CN109327345A - Method and device for detecting abnormal network traffic, and computer-readable storage medium - Google Patents

Abstract

The invention discloses a method and device for detecting abnormal network traffic, and a computer-readable storage medium. The method for detecting abnormal network traffic includes: collecting current traffic data in the current time period of multiple ports and historical traffic data corresponding to the current time period; using a preset filter to extract from the current traffic data and the historical traffic data respectively The current traffic characteristics and historical traffic characteristics of the port; the high-level semantics of the current traffic and the high-level semantics of the historical traffic of the port are extracted from the current traffic characteristics and the historical traffic characteristics respectively; the semantic similarity between the current traffic and the historical traffic of the port is calculated; It is judged whether the semantic similarity falls within the preset first value range, and the judgment result of the current traffic state of the port is obtained; the faulty port is confirmed according to the judgment result of the current traffic state of each port. Using the method for detecting abnormal network traffic in the embodiment of the present invention, the faulty port can be found in time.

Description

Method and device for detecting abnormal network traffic, and computer-readable storage medium

technical field

The present invention relates to the field of communications, and in particular, to a method and device for detecting abnormal network traffic, and a computer-readable storage medium.

Background technique

Currently, a network operator's computer room is usually equipped with a large number of data communication devices, and a large amount of traffic needs to be exchanged between these data communication devices every day. Maintaining the normal operation of these data communication devices is crucial to improving communication quality.

However, the inventor of the present application found that since there are a large number of data communication devices (hereinafter referred to as devices) in the computer room, and the number of ports on the same device is also large, when one or more devices When the port is faulty and the network traffic is abnormal, the faulty port cannot be found in time.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a method and device for detecting abnormal network traffic, and a computer-readable storage medium, which can find a faulty port in time.

In a first aspect, an embodiment of the present invention provides a method for detecting abnormal network traffic, including:

Collect current flow data in the current time period of multiple ports and historical flow data corresponding to the current time period;

Using a preset filter, extract the current flow characteristics and historical flow characteristics of the port from the current flow data and the historical flow data, respectively;

Extracting the high-level semantics of the current traffic of the port and the high-level semantics of the historical traffic from the current traffic characteristics and the historical traffic characteristics respectively;

According to the high-level semantics of the current traffic and the high-level semantics of the historical traffic, calculating the semantic similarity between the current traffic and the historical traffic of the port;

Judging whether the semantic similarity falls within a preset first value range, and obtaining a judgment result of the current traffic state of the port;

The faulty port is confirmed according to the judgment result of the current traffic state of each of the ports.

In some embodiments of the first aspect, extracting the high-level semantics of the current traffic and the high-level semantics of the historical traffic of the port from the current traffic characteristics and the historical traffic characteristics respectively includes:

The high-level semantics of the current traffic and the high-level semantics of the historical traffic of the port are extracted from the current traffic characteristics and the historical traffic characteristics by using the multiplication method.

In some embodiments of the first aspect, extracting the high-level semantics of the current traffic and the high-level semantics of the historical traffic of the port from the current traffic characteristics and the historical traffic characteristics respectively includes:

Calculate the chi-square statistical distance between the high-level semantics of the current traffic and the high-level semantics of the historical traffic, and use the chi-square statistical distance as the semantic similarity between the current traffic and the historical traffic of the port.

In some embodiments of the first aspect, the judging whether the semantic similarity of the port falls within a preset first value range, and obtaining a judgment result of the current traffic state of the port, includes:

Judging whether the semantic similarity of the port falls within a preset first value interval;

If the semantic similarity of the port falls within the preset first value range, the current traffic state of the port is judged to be normal;

If the semantic similarity of the port does not fall within the preset first value range, the current traffic state of the port is determined to be abnormal.

In some embodiments of the first aspect, the judging whether the semantic similarity of the port falls within a preset first value range, and obtaining a judgment result of the current traffic state of the port, further includes:

If the semantic similarity of the port falls within the preset first value range, calculating the semantic similarity between the current incoming flow and the current outgoing flow in the current flow of the port;

Judging whether the semantic similarity between the current incoming flow and the current outgoing flow in the current flow of the port falls within a preset second value range;

If the semantic similarity between the current incoming traffic and the current outgoing traffic in the current traffic of the port falls within the preset second value range, the current traffic state of the port is judged to be normal;

If the semantic similarity between the current incoming traffic and the current outgoing traffic in the current traffic of the port does not fall within the preset second value range, the current traffic state of the port is determined to be abnormal.

