CN111901316A - Network flow abnormity detection method applied to industrial Internet and big data platform - Google Patents

Abstract

The network flow abnormity detection method and the big data platform applied to the industrial internet can establish a flow detection channel corresponding to the target terminal equipment through the authorization instruction, collect the real-time network flow of the target terminal equipment through the flow detection channel so as to draw a flow curve, periodically determine a plurality of groups of flow change tracks of the target terminal equipment based on the flow curve, calculate the track offset between the flow change tracks at different time intervals, determine the state parameter of the target terminal equipment at the current time interval when the target terminal equipment is judged to be attacked by distributed denial of service according to the track offset, and generate a dynamic security policy according to the state parameter and send the dynamic security policy to the target terminal equipment. Therefore, the target terminal device can determine and destroy the abnormal request in the to-be-processed request based on the dynamic security policy. Therefore, the paralysis of the target terminal equipment can be avoided, and the safe and reliable operation of the whole industrial internet control system is ensured.

Description

Network traffic anomaly detection method and big data platform applied to industrial Internet

technical field

The present application relates to the technical field of industrial Internet communication security processing, and in particular, to a network traffic anomaly detection method and a big data platform applied to the industrial Internet.

Background technique

The development of the Industrial Internet has made the manufacturing industry improve in the direction of intelligence and digitization, which can greatly improve production efficiency and release manual labor. With the maturity of edge computing, the distributed industrial control system of cloud, edge and terminal collaboration is gradually applied in various large-scale production scenarios. Edge computing can realize data processing and analysis on the edge device side, thereby effectively improving the efficiency of data interaction and reducing the delay of data interaction.

In practical applications, in order to ensure the safe and reliable operation of the entire industrial Internet system, it is necessary to perform security detection on the industrial Internet system. Due to the deployment of multiple terminal devices in the Industrial Internet system, Distributed Denial of Service attack (DDos) is the main attack mode suffered by the Industrial Internet system. DDos attacks can cause many terminal devices to be attacked at the same time, causing these terminal devices to fail to work normally, resulting in large-scale production accidents and huge economic losses.

It can be seen that how to effectively detect distributed denial of service attacks and formulate security strategies is a technical problem that needs to be solved urgently at this stage.

SUMMARY OF THE INVENTION

This application provides a network traffic anomaly detection method and a big data platform applied to the Industrial Internet, so as to effectively detect distributed denial of service attacks and formulate security policies.

First, a network traffic anomaly detection method applied to the Industrial Internet is provided, applied to a big data platform, and the method includes:

When receiving the authorization instruction fed back by the target terminal device based on the traffic detection request sent by the big data platform, establish a traffic detection channel corresponding to the target terminal device through the device interface parameters carried in the authorization instruction;

Collect real-time network traffic of the target terminal device through the traffic detection channel, and draw a traffic curve corresponding to the target terminal device based on the real-time network traffic;

Periodically determine multiple groups of flow change trajectories of the target terminal device based on the flow curve, and calculate the trajectory offset between the flow change trajectory corresponding to the current period and the flow change trajectory corresponding to the previous period;

When it is determined according to the track offset that the target terminal device is subject to a DDoS attack, the state parameter of the target terminal device in the current period is determined by the track offset, and according to the state parameter A dynamic security policy is generated and delivered to the target terminal device, so that the target terminal device determines and destroys abnormal requests in pending requests based on the dynamic security policy.

Optionally, judging whether the target terminal device suffers from a distributed denial of service attack specifically includes:

Determine whether the trajectory offset is lower than the set threshold;

When the trajectory offset is lower than the set threshold, superimposing the flow change trajectory corresponding to the previous period to the flow rate change trajectory corresponding to the current period;

Calculate the correlation coefficient of the trajectory feature between the flow change trajectory corresponding to the current period and the flow change trajectory corresponding to the next period;

If the correlation coefficient is greater than the set coefficient, it is determined that the target terminal device suffers from a distributed denial of service attack.

Optionally, the method further includes:

When the trajectory offset is greater than or equal to the set threshold, determine the first trajectory interval corresponding to the trajectory offset in the flow change trajectory corresponding to the previous period and in the flow rate change trajectory corresponding to the current period. the second trajectory interval of ;

Extracting the first track data list of the first track section and the second track data list of the second track section, and calculating the traffic feature overlap ratio between the first track data list and the second track data list ;

If the traffic feature overlap ratio is greater than a set ratio, it is determined that the target terminal device suffers from a distributed denial of service attack.

Optionally, the flow change trajectory corresponding to the previous period is superimposed on the flow rate change trajectory corresponding to the current period, and the correlation of the trajectory characteristics between the flow rate change trajectory corresponding to the current period and the flow rate change trajectory corresponding to the next period is calculated. coefficients, including:

Generate a first traffic protocol address list corresponding to the traffic change track corresponding to the previous time period and used to represent the packet information of the traffic packets corresponding to the traffic change track corresponding to the previous time period, and the traffic used to represent the traffic change track corresponding to the current time period. The second flow protocol address list of the message information of the message; wherein, the first flow protocol address list and the second flow protocol address list respectively include the same number of multiple list units, and the number of each list unit is The unit recognition degrees are different, and the unit recognition degrees are used to represent the degree of association of the list features of the list units;

A protocol address path corresponding to one of the list units is extracted from the first traffic protocol address list corresponding to the traffic change track corresponding to the previous period; wherein, when determining the protocol address path, the traffic corresponding to the current period is changed in parallel The list unit with the largest unit identification degree in the second traffic protocol address list corresponding to the track is determined as the reference list unit;

Map the protocol address path into the reference list unit and determine the mapped address path of the protocol address path in the reference list unit; determine the first address path through the mapped address path and the protocol address path A directed acyclic graph used to characterize the correspondence between a traffic protocol address list and the second traffic protocol address list;

Based on the directed acyclic graph for characterizing the correspondence between traffic protocol addresses, each group of first traffic trajectory parameters in the traffic change trajectory corresponding to the previous period is superimposed on the corresponding first traffic trajectory parameter in the traffic change trajectory corresponding to the current period. In the second flow trajectory parameter group;

If each group of first traffic trajectory parameters has a unique corresponding protocol signature in its corresponding second traffic trajectory parameter group, then according to the protocol signature, the difference between the traffic change trajectory corresponding to the current period and the traffic change trajectory corresponding to the next period is calculated. The numerical queues corresponding to the trajectory characteristics of the interval are weighted, and the median of the weighted numerical queues is calculated as the correlation coefficient of the trajectory characteristics between the traffic change trajectory corresponding to the current period and the traffic change trajectory corresponding to the next period;

If each group of first traffic trajectory parameters does not have a unique corresponding protocol signature in its corresponding second traffic trajectory parameter group, return the directed acyclic graph used to represent the correspondence between the traffic protocol addresses and the previous The step of superimposing each group of flow track parameters in the flow rate change track corresponding to the time period to the corresponding second flow track parameter group in the flow rate change track corresponding to the current time period.

