方法还包括：
根据第n个业务类型的预测准确率，确定所述N个业务类型的优先级信息；
按照所述优先级信息从高到低的顺序，生成检测链；所述检测链包括第n个业务类型以及所述第n个业务类型的告警系数。
上述方法通过确定n个业务类型的优先级信息，生成检测链，确定业务类型的告警系数。使不同业务类型的告警系数在检测链中进行更新。
可选的，所述按照所述优先级信息从高到低的顺序，生成检测链，包括：
根据第k个检测信息点以及所述第k个检测信息点的第一告警系数，确定所述历史综合业务流量；所述第k个检测信息点是所述检测链中优先级从 高到低的顺序确定的第n个业务类型；k为大于或等于0的整数；
在所述历史综合业务流量小于第一阈值的情况下，根据所述第一告警系数和预设的步长确定更新的第一告警系数；
在所述历史综合业务流量大于或等于所述第一阈值的情况下，确定所述检测链的预测准确率；所述预测准确率是所述第k个检测信息点在所述历史告警信息中的预测准确率；
在所述预测准确率大于或等于预设概率的情况下，确定所述第一告警系数作为所述第k个检测信息点的告警系数。
上述方法通过将历史综合业务流量与第一阈值进行比较，确定第一告警系数为第k个检测信息点的告警系数，将第k个检测信息点的告警系数进行更新。
可选的，所述方法还包括：
在所述检测链的预测准确率小于预设概率的情况下，根据所述第一告警系数和所述预设的步长确定更新的第一告警系数；
根据所述第k个检测信息点以及所述更新的第一告警系数，确定更新的历史综合业务流量。
上述方法通过更新第一告警系数，确定更新的历史综合业务流量。进一步确定上述告警系数能否作为第k个检测信息点的告警系数。
可选的，所述方法还包括：
在所述更新的第一告警系数达到最大值，且所述历史综合业务流量小于所述第一阈值，或，所述预测准确率小于所述预设概率的情况下，根据第k个检测信息点以及所述告警系数最大值，第k+1个检测信息点以及所述第k+1个检测信息点的第二告警系数，确定更新的历史综合业务流量；所述第k+1个检测信息点是所述检测链中优先级从高到低的顺序确定的第n+1个业务类型；
在所述更新的历史综合业务流量小于所述第一阈值的情况下，根据所述第二告警系数和所述预设的步长确定更新的第二告警系数。
上述方法通过更新第k+1个检测信息点的第二告警系数，确定更新的历史综合业务流量。进一步确定上述第一告警系数能否作为第k个检测信息点的告警系数。上述第二告警系数能否作为第k个检测信息点的告警系数。
可选的，所述方法还包括：
在所述更新的历史综合业务流量大于或等于所述第一阈值的情况下，确定更新的预测准确率；所述更新的预测准确率是所述第k个检测信息点和所述第k+1个检测信息点在所述历史告警信息中的预测准确率；
在所述更新的预测准确率大于或等于预设概率的情况下，确定所述告警系数最大值为所述第k个检测信息点的告警系数，确定所述更新的第二告警系数为所述第k+1个检测信息点的告警系数。
上述方法通过确定预测准确率，在预测准确率大于或等于预设概率的情况下，确定告警系数最大值为第k个检测信息点的告警系数，确定更新的第二告警系数为第k+1个检测信息点的告警系数。
可选的，所述方法还包括：
在所述更新的预测准确率小于预设概率的情况下，根据所述第二告警系数和所述预设的步长确定更新的第二告警系数。
上述方法通过第二告警系数和预设的步长确定更新的第二告警系数。进一步确定上述第一告警系数能否作为第k个检测信息点的告警系数。上述第二告警系数能否作为第k个检测信息点的告警系数。
第二方面，本申请实施例提供一种异常流量检测装置，包括：
识别模块，用于识别各个业务流量的N个业务类型；所述N为大于或等于1的整数；
处理模块，用于根据第n个业务类型的告警系数以及所述第n个业务类型的业务流量，确定综合业务流量；所述n为大于或等于1，且小于N的整数；
其中，所述第n个业务类型的告警系数根据所述第n个业务类型在历史告警信息中的预测准确率确定；所述历史告警信息是在一个或多个预设周期 内获得的，所述预测准确率为历史综合业务流量大于或等于第一阈值的次数与所述一个或多个预设周期的数量的比值，所述历史综合业务流量是根据所述第n个业务类型的告警系数和一个所述预设周期内所述历史告警信息中所述第n个业务类型的历史业务流量确定的；
生成模块，用于在所述综合业务流量大于或等于第二阈值的情况下，生成告警信息。
第三方面，本申请实施例还提供了一种电子设备，包括存储器，处理器及存储在存储器上并可在处理器运行的计算机程序，当计算机程序被处理器执行时，使得处理器实现上述第一方面中的任一种异常流量检测方法。
第四方面，本申请实施例还提供了一种计算机可读存储介质，所述计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时，实现第一方面的异常流量检测方法。
第五方面，本申请实施例还提供了一种计算机程序产品，包括计算机程序，所述计算机程序被处理器执行以实现如上述第一方面中任一项的异常流量检测方法。
第二方面至第五方面中任意一种实现方式所带来的技术效果可参见第一方面中对应的实现方式所带来的技术效果，此处不再赘述。
附图说明
图1为本申请实施例提供的一种异常流量检测方法的应用场景示意图；
图2为本申请实施例提供的一种异常流量检测方法流程图；
图3为本申请实施例提供的一种告警短信提示界面示意图；
图4为本申请实施例提供的一种确定检测链流程图；
图5为本申请实施例提供的一种检测链示意图；
图6为本申请实施例提供的另一种检测链示意图；
图7为本申请实施例提供的另一种检测链示意图；
图8为本申请实施例提供的另一种检测链示意图；
图9为本申请实施例提供的另一种检测链示意图；
图10为本申请实施例提供的一种检测异常流量的整体流程图；
图11为本申请实施例提供的一种异常流量检测的装置示意图；
图12为本申请实施例提供的电子设备的结构示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本申请保护的范围。
本申请实施例描述的应用场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着新应用场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。其中，在本申请的描述中，除非另有说明，“多个”的含义是两个或两个以上。
为了提供稳定优质服务，企业的信息化设施必须做好有关于异常流量识别和防护，保证数据安全和系统可用性。但是，现有技术中有关于异常流量的防护方法大多具有一定程度的延时，并且无法根据用户的输入业务流量特征进行定制识别。因此，如何对用户识别输入业务流量类型、对输入业务流量进行精细化管理、及时检测异常流量就显得很有必要。
为了解决上述问题，本申请实施例提供一种异常流量检测方法、装置、电子设备及存储介质。例如，识别各个业务流量的N个业务类型。其中，N为大于或等于1的整数。根据第n个业务类型的告警系数以及第n个业务类型的业务流量，确定综合业务流量。其中，n为大于或等于1，且小于N的整数。第n个业务类型的告警系数根据第n个业务类型在历史告警信息中的预测准确率确定。历史告警信息是在一个或多个预设周期内获得的。预测准确 率为历史综合业务流量大于或等于第一阈值的次数与一个或多个预设周期的数量的比值。历史综合业务流量是根据第n个业务类型的告警系数和一个预设周期内历史告警信息中第n个业务类型的历史业务流量确定的。在综合业务流量大于或等于第二阈值的情况下，生成告警信息。这样，可以精准识别用户输入的业务流量的业务类型，及时检测异常流量，对业务流量形成有力防护。为用户提供更好的网络服务，提高用户的使用体验。