In some embodiments of the first aspect, the use of a preset filter to extract the current traffic characteristics and historical traffic characteristics of the port from the current traffic data and the historical traffic data, respectively, includes:

Using the preset filter, extract the initial flow characteristics of each port from the current flow data and the historical flow data, respectively, where the initial flow characteristics include initial current flow characteristics and initial historical flow characteristics;

Feature activation is performed on the initial current traffic feature and the initial historical traffic feature, respectively, to obtain the current traffic feature and the historical traffic feature of the port.

In some embodiments of the first aspect, the use of a preset filter to extract the current traffic characteristics and historical traffic characteristics of the port from the current traffic data and the historical traffic data, respectively, includes:

Using the preset filter, extract low-frequency traffic characteristics and/or high-frequency traffic characteristics of each port from the current traffic data and the historical traffic data, respectively, where the low-frequency traffic characteristics include current low-frequency traffic characteristics and historical low-frequency traffic characteristics, the high-frequency traffic characteristics include current high-frequency traffic characteristics and historical high-frequency traffic characteristics;

The current low-frequency traffic characteristics and the current high-frequency traffic characteristics are used as the current traffic characteristics of the port, and the historical low-frequency traffic characteristics and the historical high-frequency traffic characteristics are used as the historical traffic characteristics of the port.

In some embodiments of the first aspect, the use of a preset filter to extract the current traffic characteristics and historical traffic characteristics of the port from the current traffic data and the historical traffic data, respectively, includes:

Using the preset filter, the inflow flow characteristics and/or the outflow flow characteristics of each port are extracted from the current flow data and the historical flow data, respectively, where the inflow characteristics include the current inflow characteristics and Historical inflow flow characteristics, the outflow flow characteristics include current outflow flow characteristics and historical outflow flow characteristics;

The current inflow flow characteristic and the current outflow flow characteristic are used as the current flow characteristic of the port, and the historical inflow flow characteristic and the historical outflow flow characteristic are taken as the historical flow characteristic of the port.

In some embodiments of the first aspect, after judging whether the semantic similarity of the port falls within a preset first value range, and obtaining a judgment result of the current traffic state of the port, the detection method Also includes:

Calculate the error between the judgment result of the current flow state of each port and the pre-marking result, and add the errors of the various ports to obtain the overall error of all ports;

Utilize the overall error to update the free parameters of the preset filter to obtain an updated filter;

Using the updated filter, re-extract the current traffic characteristics and historical traffic characteristics of each port, obtain the overall error between the judgment results of the current traffic status of all ports and the corresponding pre-marking results, and use the The overall error updates the free parameter of the previous filter, until the value of the free parameter of the current filter overflows the preset first value interval, and the filter corresponding to the minimum overall error is set as the optimal filter;

The faulty port is determined according to the judgment result of the current traffic state of each port corresponding to the optimal filter.

In a second aspect, an embodiment of the present invention provides an apparatus for detecting abnormal network traffic, including:

a data collection module, used for collecting current flow data in the current time period of multiple ports and historical flow data corresponding to the current time period;

a feature extraction module, configured to extract the current traffic feature and the historical traffic feature of the port from the current traffic data and the historical traffic data, respectively, by using a preset filter;

A semantic extraction module, used for extracting the high-level semantics of the current traffic of the port and the high-level semantics of the historical traffic from the current traffic feature and the historical traffic feature respectively;

a similarity calculation module, configured to calculate the semantic similarity between the current traffic and the historical traffic of the port according to the high-level semantics of the current traffic and the high-level semantics of the historical traffic;

A traffic state judgment module, configured to judge whether the semantic similarity falls within a preset first value range, and obtain a judgment result of the current traffic state of the port;

The confirmation module is used for confirming the faulty port according to the judgment result of the current flow state of each of the ports.

In a third aspect, an embodiment of the present invention provides an apparatus for detecting abnormal network traffic, including a memory, a processor, and a program stored in the memory and executable on the processor, and the processor implements the above when executing the program. The detection method of abnormal network traffic described above.

In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium on which a program is stored, and when the program is executed by a processor, implements the above-mentioned method for detecting abnormal network traffic.

