WO2024109083A1

WO2024109083A1 - Network traffic inspection method, electronic device, and storage medium

Info

Publication number: WO2024109083A1
Application number: PCT/CN2023/105206
Authority: WO
Inventors: 姚云国; 石辰
Original assignee: 中兴通讯股份有限公司
Priority date: 2022-11-23
Filing date: 2023-06-30
Publication date: 2024-05-30
Also published as: CN118074930A

Abstract

The present application relates to the technical field of information processing, and discloses a network traffic inspection method, an electronic device, and a storage medium. The method comprises: determining target flow information of target network traffic; determining target ports for the target network traffic according to the target flow information, wherein the target ports comprise a source port and a destination port; and determining a flow anomaly event according to features of the target ports and target flow features corresponding to the target flow information.

Description

A network flow detection method, electronic device and storage medium

cross reference

This application claims priority to a Chinese patent application filed with the China Patent Office on November 23, 2022, with application number 202211476183.5 and invention name “A network traffic detection method, electronic device and storage medium”. The entire contents of the application are incorporated by reference into this application.

Technical Field

The present application belongs to the field of information processing technology, and specifically relates to a network traffic detection method, an electronic device and a storage medium.

Background technique

With the rapid development of information technology, network security issues are becoming increasingly severe. As one of the methods to deal with this problem, network traffic anomaly detection technology has always attracted much attention.

There are two detection methods based on flow information. The first is the rule-based detection method, which usually records the flow information features extracted from abnormal network traffic in a predetermined rule file based on empirical values, and then matches the traffic to be detected. This method is usually used to deal with discovered threats, but for zero-day threats, the detection accuracy is low; the second is the artificial intelligence-based detection method, which usually detects network traffic based on the flow information corresponding to the network traffic, such as source IP, destination IP and other features, using related machine learning algorithms. It is difficult to identify some attack programs implanted in normal network flows, and the detection accuracy is low.

Summary of the invention

The purpose of the embodiments of the present application is to provide a network traffic detection method, device, electronic device and storage medium, which can realize abnormal detection of end-to-end communication traffic in the network with high detection accuracy.

In order to solve the above technical problems, this application is implemented as follows:

In a first aspect, an embodiment of the present application provides a network traffic detection method, the method comprising: determining target flow information of target network traffic; determining a target port of the target network traffic based on the target flow information, wherein the target port comprises a source port and a destination port; determining a flow abnormality event based on characteristics of the target port and target flow characteristics corresponding to the target flow information.

In the second aspect, an embodiment of the present application provides a network traffic detection device, which includes: a first determination module, used to determine the target flow information of the target network traffic; a second determination module, used to determine the target port of the target network traffic based on the target flow information, wherein the target port includes a source port and a destination port; a detection module, used to determine the flow abnormality event based on the characteristics of the target port and the target flow characteristics corresponding to the target flow information.

In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the network traffic detection method described in the first aspect are implemented.

In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the network traffic detection method described in the first aspect are implemented.

In a fifth aspect, an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the network traffic detection method as described in the first aspect.

In a sixth aspect, an embodiment of the present application provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the network traffic detection method as described in the first aspect.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a network traffic detection method provided in an embodiment of the present application.

FIG2 is a flow chart of a network traffic detection method provided in an embodiment of the present application.

FIG3 is a schematic diagram of the structure of a port pattern recognition model provided in an embodiment of the present application.

FIG. 4 is a schematic diagram of the structure of a port pattern recognition model provided in an embodiment of the present application.

FIG5 is a schematic diagram of the structure of a flow anomaly detection model provided in an embodiment of the present application.

FIG6 is a schematic diagram of the structure of a network traffic detection device provided in an embodiment of the present application.

FIG. 7 is a schematic diagram of the hardware structure of an electronic device for executing the network traffic detection method provided in an embodiment of the present application.

Detailed ways

The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

The terms "first", "second", etc. in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and/or" in the specification and claims represents at least one of the connected objects, and the character "/" generally indicates that the objects associated with each other are in an "or" relationship.