如图1所示，本申请实施例一种可选的异常流量检测方法的应用场景示意图，包括服务端100以及终端101，服务端100与终端101之间可以通过网络实现可通信的连接，以实现本申请的异常流量检测方法。
用户可以使用服务端100通过网络与终端101交互，例如接收或发送消息等。终端101上可以安装有各种客户端应用程序，例如程序编写类应用、网页浏览器应用、搜索类应用等。终端101可以是具有显示屏并且支持网页浏览的各种电子设备，包括但不限于智能手机、平板电脑、台式计算机等等。
服务端100用于识别各个业务流量的N个业务类型。N为大于或等于1的整数。根据第n个业务类型的告警系数以及第n个业务类型的业务流量，确定综合业务流量。其中，n为大于或等于1，且小于N的整数。第n个业务类型的告警系数根据第n个业务类型在历史告警信息中的预测准确率确定。历史告警信息是在一个或多个预设周期内获得的。预测准确率为历史综合业务流量大于或等于第一阈值的次数与一个或多个预设周期的数量的比值。历史综合业务流量是根据第n个业务类型的告警系数和一个预设周期内历史告警信息中第n个业务类型的历史业务流量确定的。在综合业务流量大于或等于第二阈值的情况下，生成告警信息。其中，服务端100可以为独立的服务器或者是多个服务器组成的服务器集群来实现。
如图2所示，本申请实施例提供的一种异常流量检测方法流程图，具体可以包括以下步骤：
步骤S201、识别各个业务流量的N个业务类型；N为大于或等于1的整数；
步骤S202、根据第n个业务类型的告警系数以及第n个业务类型的业务流量，确定综合业务流量；n为大于或等于1，且小于N的整数；
步骤S203、在综合业务流量大于或等于第二阈值的情况下，生成告警信息。
一种可选的实施方式中，在用户通过终端的操作界面启动客户端，输入业务流量。例如，用户可以单击客户端的视频链接收看该视频。
在步骤S201中，用户输入业务流量之后，服务端根据输入业务流量的数据包识别输入业务流量的N个业务类型，检测用户输入业务流量是否为异常流量。其中，N为大于或等于1的整数。
一种可选的实施方式，当收到用户输入业务流量之后，使用深度包检测(Deep Pacnet Inspection，DPI)对用户输入业务流量进行识别。
在一种可选的实施方式中，将DPI设备部署到关键网络节点即流量入口处，可以大大减少服务端的资源消耗。在用户输入业务流量时，通过DPI及时检测异常流量，针对不同网络的应用层载荷(如域名系统(Domain Name System，DNS)、超文本传输协议(Hyper Text Transfer Protocol，HTTP)等)进行深度检测。识别用户输入业务流量，对业务流量的业务类型进行精细化管理。通过对用户业务类型进行判定，进一步精准识别用户业务流量及不同类型用户业务流量流向趋势。基于DPI的统计分析，可指导控制面对硬件设备的配置进行优化调整。从而为用户提供更好的网络服务，提高用户的使用体验。
在一种可选的实施方式中，DPI设备根据如表1所示的主流互联网业务分类表，将用户输入业务流量的数据包识别到表1中的业务类型中。通过识别输入业务流量的各个业务类型，提高控制输入业务流量的精细化程度。
例如，输入业务流量的协议类型是文件传输，则该业务流量的业务类型是传统数据业务。输入业务流量的协议类型是文本消息，则该业务流量的业务类型是即时通信业务。
Figure PCTCN2022136983-appb-000001
表1
在将用户输入业务流量识别到表1中业务类型的某一类之前，根据DPI中包含的端口识别规则、关键字识别规则、五元组匹配规则对业务流量数据包的协议类型进行匹配识别。
下面分别根据端口识别规则、关键字识别规则、五元组匹配规则介绍如何对输入业务流量的协议类型进行具体的识别。
在一种可选的实施方式中，端口识别是根据业务常用端口对业务流量数据包端口进行逐包匹配。根据表2，常用端口业务表进行匹配。
例如，端口号是传输控制协议(Transmission Control Protocol，TCP)20，则该业务流量的协议类型是文件传输协议。端口号是TCP23，则该业务流量的协议类型是远程连接命令。
Figure PCTCN2022136983-appb-000002
Figure PCTCN2022136983-appb-000003
表2
在一种可选的实施方式中，关键字识别是根据知识库中的关键字，将含有关键字的数据用户输入的业务流量数据包逐包匹配。根据表3，常用业务关键字表进行匹配。
例如，用户输入的业务流量的数据包中包括TCP内容开头的“收到(GET)”，则该业务流量的协议类型为超文本传输协议(Hyper Text Transfer Protocol，HTTP)。用户输入的业务流量的数据包中包括MAC帧开头的13和 14个字节为0x0800，IP首部中协议字段为0x02，则该业务流量的协议类型为互联网控制报文协议(Internet Control Message Protocol，ICMP)。
Figure PCTCN2022136983-appb-000004
表3
五元组识别，即网际互连协议(Internet Protocol，IP)五元组识别，包括源地址、目的地址、协议类型、源端号、目的端口号。根据已识别的五元组和业务类型对应的五元组哈希表。对于用户输入的业务流量数据包逐包提取数据流的五元组，采用预设的哈希算法根据IP报文的五元组信息来计算哈希值，利用哈希值搜索哈希表中数据，从而匹配上述业务流量的业务类型。
需要说明的是，上述端口识别、关键字识别、五元组匹配的方式没有固定的先后识别顺序，任意一种方式匹配业务流量数据包都是可行的。在上述任意一种方式匹配业务流量数据包成功之后，其他的匹配方式不需要再次对业务流量数据包进行匹配。在识别业务流量之后，根据不同的业务类型存储各个业务类型对应的数据信息。其中，数据信息包括流量数据等信息。
在一种可选的实施方式中，根据预设周期识别用户输入的业务流量的业 务类型。
例如，将预设周期设定为5分钟，则在本次预设周期对应的时间点到达后，识别上个预设周期对应的时间点与本次预设周期对应的时间点之间所有输入的业务流量的N个业务类型。
在另一种可选的实施方式中，当用户输入业务流量时，根据输入业务流量的数据包实时识别该业务流量的业务类型。
在步骤S202中，第n个业务类型的告警系数根据第n个业务类型在历史告警信息中的预测准确率确定。历史告警信息是在一个或多个预设周期内获得的。预测准确率为历史综合业务流量大于或等于第一阈值的次数与一个或多个预设周期的数量的比值。历史综合业务流量是根据第n个业务类型的告警系数和一个预设周期内历史告警信息中第n个业务类型的历史业务流量确定的。其中，n为大于或等于1，且小于N的整数。可选的，n取遍1至N的整数。
举例来说，根据第1个业务类型的告警系数以及该第1个业务类型的业务流量的乘积；第2个业务类型的告警系数以及该第2个业务类型的业务流量的乘积，以此类推，根据N个业务类型的告警系数以及该N个业务类型的业务流量的乘积的和，计算综合业务流量。
例如，第1个业务类型的告警系数为1.5。第1个业务类型的业务流量为20吉字节(Gigabyte，G)。第2个业务类型的告警系数为1.1。第2个业务类型的业务流量为15G。则综合业务流量为1.5×20+1.1×15＝46.5G。
可以理解的是，业务类型的告警系数可以是实数，如0、1、1.5、2等。告警系数是根据历史告警数据更新产生的，在后续进行介绍。
在步骤S203中，在一种可选的实施方式中，在综合业务流量大于或等于第二阈值的情况下，生成告警信息。其中，综合业务流量大于或等于第二阈值表示检测到异常流量，此时需要生成告警信息。其中，告警信息包括用户输入的业务流量的地址信息、报文长度、统一资源标识符(Uniform Resource Identifier，URI)信息、流量数据等信息。