According to the method for detecting abnormal network traffic provided by the embodiment of the present invention, first collect current traffic data in the current time period of multiple ports and historical traffic data corresponding to the current time period; The current traffic characteristics and historical traffic characteristics of the port are extracted from the data and historical traffic data. Then, the high-level semantics of the current traffic and the high-level semantics of the historical traffic of the port are extracted from the current traffic characteristics and the historical traffic characteristics, respectively, and according to the high-level semantics of the current traffic and the high-level semantics of the historical traffic, the difference between the current traffic and the historical traffic of the port is calculated. By judging whether the semantic similarity falls within the preset first value range, the judgment result of the current traffic state of the port can be obtained, and then the fault can be confirmed according to the judgment result of the current traffic state of each port. port.

It can be seen from the above that the method for detecting abnormal network traffic according to the embodiment of the present invention extracts the high-level semantics of traffic in the current time period of each port and the historical time period corresponding to the current time period, that is, highly extracted traffic features. Since the traffic behavior in the current time period and its corresponding historical time period is similar, such as the similarity with a period of days, it is only necessary to compare and judge the high-level semantics of the traffic in the current time period and its corresponding historical time period. , the traffic status of each port can be obtained, so as to find the faulty port in time.

Description of drawings

The present invention can be better understood from the following description of specific embodiments of the present invention in conjunction with the accompanying drawings, wherein the same or similar reference numerals denote the same or similar features.

1 is a schematic flowchart of a method for detecting abnormal network traffic according to an embodiment of the present invention;

2 is a schematic flowchart of a method for detecting abnormal network traffic according to another embodiment of the present invention;

3 is a schematic flowchart of a method for detecting abnormal network traffic according to another embodiment of the present invention;

4 is a schematic flowchart of a method for detecting abnormal network traffic according to another embodiment of the present invention;

5 is a schematic flowchart of a learning-based filter adaptive learning method according to an embodiment of the present invention;

6 is a schematic flowchart of calculating high-level semantics based on output traffic with different granularities according to an embodiment of the present invention;

7 is a schematic flowchart of calculating high-level semantics based on input traffic with different granularities according to an embodiment of the present invention;

8 is a schematic structural diagram of an apparatus for detecting abnormal network traffic according to an embodiment of the present invention;

9 is a schematic diagram of a hardware structure of an apparatus for detecting abnormal network traffic according to an embodiment of the present invention;

10 is a schematic layout diagram of a test scene according to an embodiment of the present invention;

11 is a schematic diagram of historical traffic data when the traffic of the Trunk2 port is normal according to an embodiment of the present invention;

12 is a schematic diagram of current flow data when the flow of the Trunk2 port is abnormal according to an embodiment of the present invention;

13 is a schematic diagram of historical traffic data when the traffic of the Trunk1 port is normal according to an embodiment of the present invention;

FIG. 14 is a schematic diagram of current historical traffic data when the traffic of the Trunk1 port is abnormal according to an embodiment of the present invention.

Detailed ways

Features and exemplary embodiments of various aspects of embodiments of the present invention are described in detail below. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without some of these specific details. The following description of the embodiments is merely to provide a better understanding of the embodiments of the present invention by illustrating examples of the embodiments of the present invention. Embodiments of the present invention are by no means limited to any specific configurations and algorithms proposed below, but cover any modifications, substitutions and improvements of elements, components and algorithms without departing from the spirit of the embodiments of the present invention. In the drawings and the following description, well-known structures and techniques are not shown in order to avoid unnecessarily obscuring the embodiments of the present invention.

The method and device for detecting abnormal network traffic provided in the embodiments of the present invention are applied to the fault detection of abnormal network traffic of communication equipment. By using the method and device for detecting abnormal network traffic in the embodiment of the present invention, the traffic in each device can be obtained. status, and find the faulty port in time.

Usually, the traffic behavior of the core equipment room has a similarity on a daily basis, that is, the traffic behavior of a certain period of the day is similar to the traffic behavior of a previous day. For example, the traffic of a certain period between the current day and the previous year has a strong similarity, the traffic of the current month and a certain period of the previous month have a strong similarity, and the current month and week of the current year have strong similarity. There is a certain similarity between the traffic of this day and the time of the week of this month of the previous year. This is because there is a certain relationship between different days and people's network usage behavior. For example, the traffic of devices deployed in hot spots on holidays will be different from normal times; The traffic of devices deployed by mobile communication operators will drop; and in different months, affected by the weather, people travel at different times, resulting in different mobile traffic in different months.

At present, with the improvement of data collection and storage capabilities, the flow of each port of the equipment room can be collected over a long period of time, such as one year, to extract and utilize this daily flow behavior.