In conjunction with the accompanying drawings, a network traffic detection method, device, electronic device and storage medium provided in the embodiments of the present application are described in detail through specific embodiments and their application scenarios.

FIG1 shows a flow chart of a network traffic detection method provided by an embodiment of the present application. The method can be executed by an electronic device, and the electronic device may include: a server or a terminal device. In other words, the method can be executed by software or hardware installed in the electronic device. As shown in FIG1, the method includes the following steps:

S101: Determine target flow information of target network traffic.

This step obtains the target network traffic. The target network traffic is analyzed by the traffic probe to obtain the target flow information. For example, the extracted flow information includes the 80+ dimensional features of the network flow defined by the Canadian Institute for Cyber Security, the 41 flow features defined by the KDD data set of the IDS Laboratory of Columbia University, etc. By analyzing and studying these flow information features, relevant network traffic detection is performed. In addition, the obtained network traffic data can be the original traffic obtained in the network environment or local cache file.

S102: Determine a target port of the target network traffic according to the target flow information.

This step determines the target port of the target network traffic according to the target flow information, and the target port includes a source port and a destination port.

S103: Determine a flow abnormality event according to the characteristics of the target port and the target flow characteristics corresponding to the target flow information.

This step takes into account that processes that transmit traffic often communicate through ports. For example, the communication between 5th Generation Mobile Communication Technology (5G) devices and device management centers is usually point-to-point, and the source port and destination port are fixed. For example, when a device initiates a scanning and reconnaissance behavior, the source port and the destination port flow largely show a pattern of fixed source ports and random destination ports. Although different devices are similar in traffic, they have different communication ports. By adding the port features corresponding to the target flow as detection features on the basis of the target flow features corresponding to the target flow information to determine the flow anomaly event, the flow anomaly detection effect is further enhanced, and the anomaly detection of end-to-end communication traffic in the network is achieved with high detection accuracy.

In an optional implementation, the flow abnormality event is determined based on the characteristics of the target port and the target flow characteristics, including: splicing the characteristics of the target port and the target flow characteristics to obtain a spliced value; encoding the spliced value and then restoring it to obtain a restored value; comparing the spliced value with the restored value to obtain an abnormal value; when the abnormal value is greater than a threshold, determining the target network traffic as the flow abnormality event.

A network traffic detection method provided by an embodiment of the present application determines the target flow information of the target network traffic; determines the target port of the target network traffic based on the target flow information, wherein the target port includes a source port and a destination port; determines the flow abnormality event based on the characteristics of the target port and the target flow characteristics corresponding to the target flow information, thereby realizing abnormal detection of end-to-end communication traffic in the network with high detection accuracy.

FIG2 is a schematic diagram showing a flow chart of another network traffic detection method provided in an embodiment of the present application. The method can be executed by an electronic device, which may include a server or a terminal device. In other words, the method can be executed by software or hardware installed in the electronic device, as shown in FIG2 , and the method includes the following steps:

S201: Determine target flow information of target network traffic.

S202: Determine a target port of the target network traffic according to the target flow information.

The network flow data is passed through a flow probe or flow information extraction tool to extract a flow information set. The flow information includes the source Internet Protocol (IP), source port, destination IP, destination port, time, number of upstream bytes, number of downstream bytes, number of upstream packets, etc.

S203: Input the characteristics of the target port into a port pattern recognition model to obtain the pattern of the target port.

In this step, the port information of the target flow information is passed as a feature into the port pattern recognition model to obtain a port pattern. The output of the port pattern recognition model includes four dimensions, namely: the source port is fixed, the source port is random, the destination port is fixed, and the destination port is random. The port pattern recognition model can be trained using network traffic with comprehensive port patterns. For example, the network traffic for port pattern recognition comes from traditional IT office networks, laboratory network traffic, etc.