本申请实施例的第二阈值是根据预设周期内用户的输入的总业务流量模型确定的总业务流量的最大值，结合防止业务流量抖动的误判容忍度确定的。第二阈值表示在该预设周期内输入的业务流量在正常范围的最大值。第二阈值也可以为本领域技术人员预先设置的经验数值，并且该第二阈值可以根据具体的应用场景进行合理设置。
在一种可选的实施方式中，用户结合业务类型与在线安全知识库对接，利用大数据分析引擎的方式建立本地安全知识库，将用户输入的业务流量中的网际互连协议(Internet Protocol，IP)设备、流量、流量行为等信息与本地知识库比对，确定是否存在告警信息。上述本地安全知识库可以根据用户需求进行更新。
在一种可选的实施方式中，在告警信息达到预设值的情况下，向用户发送告警。接收用户发送的异常流量防护指令，将异常流量防护指令下发给防护设备，执行异常流量防护指令对应的操作。
在检测周期内，告警信息达到预设值，则向用户发送告警短信。用户在收到告警短信之后，回复表示特定防护指令的短信。在接收到用户发送的表示特定防护指令的短信之后，根据异常流量防护指令，将该异常流量防护指令下发给防护设备，执行异常流量防护指令对应的操作。
需要说明的是，检测周期内包括一个或多个预设周期。本申请实施例的检测周期、预设周期、预设值可以为本领域技术人员预先设置的经验数值，并且该检测周期、预设周期、预设值可以根据具体的应用场景进行合理设置。
本申请实施例在检测到告警信息超过预设值时，根据用户指令，进行自动防护，可以提高防护效率。同时只有在必要的异常流量防护操作时，调用厂商防护能力，大幅降低防护成本。
例如，预设周期是5分钟，则每5分钟，对用户输入的业务流量进行检测。检测周期是1小时。预设值为5。在1小时内，告警信息超过预设值5条，则向用户发送告警短信。如图3所示，告警短信中说明在检测周期内异常流量已经超过预设值。并且说明特定数字符号对应的防护指令。回复1表示进 行流量清洗。回复2表示进行防火墙加固。用户发送1，则接收用户发送的异常流量防护指令。将该异常流量防护指令下发给防护设备，执行该异常流量防护指令对应的操作。
需要说明的是，本申请实施例中第n个业务类型的告警系数是根据历史告警信息进行更新的。用户也可以根据具体的应用场景对该告警系数进行合理设置。
下面介绍第n个业务类型的告警系数如何进行更新：
以下，通过图4介绍本申请实施例中，检测链的生成方法。
参阅图4，为本申请实施例中检测链的生成方法的示例性流程图，可以包括以下操作：
步骤S401、根据告警系数最大值和历史告警信息内一个预设周期中N个业务类型的历史业务流量，确定历史综合业务流量；
步骤S402、根据历史综合业务流量大于或等于第一阈值的次数与历史告警信息内所有预设周期的数量的比值确定第n个业务类型的预测准确率；
步骤S403、根据第n个业务类型的预测准确率，确定N个业务类型的优先级信息；
步骤S404、根据第k个检测信息点以及第k个检测信息点的第一告警系数，确定历史综合业务流量；第k个检测信息点是检测链中优先级从高到低的顺序确定的第n个业务类型；k为大于或等于0的整数；
步骤S405、判断历史综合业务流量是否小于第一阈值；若是，则执行步骤S406；若否，则执行步骤S410；
步骤S406、判断第一告警系数是否小于告警系数最大值，若是，则执行步骤S408；若否，则执行步骤S407；
步骤S407、根据第k个检测信息点以及告警系数最大值，第k+1个检测信息点以及第k+1个检测信息点的第二告警系数，确定更新的历史综合业务流量；第k+1个检测信息点是检测链中优先级从高到低的顺序确定的第n+1个业务类型；返回执行步骤S405；
步骤S408、根据第一告警系数和预设的步长确定更新的第一告警系数；
步骤S409、根据第k个检测信息点以及更新的第一告警系数，确定更新的历史综合业务流量；返回执行步骤S405；
步骤S410、确定第k个检测信息点在历史告警信息中的预测准确率；
步骤S411、判断预测准确率是否小于预设概率；若是，返回执行步骤S406；若否，执行步骤S412；
步骤S412、确定第一告警系数作为第k个检测信息点的告警系数。
在步骤S401中，在一种可选的实施方式中，将告警系数最大值和历史告警信息内一个预设周期中第n个业务类型的历史业务流量，确定第n个业务类型的历史综合业务流量。根据告警系数最大值和历史告警信息内一个预设周期中N个业务类型的历史业务流量，确定一个预设周期中N个业务类型的历史综合业务流量。
需要说明的是，告警系数最大值可以为本领域技术人员预先设置的经验数值，并且该告警系数最大值可以根据具体的应用场景进行合理设置，如1.4、1.5或者2等。
可以理解的是，因为第n个业务类型在不同的预设周期内的历史业务流量不一定相同，所以不同的业务类型在不同的预设周期内的历史综合业务流量也不一定相同。在不同的预设周期内的第一阈值可以是相同的，也可以是不同的。
例如，在某一个预设周期内，即时通信业务的历史业务流量是20G。告警系数最大值为1.5。将即时通信业务的历史业务流量20G乘告警系数最大值1.5得到历史综合业务流量30G。
本申请实施例的第一阈值是根据预设周期内用户的输入的总业务流量模型确定的总业务流量的最大值，结合防止业务流量抖动的误判容忍度确定的。第一阈值表示在该预设周期内输入业务流量在正常范围的最大值。第一阈值也可以为本领域技术人员预先设置的经验数值，并且该第一阈值可以根据具体的应用场景进行合理设置。
在步骤S402中，在一种可选的实施方式中，根据告警系数最大值和历史告警信息内一个预设周期中N个业务类型的历史业务流量，确定历史综合业务流量。在一个预设周期中第n个业务类型的历史综合业务流量大于或等于第一阈值的情况下，表示该业务类型检测成功一次。
在确定第n个业务类型检测成功一次之后，在获得历史告警信息的所有预设周期内，根据第n个业务类型在各个预设周期内的历史业务流量和告警系数最大值，计算在各个预设周期内的历史综合业务流量，并与各个预设周期内的第一阈值做比较。记录历史综合业务流量大于或等于第一阈值的次数。将历史综合业务流量大于或等于第一阈值的次数与预设周期的比值作为第n个业务类型的预测准确率。
在计算第n个业务类型的预测准确率之后，计算第n+1个业务类型的预测准确率的方式可以参照计算第n个业务类型的预测准确率的方式实施，此处不再赘述。
在计算第n个业务类型的历史综合业务流量时，使用告警系数最大值能够增大第n个业务类型在历史告警信息中历史综合业务流量大于或等于第一阈值的次数，增加上述第n个业务类型的预测准确率。
在步骤S403中，在一种可选的实施方式中，在确定N个业务类型的预测准确率之后，根据第n个业务类型的预测准确率，确定N个业务类型的优先级信息。
根据第n个业务类型的预测准确率的从大到小的顺序，确定第n个业务类型的预测准确率在N个业务类型中的优先级信息。
例如，如表4所示，分别表示不同的业务类型、预测成功次数以及预测准确率。则按照预测准确率的大小关系确定优先级信息从高到低的顺序。优先级信息从高到低的顺序为：即时通信业务、流媒体业务、传统数据业务、P2P业务。
业务类型 成功次数 预测准确率
流媒体业务 1200 60％
传统数据业务 1200 60％
即时通信业务 1800 90％
P2P业务 550 27.5％
表4
需要说明的是，在出现两种业务类型的预测准确率相同的情况时，可以根据本领域技术人员预先设置的业务类型优先级顺序对预测准确率相同的两个业务类型进行排序，并且该预先设置的业务类型优先级顺序可以根据具体的应用场景进行合理设置。
在步骤S404中，按照优先级信息从高到低的顺序，生成检测链。其中，检测链包括第n个业务类型以及第n个业务类型的告警系数。在一种可选的实施方式中，将第k个检测信息点的历史业务流量，与第k个检测信息点的第一告警系数相乘，确定历史综合业务流量。其中，第k个检测信息点是检测链中优先级从高到低的顺序确定的第k个业务类型。k为大于或等于0的整数。