FIG. 1 is a schematic flowchart of a method for detecting abnormal network traffic according to an embodiment of the present invention. The method for detecting abnormal network traffic in FIG. 1 includes steps 101 to 106 .

In step 101, current flow data in the current time period and historical flow data corresponding to the current time period of multiple ports are collected.

Here, the introduced historical traffic data does not refer to traffic that has occurred on the same day, but refers to traffic data at the same time in history. By comparing the current traffic with the traffic at the same time in history, the frequency characteristics in a relatively short period of time can be used to describe the similarity or difference between the current traffic and the historical traffic.

In step 102, the current traffic characteristics and the historical traffic characteristics of the port are extracted from the current traffic data and the historical traffic data respectively by using a preset filter.

Among them, the function of the filter is to extract traffic features. In one example, the filter may be a set of weight matrices. The weight matrix can be fixed or have free parameters. The weight matrix with free parameters can extract traffic characteristics with different trends in different time periods.

In practice, it is found that, compared with the current traffic of the same equipment room, the same device or the same port of the same device, compared with the traffic of a previous day, either the total traffic is very close, or the change trend is extremely close, or both. are satisfied. In order to describe the similarity, the flow features can be divided into low-frequency features and high-frequency features, the low-frequency features are extracted by a low-pass filter, which is used to describe the total amount of traffic, and the high-frequency features are extracted by a high-pass filter. Trend. In one example, the expression for the low-pass filter is:

Correspondingly, the expression of the high-pass filter is:

g(k)=(-1) ^k w(k) (2)

Among them, k is the error judgment interval, λ=-3/64, β is a free parameter, and the expression of β is: β=β+k/128. Different β values can extract high-frequency and low-frequency features of different traffic behaviors. Generally, when β=1/32, the filter has good spectral decomposition characteristics for time-invariant signals (see A new design method of 9-7biorthogonal filterbanks based on on odd harmonic function, CSSP, Springer, 31(3):1245-1255, 2012)).

Specifically, the low-frequency characteristics of the flow can be obtained by convolution with w(k) and the flow, and the high-frequency components of the flow can be obtained by convolution with g(k) with the flow.

In step 103, the high-level semantics of the current traffic and the high-level semantics of the historical traffic of the port are extracted from the current traffic feature and the historical traffic feature, respectively.

Preferably, the high-level semantics of the current traffic and the high-level semantics of the historical traffic of the port can be extracted from the current traffic characteristics and the historical traffic characteristics by using the multiplication method, that is, the histogram vector of the traffic characteristics is obtained as the high-level semantics. So that each element in the high-level semantics can carry enough information about the traffic behavior.

The following will illustrate the calculation process of extracting high-level semantics of traffic by using the method of multiplying by ten. To extract high-level semantics of traffic is to obtain the histogram vector of traffic characteristics.

Predefine a loss expression for a flow characteristic:

s(n)=[0.8994, 0.9541, 1.0000, 0, 0.9414, 0.9852] (3)

Among them, s(n) is the flow characteristic loss, and n is the number of vector elements. The method of obtaining the histogram vector of the flow characteristics includes multiplying each element in s(n) by 10 and rounding it up; adding 1 to the value after multiplying each element by 10 and rounding up to obtain a vector [9, 10, 11, 1, 10, 10]; count the number of occurrences of 1 to 11 in the vector [9, 10, 11, 1, 10, 10], and obtain the histogram vector, that is, the high-level semantics of traffic [1, 0, 0, 0, 0] ,0,0,0,1,3,1].

In step 104, the semantic similarity between the current traffic and the historical traffic of the port is calculated according to the high-level semantics of the current traffic and the high-level semantics of the historical traffic.

Preferably, the chi-square statistical distance between the high-level semantics of the current traffic and the high-level semantics of the historical traffic can be calculated, and the chi-square statistical distance is used as the semantic similarity between the current traffic and the historical traffic of the port, that is, the chi-square statistical distance is introduced. Characterize the similarity between historical traffic and current traffic. Compared with Euclidean distance, due to the introduction of covariance matrix, chi-square statistical distance has a higher-order vanishing distance, which can exclude the influence of semantically irrelevant components on similarity.

In an example, define the high-level semantics of historical traffic as hist ₁ , the high-level semantics of current traffic as hist ₂ , and the covariance between historical traffic and current traffic as cov(hist _1i , hist _2i ), then historical traffic and current traffic The formula for calculating the chi-square statistical distance between is:

Among them, χ ² (hist ₁ , hist ₂ ) is the chi-square statistical distance between historical traffic and current traffic, and i is the number of elements in the histogram vector of high-level semantics.