In one implementation, as shown in FIG3 , the characteristics of the target port are input into a port pattern recognition model to obtain the pattern of the target port, including: inputting the characteristics of the target port into a first network layer of the port pattern recognition model; inputting characteristics of multiple ports corresponding to multiple historical flow information and multiple time period information into a second network layer of the port pattern recognition model; adding the output of the first network layer to the output of the second network layer, inputting the sum into a third network layer of the port pattern recognition model, and outputting the pattern of the target port; wherein the output dimension of the first network layer is the same as the output dimension of the second network layer.

In an optional implementation, before determining the flow abnormality event according to the characteristics of the target port and the target flow characteristics corresponding to the target flow information, it also includes: dimensionality conversion of the characteristics of the target port so that the dimension of the characteristics of the target port reaches the target dimension.

Specifically, the port pattern recognition model is divided into an input layer, a network layer, and an output layer, as shown in FIG3 . The basic idea is to query the specific port pattern of this combination based on all historical flow port information (input data 2) combined with the characteristics of the target port (input data 1). The input layer is the entrance of the model. When the model is trained, input data 1 represents the port combination (source port, destination port) passed through in the current training data set; when the model is tested, it represents the (source port, destination port) passed through by the current test flow information; input data 2 represents all flow port information in the current training data set, where the time when the flow corresponding to the source port/destination port is generated can also be used. The time characteristics of the flow generation can be processed by generalized mapping. For example, if divided by hours, 00:10:00 can be mapped to 0, and 05:30:22 can be mapped to 5. The relevant generalization granularity is not specifically limited here.

The specific structure of the port pattern recognition model can be shown in FIG4 , wherein the network layer 1 is not limited to adopting a network structure such as a fully connected or convolutional network layer. The network layer 2 is not limited to adopting a network structure such as a fully connected, convolutional, long short-term memory (LSTM), multi-head attention, etc. After obtaining the results of the network layer 1 and the network layer 2, the two results are added and then input into the network layer 3 for calculation. The network layer 3 is not limited to adopting a network structure such as a fully connected or convolutional network.

The input layer uses two embedding (65536, 16) layers. The source port uses one embedding1, and the destination port uses embedding2. 65536 represents the maximum total number of ports, and 16 represents the dimension after port mapping. This value can be adjusted as needed. The first dimension in the embedding corresponds to the replaced port number one by one. The time period information does not need to use the embedding technology. Network layer 1 uses a single-layer fully connected layer with 64 neurons; network layer 2 uses 2 convolutional layers + Flatten + 64 neurons. Single-layer fully connected layer. Network layer 3 uses a single-layer fully connected layer with 128 neurons. The output layer uses a single-layer fully connected network with 4 neurons.

S204: According to the mode of the target port and the characteristics of the target port, convert the characteristics of the target port to obtain the converted characteristics of the target port.

In an optional implementation, the characteristics of the target port are converted according to the pattern of the target port and the characteristics of the target port, including one of the following: when the pattern of the target port is fixed, retaining the original value of the characteristics of the target port; when the pattern of the target port is random, converting the characteristics of the target port to a preset generalized value.

Specifically, the input data 1 is passed through the pattern recognition model to obtain the port pattern, and then port conversion is performed. If the port mode is fixed, the original value of the port is retained. If the port pattern is recognized as random, the port is replaced with "random" to obtain a new port feature. For example, the target port (50001, 80) has a port mode of (random, fixed), and the converted result is represented as (random, 80).

S205: Input the converted target port features and the target flow features into a flow anomaly detection model to obtain the flow anomaly event.

The flow anomaly detection model described in this step includes an autoencoder AE or a variational autoencoder VAE, and the network structure can be as shown in Figure 5, without specific limitation.