需要说明的是，第一告警系数可以为本领域技术人员预先设置的经验数值，并且该第一告警系数可以根据具体的应用场景进行合理设置，如0、1或者2等。
例如，在某一预设周期内，在检测链中，根据优先级从高到低的顺序确定的第一个业务类型为即时通信业务，则第一个检测信息点为即时通信业务。第一告警系数为1.0。即时通信业务的历史业务流量为20G，则将即时通信业务的历史业务流量为20G乘第一告警系数1.0得到历史综合业务流量。
在步骤S405中，在一种可选的实施方式中，判断历史综合业务流量是否小于第一阈值。如果历史综合业务流量小于第一阈值，则执行步骤S406，判断第一告警系数是否小于告警系数最大值。如果历史综合业务流量不小于第一阈值，则执行步骤S410，确定第k个检测信息点在历史告警信息中的预测 准确率。
在步骤S406中，在一种可选的实施方式中，判断第一告警系数是否小于告警系数最大值。如果第一告警系数小于告警系数最大值，则执行步骤S408，根据第一告警系数和预设的步长确定更新的第一告警系数。
如果第一告警系数不小于告警系数最大值，则执行步骤S407，根据第k个检测信息点以及告警系数最大值，第k+1个检测信息点以及第k+1个检测信息点的第二告警系数，确定更新的历史综合业务流量。其中，第k+1个检测信息点是检测链中优先级从高到低的顺序确定的第n+1个业务类型。
在步骤S407中，在一种可选的实施方式中，将第k个检测信息点的历史业务流量，与第k个检测信息点的告警系数最大值相乘。第k+1个检测信息点的历史业务流量，与第k+1个检测信息点的第二告警系数相乘。将上述两个乘积相加，确定更新的历史综合业务流量。其中，第k+1个检测信息点是在检测链中优先级从高到低的顺序确定的第n+1个业务类型。
需要说明的是，第二告警系数可以为本领域技术人员预先设置的经验数值，并且该第二告警系数可以根据具体的应用场景进行合理设置，如0、1或者2等。
在上述更新的历史综合业务流量大于或等于第一阈值的情况下，确定更新的预测准确率。根据第k个检测信息点以及第k个检测信息点的告警系数最大值，第k+1个检测信息点以及第k+1个检测信息点的第二告警系数，确定在历史告警信息中的其他预设周期内历史综合业务流量大于或等于第一阈值的次数。
根据历史综合业务流量大于或等于第一阈值的次数与历史告警信息中预设周期的数量的比值，确定第k个检测信息点和第k+1个检测信息点在历史告警信息中的更新的预测准确率。
在一种可选的实施方式中，在更新的预测准确率大于或等于预设概率的情况下，确定告警系数最大值为第k个检测信息点的告警系数。确定更新的第二告警系数为第k+1个检测信息点的告警系数。
在一种可选的实施方式中，在更新的预测准确率小于预设概率的情况下，判断第二告警系数是否小于告警系数最大值。
在第二告警系数小于告警系数最大值的情况下，根据第二告警系数和预设的步长确定更新的第二告警系数。根据第k个检测信息点以及告警系数最大值，第k+1个检测信息点以及第k+1个检测信息点的更新的第二告警系数确定更新的历史综合业务流量。
在第二告警系数不小于告警系数最大值的情况下，根据第k个检测信息点以及告警系数最大值，第k+1个检测信息点以及第k+1个检测信息点的告警系数最大值，第k+2个检测信息点以及第k+2个检测信息点的告警系数最大值确定更新的历史综合业务流量。其中，第k+2个检测信息点是在检测链中优先级从高到低的顺序确定的第n+2个业务类型。
在步骤S408中，在一种可选的实施方式中，在历史综合业务流量小于第一阈值，且第一告警系数小于告警系数最大值的情况下，根据第一告警系数和预设的步长确定更新的第一告警系数。根据第k个检测信息点以及第k个检测信息点的更新的第一告警系数，确定更新的历史综合业务流量。
需要说明的是，预设的步长可以为本领域技术人员预先设置的经验数值，并且该预设的步长可以根据具体的应用场景进行合理设置。如果预设的步长太小，则告警系数在调整后，历史综合业务流量、预测准确率等信息变化不明显。如果预设的步长太大，则告警系数在调整后，历史综合业务流量、预测准确率等信息变化不合理。
例如，在检测链中，根据优先级从高到低的顺序确定的第一个业务类型为即时通信业务，则第一个检测信息点为即时通信业务。第一告警系数为1.0。即时通信业务的历史业务流量为20G，则将即时通信业务的历史业务流量为20G乘第一告警系数1.0得到历史综合业务流量。在上述历史综合流量小于该预设周期内的第一阈值30G且第一告警系数1.0小于告警系数最大值1.5的情况下，根据预设的步长0.1，更新告警系数初始值1.0，更新后的第一告警系数为1.1。将即时通信业务的历史业务流量为20G乘更新的第一告警系数1.1， 得到新的历史综合业务流量22G。将更新的历史综合业务流量与第一阈值再次进行比较。
在步骤S409中，根据第k个检测信息点以及更新的第一告警系数，确定更新的历史综合业务流量。再执行步骤S405，判断更新的历史综合业务流量是否小于第一阈值。
在步骤S410中，在一种可选的实施方式中，在根据第k个检测信息点以及第k个检测信息点的第一告警系数，确定的历史综合业务流量大于或等于第一阈值的情况下，确定在历史告警信息的预设周期内，历史综合业务流量大于或等于第一阈值的次数。根据历史综合业务流量大于或等于第一阈值的次数与一个或多个预设周期的数量的比值确定预测准确率。
本申请实施例的预设概率可以为本领域技术人员预先设置的经验数值，并且该预设概率可以根据具体的应用场景进行合理设置。
可以理解的是，检测链的预测准确率表示的是检测链中包含的检测信息点在历史告警信息中的预测准确率。检测链中可以包含1个或多个检测信息点。例如，1个检测信息点、2个检测信息点或者3个检测信息点等多个检测信息点。以检测链中包含2个检测信息点为例，在获得历史告警信息的某一预设周期内，计算第一个检测信息点的告警系数和第一个检测信息点的历史业务流量的乘积，以及第二个检测信息点的告警系数和第二个检测信息点的历史业务流量的乘积。将上述两个乘积作和，确定在该预设周期的历史综合业务流量。将上述历史综合业务流量与该预设周期的第一阈值做比较。该历史综合业务流量大于或等于第一阈值则代表该检测链预测成功一次。记录在获得历史告警信息的所有预设周期内，历史综合业务流量大于或等于第一阈值的次数。将历史综合业务流量大于或等于第一阈值的次数与预设周期的数量的比值作为检测链的预测准确率。
例如，假设历史告警信息是在2000个预设周期内获得的。在检测链中，根据优先级从高到低的顺序确定的第一个业务类型为即时通信业务，则第一个检测信息点为即时通信业务。在其中一个预设周期内，根据第一个检测信 息点以及第一个检测信息点的第一告警系数，确定历史综合业务流量大于第一阈值。则在剩余1999个预设周期内，根据第一个检测信息点以及第一个检测信息点的第一告警系数确定历史综合业务流量，判断上述历史综合业务流量是否大于对应预设周期内的第一阈值。计算在历史告警信息中所有大于或等于第一阈值的次数。在历史告警信息中所有大于或等于第一阈值的次数为1982次，则即时通信业务的预测准确率为1982÷2000＝99.1％。
在步骤S411中，在一种可选的实施方式中，判断第k个检测信息点在历史告警信息中的预测准确率是否小于预设概率。
在预测准确率小于预设概率的情况下，返回执行步骤S406。通过判断第一告警系数是否小于告警系数最大值，确定是否更新第一告警系数。或，根据第k个检测信息点以及告警系数最大值，第k+1个检测信息点以及第k+1个检测信息点的第二告警系数，确定更新的历史综合业务流量。