In step 105, it is judged whether the semantic similarity between the current traffic and the historical traffic of the port falls within a preset first value range, and a judgment result of the current traffic state of the port is obtained.

In step 106, the faulty port is confirmed according to the judgment result of the current traffic state of each port.

According to the method for detecting abnormal network traffic provided by the embodiment of the present invention, first collect current traffic data in the current time period of multiple ports and historical traffic data corresponding to the current time period; The current traffic characteristics and historical traffic characteristics of the port are extracted from the data and historical traffic data. Then, the high-level semantics of the current traffic and the high-level semantics of the historical traffic of the port are extracted from the current traffic characteristics and the historical traffic characteristics, respectively, and according to the high-level semantics of the current traffic and the high-level semantics of the historical traffic, the difference between the current traffic and the historical traffic of the port is calculated. By judging whether the semantic similarity falls within the preset first value range, the judgment result of the current traffic state of the port can be obtained, and then the fault can be confirmed according to the judgment result of the current traffic state of each port. port.

It can be seen from the above that the method for detecting abnormal network traffic according to the embodiment of the present invention extracts the high-level semantics of traffic in the current time period of each port and the historical time period corresponding to the current time period, that is, highly extracted traffic features. Since the traffic behavior in the current time period and its corresponding historical time period is similar, such as the similarity with a period of days, it is only necessary to compare and judge the high-level semantics of the traffic in the current time period and its corresponding historical time period. , the traffic status of each port can be obtained, so as to find the faulty port in time.

In addition, since the high-level semantics of traffic belongs to the high-level concept of traffic and is not limited by the limitations of low-level features (such as low-frequency features and high-frequency features), using the high-level semantics of traffic as the basis for judging whether the traffic is abnormal can better It reflects people's understanding and judgment of abnormal traffic.

FIG. 2 is a schematic flowchart of a method for detecting abnormal network traffic according to another embodiment of the present invention. The difference between FIG. 2 and FIG. 1 is that step 102 in FIG. 1 can be refined into steps 1021 to 1022 in FIG. 2 .

In step 1021, a preset filter is used to extract initial traffic characteristics of each port from the current traffic data and the historical traffic data, respectively, where the initial traffic characteristics include initial current traffic characteristics and initial historical traffic characteristics.

In step 1022, feature activation is performed on the initial current traffic feature and the initial historical traffic feature, respectively, to obtain the current traffic feature and the historical traffic feature of the port.

Among them, by activating the flow characteristics, the abnormal flow characteristics can be highlighted, and the ground flow characteristics can be converged. For the calculation process of activating the flow characteristic, please refer to the following formula (15) and formula (16).

FIG. 3 is a schematic flowchart of a method for detecting abnormal network traffic according to another embodiment of the present invention. The difference between FIG. 3 and FIG. 1 is that step 105 in FIG. 1 can be refined into steps 1051 to 1052 in FIG. 3 .

In step 1051, it is determined whether the semantic similarity of the port falls within a preset first value range.

In step 1052, if the semantic similarity between the current flow of the port and the historical flow falls within the preset first value range, the current flow status of the port is judged to be normal; if the difference between the current flow of the port and the historical flow is If the semantic similarity between them does not fall within the preset first value range, the current traffic state of the port is judged to be abnormal.

It should be noted that, the method in FIG. 3 mainly judges the current traffic state of the port based on the semantic similarity between the current traffic and the historical traffic.

FIG. 4 is a schematic flowchart of a method for detecting abnormal network traffic according to another embodiment of the present invention. The detection method in FIG. 4 includes steps 1053 to 1056 . It should be noted that, steps 1053 to 1056 in FIG. 4 are also further refinements of step 105 in FIG. 1 .

In step 1053, it is determined whether the semantic similarity of the port falls within a preset first value range (same as step 1051).

In step 1054, if the semantic similarity between the current flow and the historical flow of the port falls within the preset first value range, calculate the semantic similarity between the current inflow and the current outflow in the current flow of the port Spend.

In step 1055, it is determined whether the semantic similarity between the current inflow traffic and the current outgoing traffic in the current traffic of the port falls within a preset second value range.

In step 1056, if the semantic similarity between the current incoming traffic and the current outgoing traffic in the current traffic of the port falls within the preset second value interval, the current traffic state of the port is judged to be normal; The semantic similarity between the current incoming traffic and the current outgoing traffic in the current traffic does not fall within the preset second value range, and the current traffic state of the port is judged to be abnormal.