In an optional implementation, before inputting the characteristics of multiple ports corresponding to multiple historical flow information and multiple time period information into the second network layer of the port pattern recognition model, it also includes: determining a first number of first ports, wherein the first port includes at least one port corresponding to the multiple historical flow information; sorting the multiple first numbers to determine a first sorting value corresponding to the first port; encoding the characteristics of the first port according to the first sorting value; inputting the characteristics of multiple ports corresponding to multiple historical flow information and multiple time period information into the second network layer of the port pattern recognition model, includes: inputting the encoded characteristics of the multiple ports and multiple time period information into the second network layer of the port pattern recognition model.

Specifically, by data preprocessing, each flow information in the flow information set can be separated into two parts, one part contains three pieces of information: source port, destination port, and time, and the flow information set feature_1_1 is obtained, and the port mode of each flow in the set is labeled (label), for example (1,0,0,1), which respectively indicates that the source port is fixed, the source port is random, the destination port is fixed, and the destination port is random, where 1 indicates confirmation and 0 indicates negation, and the other part extracts the remaining information from the flow information except the 4-tuple (source IP, source port, destination IP, destination port) and time to obtain the flow information set feature_2_1. Then, feature_1_1 is generalized into ports, and the number of occurrences of the source port and the destination port in feature_1_1 are counted respectively, and sorted to obtain the sorting results, as shown in Table 1 below, and finally the port number is replaced with the sorting sequence number, such as encoding port 2554 as its corresponding sequence number 1.

Table 1 Example of port number sorting results

In addition, the present application may also include a data enhancement step, such as deduplicating the (source port, destination port) combination in feature_1_1 to obtain the feature_3_1 set, and then negatively sampling the feature_3_1 data, with the port value range from 1 to 65536, and recording the port mode label of the source or destination port that does not appear in feature_3_1 as random, for example, the negative sampling source and destination port (1, 10), where 10 does not appear on the destination port, then the port mode label is (1, 0, 0, 1), and the enhanced data is placed in the feature_3_1 set.

The training process of the port pattern recognition model in the embodiment of the present application includes: traversing the aforementioned feature_3_1 one by one, extracting the source port and the destination port as input data 1, all feature_1_1 source ports, destination ports, and time period information as input data 2, and the label in feature_3_1 as the output layer label, and then training, each traversal of feature_3_1 as an epoch, and the epoch can be set to 200 times, or specified as needed. After the training is completed, the port pattern recognition model is obtained.

Then, the flow anomaly detection model is trained, and the specific steps include: traversing each flow feature in feature_2_1, extracting the corresponding source port and destination port information in feature_1_1, and sending it to the port identification model to obtain the port mode; performing feature conversion on the source port and the destination port according to the port mode, and obtaining a new feature new_port_feature; splicing feature_2_1 and new_port_feature and sending them to the flow anomaly detection model for training, encoding the input data and then decoding and restoring it, using the reconstruction between the original input data and the restoration as the outlier value, each traversal of feature_2_1 as an epoch, the epoch can be specified as needed, and after the training is completed, taking the maximum outlier value in the training set as the threshold of the abnormal event to obtain the flow anomaly detection model.

It should be noted that the network traffic data used in the present application for training the port pattern recognition model and the network traffic data used for training the flow anomaly detection model may be the same or different, and the present application does not impose any specific restrictions. For example, the network traffic data used by the port pattern recognition model may be made richer, so that the training effect of the port pattern recognition model is better, thereby improving the accuracy of the flow anomaly detection model detection.

It should be noted that the network traffic detection method provided in the embodiment of the present application can be executed by a network traffic detection device, or a control module in the network traffic detection device for executing the network traffic detection method. In the embodiment of the present application, the method for executing network traffic detection by a network traffic detection device is taken as an example to illustrate the network traffic detection device provided in the embodiment of the present application.

Fig. 6 is a schematic diagram of the structure of a network traffic detection device provided by an embodiment of the present application. As shown in Fig. 6 , the network traffic detection device 600 includes: a first determination module 610 , a second determination module 620 and a detection module 630 .