在第一告警系数小于告警系数最大值的情况下，根据第一告警系数和预设的步长确定更新的第一告警系数。根据第k个检测信息点以及更新的第一告警系数，确定更新的历史综合业务流量。再次判断上述更新的历史综合业务流量是否大于第一阈值。更新的预测准确率是否小于预设概率。
在步骤S412中，在一种可选的实施方式中，在预测准确率大于或等于预设概率的情况下，确定第一告警系数作为第k个检测信息点的告警系数。
以下对图4示出的实施方式进行说明。举例来说，历史告警信息是在2000次个预设周期内获取的。在预设周期1中，第一阈值为30G。为了确定检测链中各个业务类型的顺序，可以按照预测准确率从大到小的顺序将各个业务类型进行排序。其中，即时通信业务的历史业务流量为20G，假设告警系数最大值为1.5。即时通信业务的历史综合业务流量为22×1.5＝33G。历史综合业务流量33G大于第一阈值30G，则表示即时通信业务在预设周期1检测成功。根据该业务类型以及告警系数最大值，继续判断在预设周期2内，历史综合业务流量与第一阈值之间的关系。直到将剩余所有历史告警信息都检测完成。在预设周期2中，第一阈值为40G。即时通信业务的历史业务流量 为30G。告警系数最大值为1.5。即时通信业务的历史综合业务流量为30×1.5＝45G。历史综合业务流量45G大于第一阈值40G，则表示即时通信业务在预设周期2检测成功。即时通信业务的历史综合业务流量大于或等于第一阈值的总次数为1800次。预测准确率为历史综合业务流量大于或等于第一阈值的总次数与预设周期的总数量的比值为1800÷2000＝90％。即时通信业务的预测准确率为90％。按照上述方法，确定流媒体业务的预测准确率为60％。P2P业务的预测准确率为50％。根据预测准确率从大到小的顺序，确定优先级信息为即时通信业务、流媒体业务、P2P业务。因此，检测链中第一个检测信息点是即时通信业务。
假设第一告警系数为1.0。即时通信业务的历史业务流量为20G，将即时通信业务的历史业务流量为20G乘第一告警系数1.0得到历史综合业务流量20×1.0＝20G。
假设预设的步长为0.1。在上述历史综合流量20G小于该预设周期内的第一阈值50G的情况下，判断第一告警系数1.0是否小于告警系数最大值1.5。
在第一告警系数小于告警系数最大值的情况下，如图5所示，根据预设的步长0.1，更新第一告警系数1.0，更新后的第一告警系数为1.1。在确认更新后的第一告警系数之后，将即时通信业务的历史业务流量20G乘更新的第一告警系数1.1，得到新的历史综合业务流量22G。将更新的历史综合业务流量与第一阈值再次进行比较。在更新的历史综合业务流量小于第一阈值的情况下，判断更新的第一告警系数1.1是否小于告警系数最大值1.5。
在更新的历史综合业务流量小于第一阈值，且第一告警系数1.1小于告警系数最大值1.5的情况下，继续根据更新第一告警系数，直至历史综合业务流量大于或等于第一阈值。假设在第一告警系数为1.3时，历史综合业务流量大于或等于第一阈值，那么可以确定检测链的预测准确率是否大于或等于预设概率。
在即时通信业务的预测准确率大于或等于预设概率的情况下，可以生成如图6所示的检测链。在检测链的预测准确率小于预设概率的情况下，可以 返回更新第一告警系数的步骤，直至检测链的预测准确率大于或等于预测概率。
可以理解的是，如果更新的第一告警系数不小于告警系数最大值，但是历史综合业务流量小于第一阈值或者检测链的预测准确率仍小于预设概率的情况下，可以加入第二个检测信息点。该第二个检测信息点可以是优先级第二的业务类型，如流媒体业务。此时，检测链中第一个检测信息点，也就是即时通信业务的告警系数为1.5，检测链中第二个检测信息点，也就是流媒体业务的告警系数为初始值，如1.0，如图7所示。按照上述历史综合业务流量的确定方法，可以根据即时通信业务的告警系数、即时通信业务的流量、流媒体业务的告警系数和流媒体业务的流量，确定更新的历史综合业务流量。
如果该历史综合业务流量小于第一阈值，则可以更新流媒体业务的告警系数，更新流媒体业务的告警系数的方式可以参照更新即时通信业务的告警系数的方式实施，此处不再赘述。
可以理解的是，如果流媒体业务的告警系数不小于告警系数最大值，但是历史综合业务流量小于第一阈值或者检测链的预测准确率仍小于预设概率的情况下，可以加入第三个检测信息点，以此类推，直至历史综合业务流量大于或等于第一阈值或者检测链的预测准确率大于或等于预设概率。
按照上述方式，可以生成如图8所示的检测链。该检测链中，即时通信业务的告警系数为1.5、流媒体业务的告警系数为1.5以及P2P业务的告警系数为1.1。
在一种可选的实施方式中，计算并存储所有预测准确率达到预设概率的检测链。在用户有需要的情况下，根据设定规则，选择告警系数。
每条检测链都有的准确率。因此，可以根据准确率作为设定规则选择检测链。每条检测链的长度并不一致，包含第一个检测信息点到第n个检测信息点，用户选择的检测链越短，检测异常流量的效率越高，但是预测准确率会相应个降低。用户选择的检测链越长，检测异常流量的效率会相应的降低，但是预测准确率会相应的提高。因此，可以根据检测链的长度作为设定规则 选择检测链。
在不同检测链中第n个业务类型以及该第n个业务类型的告警系数可能是相同的，可能是不同的。因此，可以根据第n个业务类型的告警系数作为设定规则选择检测链。需要说明的是，在检测链中，告警系数越接近1，则越接近该业务类型的流量真实值，检测准确性越高。
例如，如图9所示，有4条不同的检测链。用户的设定规则为：以预测率达到99％为第一原则，以预测链尽量短为第二原则，以各告警判决系数尽量接近1为第三原则。根据第一原则，排除检测链1。根据第二原则，在检测链2、检测链3、检测链4中，排除检测链4。根据第三原则，因为在检测链2以及检测链3中，即时通信业务以及流媒体业务的告警系数都是1.5。但是，在检测链2中传统数据业务的告警系数1.3小于在检测链3中传统数据业务的告警系数1.4，更接近1。所以，选择检测链2。根据检测链2，确定1.5为即时通信业务的告警系数、确定1.5为流媒体业务的告警系数以及确定1.3为传统数据业务的告警系数。
本申请实施例根据检测链的方式确定告警系数，相比于其他方式，实现简单，并且更加方便。通过历史告警信息更新告警系数，提高告警流量的检测准确性和检测异常流量的检测效率。
如图10所示，本申请实施例提供一种检测异常流量的整体流程图。
步骤S1001、识别各个业务流量的N个业务类型；N为大于或等于1的整数；
步骤S1002、根据第n个业务类型的预测准确率，确定N个业务类型的优先级信息；
步骤S1003、根据第k个检测信息点以及第k个检测信息点的第一告警系数，确定历史综合业务流量；第k个检测信息点是检测链中优先级从高到低的顺序确定的第n个业务类型；
步骤1004、在历史综合业务流量大于第一阈值的情况下，确定第k个检测信息点在历史告警信息中的预测准确率；
步骤1005、在预测准确率大于或等于预设概率的情况下，确定第一告警系数作为第k个检测信息点的告警系数；k为大于或等于0的整数；
步骤1006、根据第n个业务类型的告警系数以及第n个业务类型的业务流量，确定综合业务流量；n为大于或等于1，且小于N的整数；
步骤S1007、在综合业务流量大于或等于第二阈值的情况下，生成告警信息；
步骤S1008、在告警信息达到预设值的情况下，向用户发送告警；
步骤S1009、接收用户发送的异常流量防护指令；
步骤S1010、将异常流量防护指令下发给防护设备执行异常流量防护指令的操作。
本申请实施例提供了一种异常流量检测装置，如图11所示，该装置包括：识别模块1101、处理模块1102、生成模块1103，其中：
识别模块1101，用于识别各个业务流量的N个业务类型；所述N为大于或等于1的整数；