It should be noted that the method in Figure 4 is mainly based on the situation that the semantic similarity between the current traffic and the historical traffic is within the preset range, and further judges whether the input traffic and output traffic of the current traffic are conserved, which improves the Judgment accuracy of port traffic.

According to the embodiment of the present invention, preset filters can also be used to extract low-frequency traffic characteristics and/or high-frequency traffic characteristics of each port from current traffic data and historical traffic data, respectively, where low-frequency traffic characteristics include current low-frequency traffic characteristics and historical traffic characteristics. Low-frequency traffic characteristics, high-frequency traffic characteristics include current high-frequency traffic characteristics and historical high-frequency traffic characteristics; take the current low-frequency traffic characteristics and current high-frequency traffic characteristics as the current traffic characteristics of the port, and use the historical low-frequency traffic characteristics and historical high-frequency traffic characteristics. The characteristic is used as the historical traffic characteristic of the port. And/or, using a preset filter, respectively extract the inflow flow characteristics and/or outflow flow characteristics of each port from the current flow data and the historical flow data, the inflow flow characteristics include the current inflow flow characteristics and the historical inflow flow characteristics, and the outflow flow characteristics Traffic characteristics include current outgoing traffic characteristics and historical outgoing traffic characteristics; take the current inflow traffic characteristics and current outgoing traffic characteristics as the current traffic characteristics of the port, and use the historical inflow traffic characteristics and historical outgoing traffic characteristics as the historical traffic characteristics of the port.

As described above, by extracting the traffic characteristics from multiple angles as the judgment basis of the port traffic, the judgment accuracy of the port traffic can be improved.

Network traffic is both transient and long-term, and it is necessary to capture this time-varying network traffic feature by a non-fixed filter. In order to capture the time-varying network traffic characteristics, the embodiments of the present invention also propose a learning-based filter adaptive learning method to obtain filters with different time-varying characteristics.

FIG. 5 is a schematic flowchart of a learning-based filter adaptive learning method according to an embodiment of the present invention. It should be noted that, steps 107 to 110 in FIG. 5 are located after step 105 in FIG. 1 .

In step 107, the error between the judgment result of the current traffic state of each port and the pre-marking result is calculated respectively, and the errors of each port are added to obtain the overall error of all ports.

In step 108, the free parameters of the preset filter are updated by using the overall error to obtain an updated filter.

In step 109, use the updated filter to re-extract the current traffic characteristics and historical traffic characteristics of each port, obtain the overall error between the judgment results of the current traffic status of all ports and the corresponding pre-marking results, and use The overall error updates the free parameters of the previous filter until the value of the free parameters of the current filter overflows the preset first value range, and the filter corresponding to the smallest overall error is set as the optimal filter. The preset first value interval is [1/128, 1/4]. In this method, β is set as a free parameter, and the value interval of β is [1/128, 1/4] to obtain filters with different time-varying characteristics.

In step 110, the faulty port is determined according to the judgment result of the current traffic state of each port corresponding to the optimal filter.

The following is an example of the flow of the learning-based filter adaptive learning method, including the following steps:

Select 50,000 traffic segments in advance that contain the current traffic data information and historical traffic data information of each port of each device in the computer room, and mark the traffic status of these 50,000 traffic segments according to the historical fault records. The abnormal traffic status is marked with 1. The normal flow status is marked with 0.

Then, according to the above method for detecting abnormal network traffic, the judgment result of the respective traffic states of the 50,000 traffic segments is obtained (refer to step 105). Similarly, the judgment result of the abnormal traffic state is 1, and the judgment result of the normal traffic state is 0.

Next, find the overall error between the labeling results of the traffic states of these 50,000 traffic segments and the judgment results. The calculation formula is:

Among them, H(y _n , l(z _n )) is the entropy of the overall error, y _n is the labeling result of the traffic status of the traffic segment, l(z _n ) is the judgment result obtained from the abnormal judgment of the traffic segment, and n represents the number of the traffic segment .

Taking the derivative of formula (5), we get:

Then, divide H' by 50000, normalize H' to be between 0 and 1, and divide the interval between 0 and 1 into 256 equal parts as the error judgment interval, and the number of the error judgment interval is denoted as k, By judging the error judgment interval that H' falls into, the value of k can be obtained. For example, if the value of H' is 3/256, then k=3.