Optionally, determine the first trajectory interval corresponding to the trajectory offset in the flow rate change trajectory corresponding to the previous period and the second trajectory interval corresponding to the flow rate change trajectory corresponding to the current period, and extract the first trajectory. The first track data list of the interval and the second track data list of the second track interval, and the calculation of the traffic feature overlap ratio between the first track data list and the second track data list, specifically including:

List the first description information of the flow change trajectory corresponding to the previous period and the second description information of the flow rate change trajectory corresponding to the current period, respectively, according to the flow change trajectory corresponding to the previous period and the current period corresponding to the flow change trajectory. The timing weight between the first description information and the second description information is integrated to obtain target description information; wherein, the target description information includes multiple first track identifiers and multiple second track identifiers;

determining a first offset weight between the track offset and each first track identifier and a second offset weight between the track offset and each second track identifier; according to the first offset weight and the The distribution sequence of the second offset weight determines the first trajectory interval and the second trajectory interval;

Determine a first interval parameter matrix corresponding to the first trajectory interval and a second interval parameter matrix corresponding to the second trajectory interval; wherein the first interval parameter matrix is used to represent the trajectory nodes of the first trajectory interval The distribution of the second interval parameter matrix is used to represent the distribution of the trajectory nodes in the second trajectory interval; respectively extract the first matrix discrete values of the first interval parameter matrix and the second interval parameter matrix The second matrix discrete value, according to the first matrix discrete value and the second matrix discrete value, respectively extract the first trajectory data list and the second track data list;

determining a traffic list queue generated according to the first track data list and the second track data list; for the current traffic list queue in the traffic list queue, based on the first traffic list queue of the current traffic list queue in the previous period The queue change frequency and the second queue change frequency of each of the traffic list queues within the current time period, determine the third queue change frequency of the current traffic list queue between the previous time period and the current time period; The change frequency of the three queues and the number of the traffic list queues are used to calculate the traffic feature overlap ratio between the first trajectory data list and the second trajectory data list.

Optionally, the state parameter of the target terminal device in the current period is determined by the track offset, a dynamic security policy is generated according to the state parameter, and the dynamic security policy is issued to the target terminal device , including:

Based on the obtained offset evaluation factor and the trajectory continuity factor used to characterize the confidence of the trajectory offset, determine the label script files of multiple identification labels to be marked for identifying the state parameters of the target terminal device, and different Identify the similarity between tags;

Mark the multiple identification tags based on the determined tag script files of the multiple identification tags and the similarity between different identification tags, so that the file response corresponding to the marked tag script files of the identification tags is time-consuming is less than the first set value, and marks that the similarity between the identification tags is greater than the second set value;

According to the marked identification tag, the state parameters of the target terminal device in the current period are extracted from the operation log of the target terminal device; the state parameters are divided into multiple parameter segments according to the time sequence, and each parameter is determined. The traffic processing indicator information corresponding to the segment; wherein, the traffic processing indicator information is used to characterize the throughput and the maximum traffic carrying capacity of the target terminal device;

Determine the event behavior characteristics of the DDos attack corresponding to each group of traffic processing index information, and generate a target security policy according to the event behavior characteristics and the throughput and maximum traffic carrying capacity of the corresponding traffic processing index information; corresponding to the target security policy The time sequence feature of the event behavior feature encapsulates the target security policy as the dynamic security policy.

Secondly, a big data platform is provided, the big data platform communicates with terminal equipment, and the big data platform is used for:

When receiving the authorization instruction fed back by the target terminal device based on the traffic detection request sent by the big data platform, establish a traffic detection channel corresponding to the target terminal device through the device interface parameters carried in the authorization instruction;

Collect real-time network traffic of the target terminal device through the traffic detection channel, and draw a traffic curve corresponding to the target terminal device based on the real-time network traffic;

Periodically determine multiple groups of flow change trajectories of the target terminal device based on the flow curve, and calculate the trajectory offset between the flow change trajectory corresponding to the current period and the flow change trajectory corresponding to the previous period;

When it is determined according to the track offset that the target terminal device is subject to a DDoS attack, the state parameter of the target terminal device in the current period is determined by the track offset, and according to the state parameter A dynamic security policy is generated and delivered to the target terminal device, so that the target terminal device determines and destroys abnormal requests in pending requests based on the dynamic security policy.

Optionally, the big data platform judging whether the target terminal device suffers from a distributed denial of service attack specifically includes:

Determine whether the trajectory offset is lower than the set threshold;

When the trajectory offset is lower than the set threshold, the flow change trajectory corresponding to the previous period is superimposed on the flow rate change trajectory corresponding to the current period; the flow rate change trajectory corresponding to the current period and the flow rate change corresponding to the next period are calculated The correlation coefficient of the trajectory features between the trajectories; if the correlation coefficient is greater than the set coefficient, it is determined that the target terminal device has suffered a distributed denial of service attack;

When the trajectory offset is greater than or equal to the set threshold, determine the first trajectory interval corresponding to the trajectory offset in the flow change trajectory corresponding to the previous period and in the flow rate change trajectory corresponding to the current period. the second track interval of If the traffic feature overlap ratio is greater than the set ratio, it is determined that the target terminal device suffers from a distributed denial of service attack.

Then a big data platform is provided, including a processor and a memory in communication with each other, the processor implements the above method by running a computer program retrieved from the memory.

Finally, a computer-readable storage medium is provided on which a computer program is stored, and the computer program implements the above method when running.

The network traffic anomaly detection method and big data platform applied to the industrial Internet provided by the embodiments of the present invention can establish a traffic detection channel corresponding to the target terminal device through the device interface parameters carried in the authorization instruction, and collect the target terminal through the traffic detection channel. The real-time network traffic of the device is used to draw the traffic curve corresponding to the target terminal device, and then periodically based on the traffic curve, multiple groups of traffic change trajectories of the target terminal device are determined, and the trajectory offset between the traffic change trajectories in different time periods is calculated. Finally, when it is determined that the target terminal device is subject to a DDoS attack according to the trajectory offset, the state parameters of the target terminal device in the current period are determined, and a dynamic security policy is generated according to the state parameters and sent to the target terminal device. In this way, the target terminal device can determine the abnormal request in the pending request based on the dynamic security policy and destroy it. In this way, it can avoid the paralysis of the target terminal equipment and ensure the safe and reliable operation of the entire industrial Internet control system.

Description of drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the application and together with the description serve to explain the principles of the application.

FIG. 1 is a flow chart of a network traffic anomaly detection method applied to the Industrial Internet.

FIG. 2 is a block diagram of an embodiment of a network traffic anomaly detection apparatus applied to the Industrial Internet.

FIG. 3 is a schematic diagram of a communication architecture of a network traffic anomaly detection system applied to the Industrial Internet.

Figure 4 is a hardware structure diagram of the big data platform.

Detailed ways

In practical application, the inventor analyzed the distance of DDoS attack, and found that the DDoS attack method is to send a large amount of useless information to the terminal device within a period of time, which will occupy large-scale The resources of the terminal equipment make the terminal equipment unable to be used normally or paralyzed. Further, the inventor also found that when the terminal device receives a large amount of useless information that needs to be processed, the information flow of the terminal device will change significantly.