处理模块1102，用于根据第n个业务类型的告警系数以及所述第n个业务类型的业务流量，确定综合业务流量；所述n为大于或等于1，且小于N的整数；
其中，所述第n个业务类型的告警系数根据所述第n个业务类型在历史告警信息中的预测准确率确定；所述历史告警信息是在一个或多个预设周期内获得的，所述预测准确率为历史综合业务流量大于或等于第一阈值的次数与所述一个或多个预设周期的数量的比值，所述历史综合业务流量是根据所述第n个业务类型的告警系数和一个所述预设周期内所述历史告警信息中所述第n个业务类型的历史业务流量确定的；
生成模块1103，用于在所述综合业务流量大于或等于第二阈值的情况下，生成告警信息。
可选的，所述处理模块1102还用于：
在所述告警信息达到预设值的情况下，向用户发送告警；
接收用户发送的异常流量防护指令；
将所述异常流量防护指令下发给防护设备执行所述异常流量防护指令的操作。
可选的，所述处理模块1102还用于：
根据第n个业务类型的预测准确率，确定所述N个业务类型的优先级信息；
按照所述优先级信息从高到低的顺序，生成检测链；所述检测链包括第n个业务类型以及所述第n个业务类型的告警系数。
可选的，所述处理模块1102还用于：
根据第k个检测信息点以及所述第k个检测信息点的第一告警系数，确定所述历史综合业务流量；所述第k个检测信息点是所述检测链中优先级从高到低的顺序确定的第n个业务类型；k为大于或等于0的整数；
在所述历史综合业务流量小于第一阈值的情况下，根据所述第一告警系数和预设的步长确定更新的第一告警系数；
在所述历史综合业务流量大于或等于所述第一阈值的情况下，确定所述检测链的预测准确率；所述预测准确率是所述第k个检测信息点在所述历史告警信息中的预测准确率；
在所述预测准确率大于或等于预设概率的情况下，确定所述第一告警系数作为所述第k个检测信息点的告警系数。
可选的，所述处理模块1102还用于：
在所述检测链的预测准确率小于预设概率的情况下，根据所述第一告警系数和所述预设的步长确定更新的第一告警系数；
根据所述第k个检测信息点以及所述更新的第一告警系数，确定更新的历史综合业务流量。
可选的，所述处理模块1102还用于：
在所述更新的第一告警系数达到最大值，且所述历史综合业务流量小于所述第一阈值，或，所述预测准确率小于所述预设概率的情况下，根据第k 个检测信息点以及所述告警系数最大值，第k+1个检测信息点以及所述第k+1个检测信息点的第二告警系数，确定更新的历史综合业务流量；所述第k+1个检测信息点是所述检测链中优先级从高到低的顺序确定的第n+1个业务类型；
在所述更新的历史综合业务流量小于所述第一阈值的情况下，根据所述第二告警系数和所述预设的步长确定更新的第二告警系数。
可选的，所述处理模块1102还用于：
在所述更新的历史综合业务流量大于或等于所述第一阈值的情况下，确定更新的预测准确率；所述更新的预测准确率是所述第k个检测信息点和所述第k+1个检测信息点在所述历史告警信息中的预测准确率；
在所述更新的预测准确率大于或等于预设概率的情况下，确定所述告警系数最大值为所述第k个检测信息点的告警系数，确定所述更新的第二告警系数为所述第k+1个检测信息点的告警系数。
可选的，所述处理模块1102还用于：
在所述更新的预测准确率小于预设概率的情况下，根据所述第二告警系数和所述预设的步长确定更新的第二告警系数。
如图12所示，电子设备120以通用电子设备的形式表现。电子设备120的组件可以包括但不限于：上述至少一个处理器121、上述至少一个存储器122、连接不同系统组件(包括存储器122和处理器121)的总线123。
总线123表示几类总线结构中的一种或多种，包括存储器总线或者存储器控制器、外围总线、处理器或者使用多种总线结构中的任意总线结构的局域总线。
存储器122可以包括易失性存储器形式的可读介质，例如随机存取存储器(RAM)1221和/或高速缓存存储器1222，还可以进一步包括只读存储器(ROM)1223。
存储器122还可以包括具有一组(至少一个)程序模块1224的程序/实用工具1225，这样的程序模块1224包括但不限于：操作系统、一个或者多个应 用程序、其它程序模块以及程序数据，这些示例中的每一个或某种组合中可能包括网络环境的实现。
电子设备120也可以与一个或多个外部设备124(例如键盘、指向设备等)通信，还可与一个或者多个使得用户能与电子设备120交互的设备通信，和/或与使得该电子设备120能与一个或多个其它电子设备进行通信的任何设备(例如路由器、调制解调器等等)通信。这种通信可以通过输入/输出(I/O)接口125进行。并且，电子设备120还可以通过网络适配器126与一个或者多个网络(例如局域网(LAN)，广域网(WAN)和/或公共网络，例如因特网)通信。如图所示，网络适配器126通过总线123与用于电子设备120的其它模块通信。应当理解，尽管图中未示出，可以结合电子设备120使用其它硬件和/或软件模块，包括但不限于：微代码、设备驱动器、冗余处理器、外部磁盘驱动阵列、RAID系统、磁带驱动器以及数据备份存储系统等。
在示例性实施例中，还提供了一种包括指令的计算机可读存储介质，例如包括指令的存储器122，上述指令可由处理器121执行以完成上述异常流量检测方法。可选地，存储介质可以是非临时性计算机可读存储介质，例如，非临时性计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
在示例性实施例中，还提供一种计算机程序产品，包括计算机程序，计算机程序被处理器121执行时实现如本申请提供的异常流量检测方法的任一方法。
在示例性实施例中，本申请提供的一种异常流量检测方法的各个方面还可以实现为一种程序产品的形式，其包括程序代码，当程序产品在计算机设备上运行时，程序代码用于使计算机设备执行本说明书上述描述的根据本申请各种示例性实施方式的异常流量检测方法中的步骤。
程序产品可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以包括但不限于电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。 可读存储介质的更具体的例子(非穷举的列表)包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
本申请的实施方式的用于异常流量检测方法的程序产品可以采用便携式紧凑盘只读存储器(CD-ROM)并包括程序代码，并可以在电子设备上运行。然而，本申请的程序产品不限于此，在本文件中，可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了可读程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。可读信号介质还可以是可读存储介质以外的任何可读介质，该可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。
可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于无线、有线、光缆、RF等等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言的任意组合来编写用于执行本申请操作的程序代码，程序设计语言包括面向对象的程序设计语言，诸如Java、C++等，还包括常规的过程式程序设计语言，诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户电子设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户电子设备上部分在远程电子设备上执行、或者完全在远程电子设备或服务端上执行。在涉及远程电子设备的情形中，远程电子设备可以通过任意种类的网络，例如局域网(LAN)或广域网(WAN)，连接到用户电子设备，或者，可以连接到外部电子设备，例如利用因特网服务提供商来通过因特网连接。