In order to speed up the process of finding the optimal filter, β is updated with k, where β=β+k/128. And after traversing the entire value range of β [1/128, 1/4], the filter bank corresponding to β when H' is the smallest is selected as the optimal filter, so as to adaptively obtain a filter with learning ability.

Understandably, due to differences in the traffic behavior of different granularities (computer room, device, and port), according to the embodiment of the present invention, the high-level semantics corresponding to each granularity layer can also be extracted from the three levels of computer room granularity, device granularity, and device granularity. , compare the semantic similarity between current traffic and historical traffic of each granularity layer by layer, obtain the judgment results of network traffic at multiple granularities, and then obtain filters adapted to traffic behaviors of different granularities.

In order to facilitate the understanding of those skilled in the art, the process of feature extraction of traffic corresponding to the computer room granularity, the device granularity, and the port granularity is exemplified below.

Assuming that the flow sampling interval is 1 minute, each port can collect 1440 incoming flows and 1440 outgoing flows within 24 hours. In the following expressions, x is continuous time, n is discrete time, n=1 represents the current time point, and n=N represents the Nth time point ahead of the current time, that is, N is the number of samples used to calculate the flow characteristics. In practice, in order to detect abnormal flow in time, N takes a value between 6 and 30, that is, takes the first 6 to 30 sampling points up to the current time point.

The extraction formula of low-frequency characteristics of port traffic is:

The extraction formula of the high-frequency characteristics of the port traffic is:

in, is the low frequency characteristic of the lth port, is the high frequency characteristic of the lth port, Indicates the traffic of the lth port, π is the extraction layer number, ω(k) is the low-frequency feature extraction function, that is, the weight matrix corresponding to the low-pass filter, and g(k) is the high-frequency feature extraction function, that is, the high-pass filter. The corresponding weight matrix, b ^(π) represents the offset corresponding to the extraction layer. Equation (7) is used to describe the flow of the lth port of a device Low frequency components of flow over a period of time. Equation (8) is used to describe the flow of the lth port of a device High frequency components of traffic over a period of time.

The extraction formula of the low-frequency characteristics of the flow of the device is:

The extraction formula of the high-frequency characteristics of the flow of the device is:

in, is the low frequency characteristic of the mth port, is the high frequency feature of the mth device, is the traffic of the mth device, and L is the total number of ports on the device. Equation (9) is used to characterize the flow of the mth device The low-frequency component of the flow in a period of time, Equation (11) is used to characterize the flow of the mth device High frequency components of traffic over a period of time.

The extraction formula for the low-frequency characteristics of traffic in the computer room is:

s ^R (n)=f(z _n )=f(w ^(ω) t ^R (x)+b ^(π) ) (12)

The extraction formula for the high-frequency characteristics of traffic in the computer room is:

d ^R (n)=f(z _n )=f(g ^(π) t ^R (x)+b ^(π) ) (14)

Among them, S ^R (n) is the low frequency characteristic of the computer room, d ^R (n) is the low frequency characteristic of the computer room, t ^R (n) is the total flow of the computer room, and m is the total number of devices in the computer room. Equation (12) is used to describe the low frequency component of the flow t ^R (x) in the computer room in a period of time, and Equation (14) is used to describe the high frequency component of the flow t ^R (x) of the computer room in a period of time.

Next, activation processing can be performed on the results of (7), (8), (9), (11), (12) and (14), and the calculation formula of the activation processing is:

in, u is the number of iterations, the value of γ is 0.25, and the value of λ is 0.25. Substitute the results of Equation (15) into Equation (16) to obtain the flow characteristics of each layer after convergence. Since the traffic features of the network are extracted at multiple levels, and these traffic features are activated by equations (15) and (16), they are called deep activation features of traffic, or traffic features for short.

FIG. 6 is a schematic flowchart of calculating high-level semantics based on output traffic with different granularities according to an embodiment of the present invention. The equipment room includes multiple devices, and each device includes multiple ports. The total number of devices in the equipment room shown in FIG. 6 is M, and the mth device includes L ports.

Referring to Figure 6, first, according to the output traffic of each port, respectively calculate the high-level semantics corresponding to the output traffic characteristics of each port;

Then, according to the output traffic of each device, respectively calculate the high-level semantics corresponding to the output traffic characteristics of each device, wherein the output traffic of each device is the sum of the output traffic of all ports in the device;

Finally, the high-level semantics corresponding to the output traffic characteristics of the computer room, where the output traffic of the computer room is the sum of the output traffic of all ports in the computer room.