The defects of the above solutions in the prior art are the results obtained by the inventor after practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed in the following embodiments of the present invention for the above problems , should be the contributions made by the inventor to the present invention in the process of the present invention.

To this end, the embodiments of the present invention provide a network traffic anomaly detection method and a big data platform applied to the Industrial Internet, which can detect and analyze the real-time network traffic of the terminal device, so as to determine whether the terminal device suffers from a DDos attack, and determine whether the terminal device is under DDos attack. After the terminal device is attacked by DDos, dynamic security policies for different stages of the DDos attack are generated and issued to the terminal device, which can avoid the paralysis of the terminal device and ensure the safe and reliable operation of the entire industrial Internet control system.

The following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but is merely representative of selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

1 is a schematic flowchart of a network traffic abnormality detection method applied to the Industrial Internet provided by an embodiment of the present invention. The network traffic abnormality detection method can be applied to a big data platform that communicates with multiple terminal devices. The big data platform The above-mentioned network traffic abnormality detection method is implemented by executing the following steps S110-S140 during operation.

Step S110, when receiving the authorization instruction fed back by the target terminal device based on the traffic detection request sent by the big data platform, establish a traffic detection channel corresponding to the target terminal device through the device interface parameters carried in the authorization instruction .

In this embodiment, the big data platform first sends a traffic detection request to each terminal device. The terminal device verifies whether the traffic detection request is legal, and when verifying the legality, feeds back an authorization instruction carrying the device interface parameters to the big data platform.

The big data platform establishes different traffic detection channels through different device interface parameters, which can avoid mutual interference between traffic detection channels, thereby ensuring the accuracy and reliability of traffic detection for each terminal device.

Step S120: Collect real-time network traffic of the target terminal device through the traffic detection channel, and draw a traffic curve corresponding to the target terminal device based on the real-time network traffic.

In a possible implementation manner, the real-time network traffic includes first network traffic received by the target terminal device and second network traffic sent by the target terminal device.

Step S130: Periodically determine multiple sets of flow change trajectories of the target terminal device based on the flow curve, and calculate the track offset between the flow change trajectory corresponding to the current period and the flow change trajectory corresponding to the previous period.

In actual implementation, the flow change trajectory can be represented by graph data. The graph data includes graph nodes and graph connections, the graph nodes are used to encapsulate characteristic data of the flow curve, and the graph connections are used to connect multiple graph nodes.

Step S140, when it is determined that the target terminal device suffers from a DDoS attack according to the trajectory offset, the state parameter of the target terminal device in the current period is determined by the trajectory offset, and according to the The state parameter generates a dynamic security policy and delivers the dynamic security policy to the target terminal device, so that the target terminal device determines and destroys abnormal requests in pending requests based on the dynamic security policy.

Specifically, the operating parameters include network protocol parameters of the target terminal device, encryption key parameters, request queue configuration parameters, and the like. The dynamic security policy includes script files for anomaly detection for requests in different time periods. Abnormal requests can be understood as a large number of invalid requests corresponding to distributed denial of service attacks that need to be processed by the target terminal device.

By implementing the content described in the above steps S110-S140, a traffic detection channel corresponding to the target terminal device can be established through the device interface parameters carried in the authorization instruction, and the real-time network traffic of the target terminal device can be collected through the traffic detection channel to draw the target. The flow curve corresponding to the terminal device, and then periodically determine the multiple sets of flow change trajectories of the target terminal device based on the flow curve, and calculate the trajectory offset between the flow change trajectories in different time periods, and finally determine the trajectory according to the offset. When the target terminal device is subjected to a distributed denial of service attack, the state parameters of the target terminal device in the current period are determined, and a dynamic security policy is generated according to the state parameters and delivered to the target terminal device. In this way, the target terminal device can determine the abnormal request in the pending request based on the dynamic security policy and destroy it. In this way, it can avoid the paralysis of the target terminal equipment and ensure the safe and reliable operation of the entire industrial Internet control system.

When implementing the above solution, the inventor finds that when the judgment of the distributed denial of service attack is performed according to the trajectory offset, the phenomenon of omission of judgment may occur. After researching and analyzing the phenomenon of missed judgment, the inventor came to the following reasons: the iterative nature of the flow change trajectories in the continuous period was not taken into account, which would lead to the lack of flow characteristics between the flow change trajectories in the continuous period. , thus affecting the accuracy of the judgment. In order to improve the above-mentioned problem, in step S140, whether the target terminal device is subjected to a distributed denial of service attack can be exemplarily determined by the method described in the following steps S1411-S1413.

In step S1411, it is judged whether the track offset is lower than the set threshold, if yes, go to step S1412, if not, go to step S1413.

Step S1412, when the trajectory offset is lower than the set threshold, superimpose the flow change trajectory corresponding to the previous period to the flow rate change trajectory corresponding to the current period, and calculate the flow rate change trajectory corresponding to the current period and the next period. Correlation coefficients of trajectory features between corresponding traffic change trajectories, if the correlation coefficient is greater than the set coefficient, it is determined that the target terminal device has suffered a distributed denial of service attack.

Step S1413, when the trajectory offset is greater than or equal to the set threshold, determine the first trajectory interval corresponding to the trajectory offset in the flow change trajectory corresponding to the previous period and the flow change corresponding to the current period The corresponding second trajectory interval in the trajectory; extract the first trajectory data list of the first trajectory interval and the second trajectory data list of the second trajectory interval, and calculate the first trajectory data list and the second trajectory The traffic feature overlap ratio between the data lists. If the traffic feature overlap ratio is greater than the set ratio, it is determined that the target terminal device has suffered a distributed denial of service attack.

It can be understood that, based on the above steps S1411-S1413, the iteration and superposition of the flow change trajectories in continuous periods can be taken into account, which can ensure that there will be no missing flow characteristics between the flow change trajectories in continuous periods, Thus, the judgment accuracy of distributed denial of service attacks is ensured.

During the specific implementation, in order to ensure the one-to-one correspondence of the traffic packets on the traffic protocol addresses when the traffic change trajectories in different time periods are superimposed, so as to accurately determine the correlation coefficient of the trajectory characteristics of the traffic change trajectories in different time periods, the steps Described in S1412, the flow change trajectory corresponding to the previous period is superimposed on the flow rate change trajectory corresponding to the current period, and the correlation of the trajectory characteristics between the flow rate change trajectory corresponding to the current period and the flow rate change trajectory corresponding to the next period is calculated The coefficient may specifically include the content described in the following steps a to e.

Step a, generating a first traffic protocol address list corresponding to the traffic change track corresponding to the previous time period and used to represent the packet information of the traffic packets corresponding to the traffic change track corresponding to the previous time period, and for representing the traffic change corresponding to the current time period. A second flow protocol address list of the packet information of the traced flow packets; wherein the first flow protocol address list and the second flow protocol address list respectively include the same number of multiple list units, and each The unit identification degrees of the list units are different, and the unit identification degrees are used to represent the association degree of the list features of the list units.

Step b, extracting a protocol address path corresponding to one of the list units from the first traffic protocol address list corresponding to the traffic change track corresponding to the previous period; wherein, when determining the protocol address path, the current period corresponds to the current period in parallel. The list unit with the largest unit identification degree in the address list of the second traffic protocol corresponding to the traffic change track of , is determined as the reference list unit.