The first determination module 610 is used to determine the target flow information of the target network traffic; the second determination module 620 is used to determine the target port of the target network traffic based on the target flow information, wherein the target port includes a source port and a destination port; the detection module 630 is used to determine the flow abnormality event based on the characteristics of the target port and the target flow characteristics corresponding to the target flow information.

In an optional implementation, the detection module 630 is used to: input the characteristics of the target port into a port pattern recognition model to obtain the pattern of the target port, wherein the port pattern recognition model is used to simulate the correspondence between the characteristics of multiple ports and multiple port patterns, and the pattern of the target port is used to represent the combined characteristics of the target port and the target port attributes; according to the pattern of the target port and the characteristics of the target port, convert the characteristics of the target port to obtain the characteristics of the converted target port; according to the characteristics of the converted target port and the target flow characteristics, determine the flow abnormality event.

In an optional implementation, the detection module 630 is used to: input the characteristics of the target port into the first network layer of the port pattern recognition model; input the characteristics of multiple ports corresponding to multiple historical flow information and multiple time period information into the second network layer of the port pattern recognition model; add the output of the first network layer to the output of the second network layer, input the result to the third network layer of the port pattern recognition model, and output the pattern of the target port; wherein the output dimension of the first network layer is the same as the output dimension of the second network layer.

In an optional implementation, the detection module 630 is used to: input the characteristics of the target port and the target flow characteristics into a flow anomaly detection model to obtain the flow anomaly event, wherein the flow anomaly detection model includes an autoencoder AE or a variational autoencoder VAE.

In an optional implementation, the detection module 630 is used to: splice the characteristics of the target port and the target flow characteristics to obtain a spliced value; encode the spliced value and then restore it to obtain a restored value; compare the spliced value with the restored value to obtain an abnormal value; when the abnormal value is greater than a threshold, determine the target network traffic as the flow abnormal event.

In an optional implementation, the device 600 also includes: an encoding module, which is used to: determine a first number of first ports, wherein the first port includes at least one port corresponding to the multiple historical flow information; sort the multiple first numbers to determine a first sorting value corresponding to the first port; encode the characteristics of the first port according to the first sorting value; the detection module 630 is used to input the encoded characteristics of the multiple ports and multiple time period information into the second network layer of the port pattern recognition model.

In an optional implementation, the device 600 further includes: a preprocessing module, wherein the preprocessing module is configured to: perform dimension conversion on the feature of the target port so that the dimension of the feature of the target port reaches a target dimension.

A network traffic detection device provided by an embodiment of the present application uses a first determination module to determine target flow information of target network traffic; a second determination module to determine a target port of the target network traffic based on the target flow information, wherein the target port includes a source port and a destination port; a detection module to determine a flow anomaly event based on characteristics of the target port and target flow characteristics corresponding to the target flow information, thereby enabling abnormal detection of end-to-end communication traffic in the network with high detection accuracy.

The network traffic detection device provided in the embodiment of the present application can implement the various processes implemented by the network traffic detection method embodiment described in Figures 1 to 2, and achieve the same technical effect. To avoid repetition, it will not be repeated here.

The network traffic detection device in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal device. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and the non-mobile electronic device can be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

The network traffic detection device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other optional operating systems, which are not specifically limited in the embodiment of the present application.

Optionally, as shown in FIG7 , an embodiment of the present application further provides an electronic device 700, including a processor 701, a memory 702, a program or instruction stored in the memory 702 and executable on the processor 701, and when the program or instruction is executed by the processor 701, the network traffic detection method described in at least one of the embodiments of FIG1 and FIG2 is implemented. It should be noted that the electronic device in the embodiment of the present application includes: a server, a terminal device, or other devices other than a terminal device.

The above electronic device structure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the input unit may include a graphics processing unit (GPU) and a microphone, and the display unit may be configured with a display panel in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes a touch panel and at least one of other input devices. The touch panel is also called a touch screen. Other input devices may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

The memory can be used to store software programs and various data. The memory may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory may include a volatile memory or a non-volatile memory, or the memory may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. Volatile memory can be random access memory (Random Access Memory, RAM), static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDRSDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (Synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DRRAM).