应当注意，尽管在上文详细描述中提及了装置的若干单元或子单元，但是这种划分仅仅是示例性的并非强制性的。实际上，根据本申请的实施方式， 上文描述的两个或更多单元的特征和功能可以在一个单元中具体化。反之，上文描述的一个单元的特征和功能可以进一步划分为由多个单元来具体化。
此外，尽管在附图中以特定顺序描述了本申请方法的操作，但是，这并非要求或者暗示必须按照该特定顺序来执行这些操作，或是必须执行全部所示的操作才能实现期望的结果。附加地或备选地，可以省略某些步骤，将多个步骤合并为一个步骤执行，和/或将一个步骤分解为多个步骤执行。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程图像缩放设备的处理器以产生一个机器，使得通过计算机或其他可编程图像缩放设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程图像缩放设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程图像缩放设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例做出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (12)

  1. 一种异常流量检测方法，其特征在于，所述方法包括：
    识别各个业务流量的N个业务类型；所述N为大于或等于1的整数；
    根据第n个业务类型的告警系数以及所述第n个业务类型的业务流量，确定综合业务流量；所述n为大于或等于1，且小于N的整数；
    其中，所述第n个业务类型的告警系数根据所述第n个业务类型在历史告警信息中的预测准确率确定；所述历史告警信息是在一个或多个预设周期内获得的，所述预测准确率为历史综合业务流量大于或等于第一阈值的次数与所述一个或多个预设周期的数量的比值，所述历史综合业务流量是根据所述第n个业务类型的告警系数和一个所述预设周期内所述历史告警信息中所述第n个业务类型的历史业务流量确定的；
    在所述综合业务流量大于或等于第二阈值的情况下，生成告警信息。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    在所述告警信息达到预设值的情况下，向用户发送告警；
    接收用户发送的异常流量防护指令；
    将所述异常流量防护指令下发给防护设备执行所述异常流量防护指令对应的操作。
  3. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    根据第n个业务类型的预测准确率，确定所述N个业务类型的优先级信息；
    按照所述优先级信息从高到低的顺序，生成检测链；所述检测链包括第n个业务类型以及所述第n个业务类型的告警系数。
  4. 根据权利要求3所述的方法，其特征在于，所述按照所述优先级信息从高到低的顺序，生成检测链，包括：
    根据第k个检测信息点以及所述第k个检测信息点的第一告警系数，确定所述历史综合业务流量；所述第k个检测信息点是所述检测链中优先级从 高到低的顺序确定的第n个业务类型；k为大于或等于0的整数；
    在所述历史综合业务流量小于第一阈值的情况下，根据所述第一告警系数和预设的步长确定更新的第一告警系数；
    在所述历史综合业务流量大于或等于所述第一阈值的情况下，确定所述检测链的预测准确率；所述预测准确率是所述第k个检测信息点在所述历史告警信息中的预测准确率；
    在所述预测准确率大于或等于预设概率的情况下，确定所述第一告警系数作为所述第k个检测信息点的告警系数。
  5. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    在所述检测链的预测准确率小于预设概率的情况下，根据所述第一告警系数和所述预设的步长确定更新的第一告警系数；
    根据所述第k个检测信息点以及所述更新的第一告警系数，确定更新的历史综合业务流量。
  6. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    在所述更新的第一告警系数达到告警系数最大值，且所述历史综合业务流量小于所述第一阈值，或，所述预测准确率小于所述预设概率的情况下，根据第k个检测信息点以及所述告警系数最大值，第k+1个检测信息点以及所述第k+1个检测信息点的第二告警系数，确定更新的历史综合业务流量；所述第k+1个检测信息点是所述检测链中优先级从高到低的顺序确定的第n+1个业务类型；
    在所述更新的历史综合业务流量小于所述第一阈值的情况下，根据所述第二告警系数和所述预设的步长确定更新的第二告警系数。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    在所述更新的历史综合业务流量大于或等于所述第一阈值的情况下，确定更新的预测准确率；所述更新的预测准确率是所述第k个检测信息点和所述第k+1个检测信息点在所述历史告警信息中的预测准确率；
    在所述更新的预测准确率大于或等于预设概率的情况下，确定所述告警 系数最大值为所述第k个检测信息点的告警系数，确定所述更新的第二告警系数为所述第k+1个检测信息点的告警系数。
  8. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    在所述更新的预测准确率小于预设概率的情况下，根据所述第二告警系数和所述预设的步长确定更新的第二告警系数。
  9. 一种异常流量检测装置，其特征在于，包括：
    识别模块，用于识别各个业务流量的N个业务类型；所述N为大于或等于1的整数；
    处理模块，用于根据第n个业务类型的告警系数以及所述第n个业务类型的业务流量，确定综合业务流量；所述n为大于或等于1，且小于N的整数；
    其中，所述第n个业务类型的告警系数根据所述第n个业务类型在历史告警信息中的预测准确率确定；所述历史告警信息是在一个或多个预设周期内获得的，所述预测准确率为历史综合业务流量大于或等于第一阈值的次数与所述一个或多个预设周期的数量的比值，所述历史综合业务流量是根据所述第n个业务类型的告警系数和一个所述预设周期内所述历史告警信息中所述第n个业务类型的历史业务流量确定的；
    生成模块，用于在所述综合业务流量大于或等于第二阈值的情况下，生成告警信息。
  10. 一种电子设备，包括存储器，处理器及存储在存储器上并可在处理器运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如权利要求1-8中任一项所述的异常流量检测方法。
  11. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求1-8中任一所述方法的步骤。
  12. 一种计算机程序产品，其特征在于，所述计算机程序产品在被计算机调用时，使得所述计算机执行如权利要求1-8中任一所述方法的步骤。
PCT/CN2022/136983 2022-08-23 2022-12-06 一种异常流量检测方法、装置、电子设备及存储介质 WO2024040794A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211011554.2A CN115412326A (zh) 2022-08-23 2022-08-23 一种异常流量检测方法、装置、电子设备及存储介质