Step c, mapping the protocol address path to the reference list unit and determining the mapped address path of the protocol address path in the reference list unit; determining the mapped address path and the protocol address path A directed acyclic graph between the first traffic protocol address list and the second traffic protocol address list for representing the correspondence between traffic protocol addresses.

Step d, based on the directed acyclic graph used to characterize the correspondence of the traffic protocol addresses, superimpose each group of first traffic trajectory parameters in the traffic change trajectory corresponding to the previous period to the flow rate change trajectory corresponding to the current period. in the corresponding second flow trajectory parameter group.

Step e, if each group of first traffic trajectory parameters has a unique corresponding protocol signature in its corresponding second traffic trajectory parameter group, then according to the protocol signature, the traffic change trajectory corresponding to the current period and the traffic corresponding to the next period are compared. The numerical queues corresponding to the trajectory features between the change trajectories are weighted, and the median of the weighted numerical queues is calculated as the correlation of the trajectory characteristics between the traffic change trajectory corresponding to the current period and the traffic change trajectory corresponding to the next period Sex coefficient.

Step f, if each group of first traffic trajectory parameters does not have a unique corresponding protocol signature in its corresponding second traffic trajectory parameter group, return the directed acyclic graph according to the corresponding relationship used to represent the traffic protocol addresses The step of superimposing each group of flow track parameters in the flow change track corresponding to the previous time period to the corresponding second flow track parameter group in the flow change track corresponding to the current time period.

When applying the content described in the above steps a to f, it can ensure that the traffic change trajectories in different time periods have a one-to-one correspondence between the traffic packets and the traffic protocol addresses when they are superimposed, so as to accurately determine the traffic change trajectories in different time periods. The correlation coefficient of the trajectory features.

In a possible implementation manner, the step S1413 described in determining the first track interval corresponding to the track offset in the flow change track corresponding to the previous period and the second track interval corresponding to the flow change track corresponding to the current period Track section, extracting the first track data list of the first track section and the second track data list of the second track section, and calculating the flow between the first track data list and the second track data list The feature overlap rate may specifically include the content described in the following steps (1)-(4).

(1) List the first description information of the flow change trajectory corresponding to the previous period and the second description information of the flow rate change trajectory corresponding to the current period, respectively. The time sequence weight between the traffic change tracks integrates the first description information and the second description information to obtain target description information; wherein, the target description information includes multiple first track identifiers and multiple second track identifiers.

(2) Determine the first offset weight between the track offset and each first track identifier and the second offset weight between the track offset and each second track identifier; according to the first offset weight and the distribution sequence of the second offset weights to determine the first trajectory interval and the second trajectory interval.

(3) Determine a first interval parameter matrix corresponding to the first trajectory interval and a second interval parameter matrix corresponding to the second trajectory interval; wherein, the first interval parameter matrix is used to represent the first trajectory interval The distribution of the trajectory nodes of the first interval, the second interval parameter matrix is used to represent the distribution of the trajectory nodes of the second trajectory interval; respectively extract the first matrix discrete values of the first interval parameter matrix and the second interval parameter matrix. A second matrix discrete value of the interval parameter matrix, and the first trajectory is extracted from the first interval parameter matrix and the second interval parameter matrix according to the first matrix discrete value and the second matrix discrete value, respectively A data list and the second trajectory data list.

(4) Determine the traffic list queue generated according to the first track data list and the second track data list; for the current traffic list queue in the traffic list queue, based on the current traffic list queue within the previous period of time The first queue change frequency and the second queue change frequency of each of the traffic list queues within the current time period, determine the third queue change frequency of the current traffic list queue between the previous time period and the current time period; based on The frequency of change of the third queue and the number of the traffic list queues are used to calculate a traffic feature overlap ratio between the first trajectory data list and the second trajectory data list.

It can be understood that through the above steps (1) to (4), the traffic feature overlap rate between the first track data list and the second track data list can be accurately calculated, thereby improving the accuracy of judging and detecting DDos attacks. .

In the specific implementation process, in order to ensure that the target terminal device can cope with the DDos attack, it is necessary to specify different dynamic security policies for the target terminal device to use according to the event behavior characteristics of the DDos attack. Determining the state parameters of the target terminal device in the current period of time by the shift amount, generating a dynamic security policy according to the state parameters and issuing the dynamic security policy to the target terminal device, exemplarily including the following step S1421 - the content described in step S1424.

Step S1421, based on the obtained offset evaluation factor and the trajectory continuity factor used to characterize the confidence of the trajectory offset, determine the label script file of multiple identification labels to be marked for identifying the state parameters of the target terminal device , and the similarity between different identification labels.

Step S1422, marking the multiple identification tags based on the determined tag script files of the multiple identification tags and the similarity between different identification tags, so that the files corresponding to the marked tag script files of the identification tags are marked. The response time is less than the first set value, and the similarity between the marked identification tags is greater than the second set value.

Step S1423, according to the marked identification tag, extract the state parameter of the target terminal device in the current period from the operation log of the target terminal device; divide the state parameter into multiple parameter segments according to the time sequence, and determine Traffic processing indicator information corresponding to each parameter segment; wherein, the traffic processing indicator information is used to represent the throughput and maximum traffic carrying capacity of the target terminal device.

Step S1424: Determine the event behavior characteristics of the DDos attack corresponding to each group of traffic processing index information, and generate a target security policy according to the event behavior characteristics and the throughput and maximum traffic carrying capacity of the event behavior characteristics and corresponding traffic processing index information; The time sequence feature of the event behavior feature corresponding to the security policy encapsulates the target security policy as the dynamic security policy.

In specific implementation, by executing the content described in the above steps S1421-S1424, different dynamic security policies can be specified for the target terminal device according to the event behavior characteristics of the DDos attack, thereby ensuring that the target terminal device can cope with the DDos attack.

In an alternative implementation manner, the establishment of a traffic detection channel corresponding to the target terminal device through the device interface parameters carried in the authorization instruction described in step S110 may specifically include the following steps S111-S113. Content.

Step S111: Acquire data forwarding logic information corresponding to the device interface parameters, perform channel parameter extraction on the data forwarding logic information, and obtain a channel parameter package including a channel key character and a bandwidth frequency band corresponding to the channel key character.

Step S112: Generate a first check random number based on the channel key character and the bandwidth frequency band, and insert the first check random number into the channel parameter package to obtain a target parameter package.

Step S113: Send the target parameter packet to the target terminal device to obtain a second verification random number fed back by the target terminal device for verifying the channel parameter packet based on the first verification random number , and when the first verification random number and the second verification random number are equal, according to the channel key character, the bandwidth frequency band, the first verification random number and the second verification random number The random number establishes a traffic detection channel corresponding to the target terminal device.

Exemplarily performing the above steps S111-S113, different traffic detection channels can be established with different device interface parameters, thereby avoiding mutual interference between traffic detection channels and ensuring the accuracy and reliability of traffic detection for each terminal device .

Further, the drawing of the traffic curve corresponding to the target terminal device based on the real-time network traffic described in step S120 may specifically include the content described in the following steps S121-S123.