The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, and the modem processor mainly processes communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor.

An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the network traffic detection method described in at least one of the embodiments of Figures 1 and 2 is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

The processor is a processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned network traffic detection method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM/RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

A network traffic detection method, the method comprising:

Determine target flow information of target network traffic;

Determine the target port of the target network traffic according to the target flow information, wherein the target port includes a source port and a destination port;

A flow abnormality event is determined according to the characteristics of the target port and the target flow characteristics corresponding to the target flow information.
The method according to claim 1, wherein the determining the flow abnormality event according to the characteristics of the target port and the target flow characteristics corresponding to the target flow information comprises:

Inputting the characteristics of the target port into a port pattern recognition model to obtain the pattern of the target port, wherein the port pattern recognition model is used to simulate the corresponding relationship between the characteristics of a port and the pattern of a port, and the pattern of the target port is used to represent the combined characteristics of the target port and the attributes of the target port;

According to the mode of the target port and the characteristics of the target port, the characteristics of the target port are converted to obtain the characteristics of the converted target port;

The flow abnormality event is determined according to the characteristics of the converted target port and the characteristics of the target flow.
The method according to claim 2, wherein the step of inputting the characteristics of the target port into a port pattern recognition model to obtain the pattern of the target port comprises:

Inputting the characteristics of the target port into the first network layer of the port pattern recognition model;

Inputting the characteristics of multiple ports and multiple time period information corresponding to the multiple historical flow information into the second network layer of the port pattern recognition model;

After adding the output of the first network layer and the output of the second network layer, the output is input into the third network layer of the port pattern recognition model, and the pattern of the target port is output;

The output dimension of the first network layer is the same as the output dimension of the second network layer.
The method according to claim 2, wherein the converting the characteristic of the target port according to the mode of the target port and the characteristic of the target port comprises one of the following:

In the case where the mode of the target port is fixed, retaining the original value of the characteristic of the target port;

When the pattern of the target port is random, the feature of the target port is converted into a preset generalization value.
The method according to claim 1, wherein the determining the flow abnormality event according to the characteristics of the target port and the characteristics of the target flow comprises:

The characteristics of the target port and the characteristics of the target flow are input into a flow anomaly detection model to obtain the flow anomaly event, wherein the flow anomaly detection model includes an autoencoder AE or a variational autoencoder VAE.
The method according to claim 1, wherein the determining the flow abnormality event according to the characteristics of the target port and the characteristics of the target flow comprises:

Concatenate the target port feature and the target flow feature to obtain a concatenated value;

Encoding the concatenated value and then restoring it to obtain a restored value;

Compare the spliced value with the restored value to obtain an abnormal value;

When the abnormal value is greater than a threshold, the target network traffic is determined as the flow abnormality event.
The method according to claim 3, wherein, before inputting the characteristics of the multiple ports and the multiple time period information corresponding to the multiple historical flow information into the second network layer of the port pattern recognition model, it also includes:

Determine a first number of first ports, wherein the first ports include at least one port corresponding to the plurality of historical flow information;

sorting the first quantities to determine a first sorting value corresponding to the first port;

encoding a characteristic of the first port according to the first ranking value;

The step of inputting the characteristics of the multiple ports and the multiple time period information corresponding to the multiple historical flow information into the second network layer of the port pattern recognition model comprises:

The encoded features of the multiple ports and the multiple time period information are input into the second network layer of the port pattern recognition model.
The method according to claim 1, wherein, before determining the flow abnormality event according to the characteristics of the target port and the target flow characteristics corresponding to the target flow information, it also includes:

The feature of the target port is dimensionally transformed so that the dimension of the feature of the target port reaches a target dimension.
An electronic device comprises a processor, a memory and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the network traffic detection method as described in any one of claims 1 to 8.
A readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the network traffic detection method according to any one of claims 1 to 8 are implemented.