CN202211011554.2 2022-08-23

Publications (1)

Publication Number Publication Date
WO2024040794A1 true WO2024040794A1 (zh) 2024-02-29

Family

ID=84160653

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/136983 WO2024040794A1 (zh) 2022-08-23 2022-12-06 一种异常流量检测方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN115412326A (zh)
WO (1) WO2024040794A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115412326A (zh) * 2022-08-23 2022-11-29 天翼安全科技有限公司 一种异常流量检测方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090070880A1 (en) * 2007-09-11 2009-03-12 Harris David E Methods and apparatus for validating network alarms
CN110784458A (zh) * 2019-10-21 2020-02-11 新华三信息安全技术有限公司 流量异常检测方法、装置及网络设备
WO2020259421A1 (zh) * 2019-06-28 2020-12-30 深圳前海微众银行股份有限公司 一种业务系统的监控方法及装置
WO2022068549A1 (zh) * 2020-09-30 2022-04-07 中国银联股份有限公司 异常告警方法、装置、设备及存储介质
CN115412326A (zh) * 2022-08-23 2022-11-29 天翼安全科技有限公司 一种异常流量检测方法、装置、电子设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090070880A1 (en) * 2007-09-11 2009-03-12 Harris David E Methods and apparatus for validating network alarms
WO2020259421A1 (zh) * 2019-06-28 2020-12-30 深圳前海微众银行股份有限公司 一种业务系统的监控方法及装置
CN110784458A (zh) * 2019-10-21 2020-02-11 新华三信息安全技术有限公司 流量异常检测方法、装置及网络设备
WO2022068549A1 (zh) * 2020-09-30 2022-04-07 中国银联股份有限公司 异常告警方法、装置、设备及存储介质
CN115412326A (zh) * 2022-08-23 2022-11-29 天翼安全科技有限公司 一种异常流量检测方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN115412326A (zh) 2022-11-29

Similar Documents

Publication Publication Date Title
US11632392B1 (en) Distributed malware detection system and submission workflow thereof
US10320623B2 (en) Techniques for tracking resource usage statistics per transaction across multiple layers of protocols
CN111124819B (zh) 全链路监控的方法和装置
WO2022083353A1 (zh) 异常网络数据检测方法、装置、计算机设备和存储介质
US10785255B1 (en) Cluster configuration within a scalable malware detection system
CN109313689B (zh) 用于检测网络上的容量耗尽攻击的方法和系统
US11184387B2 (en) Network attack defense system and method
US10122722B2 (en) Resource classification using resource requests
EP3149894B1 (en) Assisting application classification using predicted subscriber behavior
US20200120124A1 (en) Network traffic spike detection and management
CN106789413B (zh) 一种检测代理上网的方法和装置
WO2024040794A1 (zh) 一种异常流量检测方法、装置、电子设备及存储介质
WO2024060408A1 (zh) 网络攻击检测方法和装置、设备及存储介质
CN112437006A (zh) 基于api网关的请求控制方法、装置、电子设备和存储介质
US20200059471A1 (en) System for Application Aware Rate-Limiting Using Plug-In
US9122546B1 (en) Rapid processing of event notifications
US9195805B1 (en) Adaptive responses to trickle-type denial of service attacks
US11258768B2 (en) Optimization of the isolation and disabling of unauthorized applications by detection of false positives
CN112994934B (zh) 数据交互方法、装置及系统
US20230188545A1 (en) Adaptive Online Services Access Control
Sabir DDoS Attacks Detection using Machine Learning
US11425100B2 (en) Optimization of redundant usage patterns based on historical data and security constraints
CN112866179B (zh) 限流方法和限流装置
US11075911B2 (en) Group-based treatment of network addresses
CN112152915A (zh) 消息转发网关系统和消息转发方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22956327

Country of ref document: EP

Kind code of ref document: A1