Step S121: Divide the real-time network traffic into first network traffic and second network traffic.

Step S122, plot points in a preset coordinate plane according to the flow values of the first network traffic and the second network traffic at the same time, to obtain a first plot point set corresponding to the first network traffic and the first plotted point set. The second set of delineation points corresponding to the network traffic.

Step S123: Fitting the first trace point set and the second trace point set based on the traffic priorities of the first network traffic and the second network traffic at the same time to obtain a traffic curve.

Through the above steps S121-S123, the first network traffic received by the target terminal device and the second network traffic sent by the target terminal device can be taken into account, so that the traffic curve can be completely determined.

Further, step S130 periodically determines multiple groups of flow change trajectories of the target terminal device based on the flow curve, and calculates the difference between the flow change trajectories corresponding to the current period and the flow change trajectories corresponding to the previous period. The track offset can be specifically implemented through the content described in the following steps S131 and S132.

Step S131: Determine multiple groups of flow change trajectories of the target terminal device from the flow curve according to a set time step.

Step S132: Determine the track offset according to the weighted sum of the sequence differences between the first flow value sequence of the flow change track corresponding to the current time period and the second flow value sequence of the flow change track corresponding to the previous time period.

By executing the content described in the above steps S131-S132, the track offset between the flow change track corresponding to the current time period and the flow change track corresponding to the previous time period can be accurately determined.

Based on the same inventive concept described above, please refer to FIG. 2 , a network traffic anomaly detection device 200 applied to the Industrial Internet is provided, applied to a big data platform, the device includes:

The channel establishment module 210 is configured to, when receiving the authorization instruction fed back by the target terminal device based on the traffic detection request sent by the big data platform, establish a corresponding connection with the target terminal device through the device interface parameters carried in the authorization instruction flow detection channel;

A traffic collection module 220, configured to collect real-time network traffic of the target terminal device through the traffic detection channel, and draw a traffic curve corresponding to the target terminal device based on the real-time network traffic;

A trajectory determination module 230, configured to periodically determine multiple groups of flow change trajectories of the target terminal device based on the flow curve, and calculate a trajectory between the flow change trajectory corresponding to the current period and the flow change trajectory corresponding to the previous period Offset;

The policy issuing module 240 is configured to determine, according to the trajectory offset, that the target terminal device is subject to a distributed denial of service attack, and determine the target terminal device's status in the current period by using the trajectory offset. state parameter, generate a dynamic security policy according to the state parameter and issue the dynamic security policy to the target terminal device, so that the target terminal device determines the abnormal request in the pending requests based on the dynamic security policy and destroy.

Optionally, the policy issuing module 240 is specifically configured to:

Determine whether the trajectory offset is lower than the set threshold;

When the trajectory offset is lower than the set threshold, superimposing the flow change trajectory corresponding to the previous period to the flow rate change trajectory corresponding to the current period;

Calculate the correlation coefficient of the trajectory feature between the flow change trajectory corresponding to the current period and the flow change trajectory corresponding to the next period;

If the correlation coefficient is greater than the set coefficient, it is determined that the target terminal device suffers from a distributed denial of service attack.

Optionally, the policy issuing module 240 is further specifically configured to:

When the trajectory offset is greater than or equal to the set threshold, determine the first trajectory interval corresponding to the trajectory offset in the flow change trajectory corresponding to the previous period and in the flow rate change trajectory corresponding to the current period. The second trajectory interval of ;

Extracting the first track data list of the first track section and the second track data list of the second track section, and calculating the traffic feature overlap ratio between the first track data list and the second track data list ;

If the traffic feature overlap ratio is greater than a set ratio, it is determined that the target terminal device suffers from a distributed denial of service attack.

Optionally, the policy issuing module 240 is further specifically configured to:

Generate a first traffic protocol address list corresponding to the traffic change track corresponding to the previous time period and used to represent the packet information of the traffic packets corresponding to the traffic change track corresponding to the previous time period, and the traffic used to represent the traffic change track corresponding to the current time period. The second flow protocol address list of the message information of the message; wherein, the first flow protocol address list and the second flow protocol address list respectively include the same number of multiple list units, and the number of each list unit is The unit recognition degrees are different, and the unit recognition degrees are used to represent the degree of association of the list features of the list units;

A protocol address path corresponding to one of the list units is extracted from the first traffic protocol address list corresponding to the traffic change track corresponding to the previous period; wherein, when determining the protocol address path, the traffic corresponding to the current period is changed in parallel The list unit with the largest unit identification degree in the second traffic protocol address list corresponding to the track is determined as the reference list unit;

Map the protocol address path into the reference list unit and determine the mapped address path of the protocol address path in the reference list unit; determine the first address path through the mapped address path and the protocol address path A directed acyclic graph used to characterize the correspondence between a traffic protocol address list and the second traffic protocol address list;

Based on the directed acyclic graph for characterizing the correspondence between traffic protocol addresses, each group of first traffic trajectory parameters in the traffic change trajectory corresponding to the previous period is superimposed on the corresponding first traffic trajectory parameter in the traffic change trajectory corresponding to the current period. In the second flow trajectory parameter group;

If each group of first traffic trajectory parameters has a unique corresponding protocol signature in its corresponding second traffic trajectory parameter group, then according to the protocol signature, the difference between the traffic change trajectory corresponding to the current period and the traffic change trajectory corresponding to the next period is calculated. The numerical queues corresponding to the trajectory characteristics of the interval are weighted, and the median of the weighted numerical queues is calculated as the correlation coefficient of the trajectory characteristics between the traffic change trajectory corresponding to the current period and the traffic change trajectory corresponding to the next period;

If each group of first traffic trajectory parameters does not have a unique corresponding protocol signature in its corresponding second traffic trajectory parameter group, return the directed acyclic graph used to represent the correspondence between the traffic protocol addresses and the previous The step of superimposing each group of flow track parameters in the flow rate change track corresponding to the time period to the corresponding second flow track parameter group in the flow rate change track corresponding to the current time period.

Optionally, the policy issuing module 240 is further specifically configured to:

List the first description information of the flow change trajectory corresponding to the previous period and the second description information of the flow rate change trajectory corresponding to the current period, respectively, according to the flow change trajectory corresponding to the previous period and the current period corresponding to the flow change trajectory. The timing weight between the first description information and the second description information is integrated to obtain target description information; wherein, the target description information includes multiple first track identifiers and multiple second track identifiers;

determining a first offset weight between the track offset and each first track identifier and a second offset weight between the track offset and each second track identifier; according to the first offset weight and the The distribution sequence of the second offset weight determines the first trajectory interval and the second trajectory interval;

Determine a first interval parameter matrix corresponding to the first trajectory interval and a second interval parameter matrix corresponding to the second trajectory interval; wherein the first interval parameter matrix is used to represent the trajectory nodes of the first trajectory interval The distribution of the second interval parameter matrix is used to represent the distribution of the trajectory nodes in the second trajectory interval; respectively extract the first matrix discrete values of the first interval parameter matrix and the second interval parameter matrix The second matrix discrete value, according to the first matrix discrete value and the second matrix discrete value, respectively extract the first trajectory data list and the second track data list;

determining a traffic list queue generated according to the first track data list and the second track data list; for the current traffic list queue in the traffic list queue, based on the first traffic list queue of the current traffic list queue in the previous period The queue change frequency and the second queue change frequency of each of the traffic list queues within the current time period, determine the third queue change frequency of the current traffic list queue between the previous time period and the current time period; The change frequency of the three queues and the number of the traffic list queues are used to calculate the traffic feature overlap ratio between the first trajectory data list and the second trajectory data list.

Optionally, the policy issuing module 240 is further specifically configured to:

Based on the obtained offset evaluation factor and the trajectory continuity factor used to characterize the confidence of the trajectory offset, determine the label script files of multiple identification labels to be marked for identifying the state parameters of the target terminal device, and different Identify the similarity between tags;

Mark the multiple identification tags based on the determined tag script files of the multiple identification tags and the similarity between different identification tags, so that the file response corresponding to the marked tag script files of the identification tags is time-consuming is less than the first set value, and marks that the similarity between the identification tags is greater than the second set value;

According to the marked identification tag, the state parameters of the target terminal device in the current period are extracted from the operation log of the target terminal device; the state parameters are divided into multiple parameter segments according to the time sequence, and each parameter is determined. The traffic processing indicator information corresponding to the segment; wherein, the traffic processing indicator information is used to characterize the throughput and the maximum traffic carrying capacity of the target terminal device;

Determine the event behavior characteristics of the DDos attack corresponding to each group of traffic processing index information, and generate a target security policy according to the event behavior characteristics and the throughput and maximum traffic carrying capacity of the corresponding traffic processing index information; corresponding to the target security policy The time sequence feature of the event behavior feature encapsulates the target security policy as the dynamic security policy.

Optionally, the flow collection module 220 is used for:

dividing the real-time network traffic into a first network traffic and a second network traffic;

According to the flow values of the first network flow and the second network flow at the same time, plot points in a preset coordinate plane to obtain a first plot point set corresponding to the first network flow and the second network flow the corresponding second drawing point set;

A traffic curve is obtained by fitting the first plot point set and the second plot point set based on the traffic priorities of the first network traffic and the second network traffic at the same time.

Optionally, the trajectory determination module 230 is configured to:

Determine multiple groups of flow change trajectories of the target terminal device from the flow curve according to a set time step;

The track offset is determined according to the weighted sum of the sequence differences between the first flow value sequence of the flow change track corresponding to the current period and the second flow value sequence of the flow change track corresponding to the previous period.

For a detailed description of the above modules, please refer to the description of the method shown in FIG. 1 , and no further description is given here.

Based on the same inventive concept described above, please refer to FIG. 3 , a network traffic anomaly detection system 300 applied to the Industrial Internet is provided, and the system includes a big data platform 400 and a terminal device 500 that communicate with each other;

The big data platform 400 is used for:

When receiving the authorization instruction fed back by the target terminal device based on the traffic detection request sent by the big data platform, establish a traffic detection channel corresponding to the target terminal device through the device interface parameters carried in the authorization instruction;

Collect real-time network traffic of the target terminal device through the traffic detection channel, and draw a traffic curve corresponding to the target terminal device based on the real-time network traffic;

Periodically determine multiple groups of flow change trajectories of the target terminal device based on the flow curve, and calculate the trajectory offset between the flow change trajectory corresponding to the current period and the flow change trajectory corresponding to the previous period;

When it is determined according to the track offset that the target terminal device is subject to a DDoS attack, the state parameter of the target terminal device in the current period is determined by the track offset, and according to the state parameter generating a dynamic security policy and delivering the dynamic security policy to the target terminal device;

The target terminal equipment is used for:

An abnormal request in the pending request is determined and destroyed based on the dynamic security policy.

Optionally, the big data platform 400 is specifically used for:

Determine whether the trajectory offset is lower than the set threshold;

When the trajectory offset is lower than the set threshold, superimposing the flow change trajectory corresponding to the previous period to the flow rate change trajectory corresponding to the current period;

Calculate the correlation coefficient of the trajectory feature between the flow change trajectory corresponding to the current period and the flow change trajectory corresponding to the next period;

If the correlation coefficient is greater than the set coefficient, it is determined that the target terminal device suffers from a distributed denial of service attack.

Optionally, the big data platform 400 is further specifically used for:

When the trajectory offset is greater than or equal to the set threshold, determine the first trajectory interval corresponding to the trajectory offset in the flow change trajectory corresponding to the previous period and in the flow rate change trajectory corresponding to the current period. The second trajectory interval of ;

Extracting the first track data list of the first track section and the second track data list of the second track section, and calculating the traffic feature overlap ratio between the first track data list and the second track data list ;

If the traffic feature overlap ratio is greater than a set ratio, it is determined that the target terminal device suffers from a distributed denial of service attack.

Optionally, the big data platform 400 is further specifically used for:

Generate a first traffic protocol address list corresponding to the traffic change track corresponding to the previous time period and used to represent the packet information of the traffic packets corresponding to the traffic change track corresponding to the previous time period, and the traffic used to represent the traffic change track corresponding to the current time period. The second flow protocol address list of the message information of the message; wherein, the first flow protocol address list and the second flow protocol address list respectively include the same number of multiple list units, and the number of each list unit is The unit recognition degrees are different, and the unit recognition degrees are used to represent the degree of association of the list features of the list units;

A protocol address path corresponding to one of the list units is extracted from the first traffic protocol address list corresponding to the traffic change track corresponding to the previous period; wherein, when determining the protocol address path, the traffic corresponding to the current period is changed in parallel The list unit with the largest unit identification degree in the second traffic protocol address list corresponding to the track is determined as the reference list unit;

Map the protocol address path into the reference list unit and determine the mapped address path of the protocol address path in the reference list unit; determine the first address path through the mapped address path and the protocol address path A directed acyclic graph used to characterize the correspondence between a traffic protocol address list and the second traffic protocol address list;

Based on the directed acyclic graph for characterizing the correspondence between traffic protocol addresses, each group of first traffic trajectory parameters in the traffic change trajectory corresponding to the previous period is superimposed on the corresponding first traffic trajectory parameter in the traffic change trajectory corresponding to the current period. In the second flow trajectory parameter group;

If each group of first traffic trajectory parameters has a unique corresponding protocol signature in its corresponding second traffic trajectory parameter group, then according to the protocol signature, the difference between the traffic change trajectory corresponding to the current period and the traffic change trajectory corresponding to the next period is calculated. The numerical queues corresponding to the trajectory characteristics of the interval are weighted, and the median of the weighted numerical queues is calculated as the correlation coefficient of the trajectory characteristics between the traffic change trajectory corresponding to the current period and the traffic change trajectory corresponding to the next period;

If each group of first traffic trajectory parameters does not have a unique corresponding protocol signature in its corresponding second traffic trajectory parameter group, return the directed acyclic graph used to represent the correspondence between the traffic protocol addresses and the previous The step of superimposing each group of flow track parameters in the flow rate change track corresponding to the time period to the corresponding second flow track parameter group in the flow rate change track corresponding to the current time period.

Optionally, the big data platform 400 is further specifically used for:

List the first description information of the flow change trajectory corresponding to the previous period and the second description information of the flow rate change trajectory corresponding to the current period, respectively, according to the flow change trajectory corresponding to the previous period and the current period corresponding to the flow change trajectory. The timing weight between the first description information and the second description information is integrated to obtain target description information; wherein, the target description information includes multiple first track identifiers and multiple second track identifiers;

determining a first offset weight between the track offset and each first track identifier and a second offset weight between the track offset and each second track identifier; according to the first offset weight and the The distribution sequence of the second offset weight determines the first trajectory interval and the second trajectory interval;

Determine a first interval parameter matrix corresponding to the first trajectory interval and a second interval parameter matrix corresponding to the second trajectory interval; wherein the first interval parameter matrix is used to represent the trajectory nodes of the first trajectory interval The distribution of the second interval parameter matrix is used to represent the distribution of the trajectory nodes in the second trajectory interval; respectively extract the first matrix discrete values of the first interval parameter matrix and the second interval parameter matrix The second matrix discrete value, according to the first matrix discrete value and the second matrix discrete value, respectively extract the first trajectory data list and the second track data list;

determining a traffic list queue generated according to the first track data list and the second track data list; for the current traffic list queue in the traffic list queue, based on the first traffic list queue of the current traffic list queue in the previous period The queue change frequency and the second queue change frequency of each of the traffic list queues within the current time period, determine the third queue change frequency of the current traffic list queue between the previous time period and the current time period; The change frequency of the three queues and the number of the traffic list queues are used to calculate the traffic feature overlap ratio between the first trajectory data list and the second trajectory data list.

Optionally, the big data platform 400 is further specifically used for:

Based on the obtained offset evaluation factor and the trajectory continuity factor used to characterize the confidence of the trajectory offset, determine the label script files of multiple identification labels to be marked for identifying the state parameters of the target terminal device, and different Identify the similarity between tags;

Mark the multiple identification tags based on the determined tag script files of the multiple identification tags and the similarity between different identification tags, so that the file response corresponding to the marked tag script files of the identification tags is time-consuming is less than the first set value, and marks that the similarity between the identification tags is greater than the second set value;

According to the marked identification tag, the state parameters of the target terminal device in the current period are extracted from the operation log of the target terminal device; the state parameters are divided into multiple parameter segments according to the time sequence, and each parameter is determined. The traffic processing indicator information corresponding to the segment; wherein, the traffic processing indicator information is used to characterize the throughput and the maximum traffic carrying capacity of the target terminal device;

Determine the event behavior characteristics of the DDos attack corresponding to each group of traffic processing index information, and generate a target security policy according to the event behavior characteristics and the throughput and maximum traffic carrying capacity of the corresponding traffic processing index information; corresponding to the target security policy The time sequence feature of the event behavior feature encapsulates the target security policy as the dynamic security policy.

Optionally, the big data platform 400 is used for:

dividing the real-time network traffic into a first network traffic and a second network traffic;

According to the flow values of the first network flow and the second network flow at the same time, plot points in a preset coordinate plane to obtain a first plot point set corresponding to the first network flow and the second network flow the corresponding second drawing point set;

A traffic curve is obtained by fitting the first plot point set and the second plot point set based on the traffic priorities of the first network traffic and the second network traffic at the same time.

Optionally, the big data platform 400 is used for:

Determine multiple groups of flow change trajectories of the target terminal device from the flow curve according to a set time step;

The track offset is determined according to the weighted sum of the sequence differences between the first flow value sequence of the flow change track corresponding to the current period and the second flow value sequence of the flow change track corresponding to the previous period.

For a detailed description of the above system, please refer to the description of the method shown in FIG. 1 , and no further description will be given here.

On the basis of the above system, as shown in FIG. 4 , a schematic diagram of the hardware structure of a big data platform 400 is also provided, including a processor 410 and a memory 420 that communicate with each other, and the processor 410 runs from the The computer program retrieved in the memory 420 implements the above-mentioned method.

Further, a computer-readable storage medium is provided, on which a computer program is stored, and the computer program implements the above method when running.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. A network flow abnormity detection method applied to an industrial Internet is characterized by being applied to a big data platform, and the method comprises the following steps:

when an authorization instruction fed back by a flow detection request sent by a target terminal device based on the big data platform is received, establishing a flow detection channel corresponding to the target terminal device through a device interface parameter carried in the authorization instruction;

acquiring real-time network traffic of the target terminal equipment through the traffic detection channel, and drawing a traffic curve corresponding to the target terminal equipment based on the real-time network traffic;

periodically determining a plurality of groups of flow change tracks of the target terminal equipment based on the flow curve, and calculating the track offset between the flow change track corresponding to the current time period and the flow change track corresponding to the previous time period;

when the target terminal equipment is judged to be attacked by the distributed denial of service according to the track offset, determining the state parameters of the target terminal equipment in the current time period through the track offset, generating a dynamic security policy according to the state parameters and issuing the dynamic security policy to the target terminal equipment so that the target terminal equipment determines the abnormal request in the request to be processed based on the dynamic security policy and destroys the abnormal request.

2. The method for detecting network traffic anomaly according to claim 1, wherein determining whether a target terminal device is under a distributed denial of service attack specifically comprises:

judging whether the track offset is lower than a set threshold value or not;

when the track offset is lower than a set threshold value, the flow change track corresponding to the previous time period is superposed to the flow change track corresponding to the current time period;

calculating a correlation coefficient of track characteristics between a flow change track corresponding to a current period and a flow change track corresponding to a next period;

and if the correlation coefficient is larger than a set coefficient, judging that the target terminal equipment is attacked by the distributed denial of service attack.

3. The method of detecting network traffic anomalies of claim 2, the method further comprising:

when the track offset is greater than or equal to the set threshold, determining a first track interval corresponding to the track offset in the flow change track corresponding to the last period and a second track interval corresponding to the flow change track corresponding to the current period;

extracting a first track data list of the first track interval and a second track data list of the second track interval, and calculating the flow characteristic overlapping rate between the first track data list and the second track data list;

and if the flow characteristic overlapping rate is greater than a set rate, judging that the target terminal equipment is attacked by the distributed denial of service.

4. The method according to claim 2, wherein the step of superimposing the traffic variation trajectory corresponding to the previous time period onto the traffic variation trajectory corresponding to the current time period and calculating a correlation coefficient of trajectory characteristics between the traffic variation trajectory corresponding to the current time period and the traffic variation trajectory corresponding to the next time period specifically includes:

generating a first traffic protocol address list corresponding to the traffic change track corresponding to the previous time period and used for representing message information of the traffic message of the traffic change track corresponding to the previous time period and a second traffic protocol address list corresponding to the message information of the traffic message of the traffic change track corresponding to the current time period; the first traffic protocol address list and the second traffic protocol address list respectively comprise a plurality of list units with the same number, the unit identification degree of each list unit is different, and the unit identification degree is used for representing the relevance degree of the list characteristics of the list units;

extracting a protocol address path corresponding to one list unit from a first flow protocol address list corresponding to a flow change track corresponding to the previous period; when the protocol address path is determined, determining a list unit with the maximum unit identification degree in a second flow protocol address list corresponding to the flow change track corresponding to the current time period in parallel as a reference list unit;

mapping the protocol address path to the reference list unit and determining a mapping address path of the protocol address path in the reference list unit; determining a directed acyclic graph used for representing the corresponding relation of traffic protocol addresses between the first traffic protocol address list and the second traffic protocol address list through the mapping address path and the protocol address path;

based on the directed acyclic graph for representing the corresponding relation of the traffic protocol addresses, superposing each group of first traffic track parameters in the traffic change tracks corresponding to the previous time period to corresponding second traffic track parameter groups in the traffic change tracks corresponding to the current time period;

if each group of first flow rate track parameters has a unique corresponding protocol signature in a corresponding second flow rate track parameter group, weighting a numerical value queue corresponding to track characteristics between a flow rate change track corresponding to a current time period and a flow rate change track corresponding to a next time period according to the protocol signature, and calculating the median of the weighted numerical value queue as a correlation coefficient of the track characteristics between the flow rate change track corresponding to the current time period and the flow rate change track corresponding to the next time period;

and if the unique corresponding protocol signature does not exist in the corresponding second flow trajectory parameter group of each group of first flow trajectory parameters, the step of superposing each group of flow trajectory parameters in the flow change trajectory corresponding to the previous time period to the corresponding second flow trajectory parameter group in the flow change trajectory corresponding to the current time period according to the directed acyclic graph for representing the corresponding relation of the flow protocol addresses is returned.

5. The method for detecting network traffic anomaly according to claim 3, wherein determining a first track interval corresponding to the track offset in the traffic change track corresponding to the previous period and a second track interval corresponding to the traffic change track corresponding to the current period, extracting a first track data list of the first track interval and a second track data list of the second track interval, and calculating a traffic feature overlap ratio between the first track data list and the second track data list specifically includes:

respectively listing first description information of a flow change track corresponding to a previous period and second description information of the flow change track corresponding to a current period, and integrating the first description information and the second description information according to a time sequence weight between the flow change track corresponding to the previous period and the flow change track corresponding to the current period to obtain target description information; the target description information comprises a plurality of first track identifications and a plurality of second track identifications;

determining a first offset weight between the track offset and each first track identification and a second offset weight between the track offset and each second track identification; determining the first track interval and the second track interval according to the distribution sequence of the first offset weight and the second offset weight;

determining a first interval parameter matrix corresponding to the first track interval and a second interval parameter matrix corresponding to the second track interval; the first interval parameter matrix is used for representing the distribution condition of the track nodes of the first track interval, and the second interval parameter matrix is used for representing the distribution condition of the track nodes of the second track interval; extracting a first matrix discrete value of the first interval parameter matrix and a second matrix discrete value of the second interval parameter matrix respectively, and extracting the first track data list and the second track data list from the first interval parameter matrix and the second interval parameter matrix respectively according to the first matrix discrete value and the second matrix discrete value;

determining a traffic list queue generated according to the first track data list and the second track data list; for a current traffic list queue in the traffic list queues, determining a third queue change frequency of the current traffic list queue between a previous time period and a current time period based on a first queue change frequency of the current traffic list queue in the previous time period and a second queue change frequency of each traffic list queue in the current time period; calculating a traffic feature overlap ratio between the first trajectory data list and the second trajectory data list based on the third queue change frequency and the number of the traffic list queues.

6. The method according to any one of claims 1 to 5, wherein the determining, by the trajectory offset, a state parameter of the target terminal device in a current time period, generating a dynamic security policy according to the state parameter, and issuing the dynamic security policy to the target terminal device specifically includes:

determining label script files of a plurality of identification labels to be marked for identifying the state parameters of the target terminal equipment and similarity among different identification labels based on the acquired offset evaluation factor and the acquired track continuity factor for representing the confidence degree of the track offset;

marking the plurality of identification tags based on the determined tag script files of the plurality of identification tags and the similarity among different identification tags, so that the time consumption of file response corresponding to the marked tag script files of the identification tags is less than a first set value, and the similarity among the marked identification tags is greater than a second set value;

extracting the state parameters of the target terminal equipment in the current time period from the running log of the target terminal equipment according to the marked identification label; sequentially splitting the state parameters into a plurality of parameter sections according to a time sequence, and determining flow processing index information corresponding to each parameter section; the traffic processing index information is used for representing the throughput and the maximum traffic carrying capacity of the target terminal equipment;

determining the event behavior characteristics of DDos attack corresponding to each group of flow processing index information, and generating a target security strategy according to the event behavior characteristics and the throughput and the maximum flow carrying capacity of the corresponding flow processing index information; and packaging the target security policy into the dynamic security policy according to the time sequence characteristics of the event behavior characteristics corresponding to the target security policy.

7. A big data platform, wherein the big data platform is in communication with a terminal device, the big data platform configured to:

when an authorization instruction fed back by a flow detection request sent by a target terminal device based on the big data platform is received, establishing a flow detection channel corresponding to the target terminal device through a device interface parameter carried in the authorization instruction;

acquiring real-time network traffic of the target terminal equipment through the traffic detection channel, and drawing a traffic curve corresponding to the target terminal equipment based on the real-time network traffic;

periodically determining a plurality of groups of flow change tracks of the target terminal equipment based on the flow curve, and calculating the track offset between the flow change track corresponding to the current time period and the flow change track corresponding to the previous time period;

when the target terminal equipment is judged to be attacked by the distributed denial of service according to the track offset, determining the state parameters of the target terminal equipment in the current time period through the track offset, generating a dynamic security policy according to the state parameters and issuing the dynamic security policy to the target terminal equipment so that the target terminal equipment determines the abnormal request in the request to be processed based on the dynamic security policy and destroys the abnormal request.

8. The big data platform of claim 7, wherein the big data platform specifically determines whether the target terminal device is subject to the distributed denial of service attack comprises:

judging whether the track offset is lower than a set threshold value or not;

when the track offset is lower than a set threshold value, the flow change track corresponding to the previous time period is superposed to the flow change track corresponding to the current time period; calculating a correlation coefficient of track characteristics between a flow change track corresponding to a current period and a flow change track corresponding to a next period; if the correlation coefficient is larger than a set coefficient, judging that the target terminal equipment is attacked by the distributed denial of service;

when the track offset is greater than or equal to the set threshold, determining a first track interval corresponding to the track offset in the flow change track corresponding to the last period and a second track interval corresponding to the flow change track corresponding to the current period; extracting a first track data list of the first track interval and a second track data list of the second track interval, and calculating the flow characteristic overlapping rate between the first track data list and the second track data list; and if the flow characteristic overlapping rate is greater than a set rate, judging that the target terminal equipment is attacked by the distributed denial of service.

9. A big data platform comprising a processor and a memory communicating with each other, the processor implementing the method of any of the preceding claims 1-6 by running a computer program fetched from the memory.

10. A computer-readable storage medium, on which a computer program is stored which, when executed, implements the method of any of claims 1-6 above.

Images