FIG. 7 is a schematic flowchart of calculating high-level semantics of input traffic with different granularities according to an embodiment of the present invention. The symbols in FIG. 7 and FIG. 6 have the same meanings, the difference is that FIG. 6 shows the high-level semantics of calculating the output flow, while FIG. 7 shows the high-level semantics of calculating the input flow.

Referring to FIG. 7, first, according to the input traffic of each port, respectively calculate the high-level semantics corresponding to the input traffic characteristics of each port;

Then, according to the input traffic of each device, respectively calculate the high-level semantics corresponding to the input traffic characteristics of each device, wherein the input traffic of each device is the sum of the input traffic of all ports in the device;

Finally, the high-level semantics corresponding to the input traffic characteristics of the computer room, where the input traffic of the computer room is the sum of the input traffic of all ports in the computer room.

Next, based on the granularity of the computer room, the granularity of the device, and the granularity of the port, the flow judgment process of the embodiment of the present invention is exemplarily described.

Table 1 is a list of variable names for the semantic similarity between the high-level semantics of traffic features at computer room granularity, device granularity, and port granularity. The rows in Table 1 correspond to the computer room granularity, device granularity, and port granularity in turn, and the columns in Table 1 correspond to the semantic similarity between the current inflow low-frequency feature and the historical inflow low-frequency feature, and the current outflow low-frequency feature and the historical outflow low-frequency feature. The semantic similarity between the current inflow high-frequency features and the historical inflow high-frequency features, the semantic similarity between the current outflow high-frequency features and the historical outflow high-frequency features, the current inflow low-frequency features and the current outflow low-frequency features The semantic similarity between the current inflow high-frequency features and the current outflow high-frequency features.

In order to clearly distinguish the variable names, in the subscript notation of the first rank of the semantic similarity χ2 ^: P represents the port granularity, I represents the device granularity, and R represents the computer room granularity; in the subscript notation of the other sorting bits: I represents the traffic Input, O represents flow output, S represents low frequency features, and G represents high frequency features.

Table 1

The flow characteristics of port granularity in Table 1 are calculated according to formula (7), formula (8) and formula (15), and the flow characteristics of equipment granularity are calculated according to formula (9), formula (11) and formula (15). The traffic feature is calculated according to formula (12), formula (14) and formula (15), and the high-level semantic similarity is calculated according to formula (4).

In an example, the flow judgment principle of the embodiment of the present invention based on the granularity of the equipment room, the granularity of the equipment, and the granularity of the port is as follows:

First, the traffic judgment starts from the level of the granularity of the computer room. The judgment rules are as follows:

(1a) if satisfied Then it is judged that the low-frequency characteristics of the inflow traffic of the computer room are normal;

(1b) if satisfied Then it is judged that the high-frequency characteristics of the inflow traffic of the computer room are normal;

(1c) If satisfied Then it is judged that the low-frequency characteristics of the outflow flow from the computer room are normal;

(1d) if satisfied Then it is judged that the high-frequency characteristics of the outflow flow from the computer room are normal;

(1e) If (1a) and (1b) are satisfied at the same time, or (1c) and (1d) are satisfied at the same time, then go to (1f), otherwise it is judged that the flow rate of the computer room is abnormal;

(1f) If and Then it is judged that the traffic in the computer room is normal, otherwise it is judged that the traffic of the computer room is abnormal.

Next, if the decision result of the computer room granularity is that the traffic is abnormal, you need to enter (2) to perform traffic detection on each device in the computer room. Take the mth device as an example:

(2a) if satisfied Then it is judged that the low-frequency characteristics of the inflow traffic of the mth device are normal;

(2b) if satisfied Then it is judged that the high-frequency characteristics of the inflow traffic of the m-th device are normal;

(2c) if satisfied Then it is judged that the low frequency characteristic of the outflow flow of the mth device is normal;

(2d) if satisfied Then it is judged that the high-frequency characteristics of the outflow flow of the mth device are normal;

(2e) If (2a) and (2b) are satisfied at the same time, or (2c) and (2d) are satisfied at the same time, then go to (2f), otherwise judge that the flow of the mth device is abnormal;

(2f) if and Then it is judged that the traffic of the mth device is normal, otherwise it is judged that the traffic of the mth device is abnormal.

Next, if the judgment result of the device granularity is that the traffic is abnormal, you need to enter (3) to perform traffic detection on each port in the device. Take the lth port as an example:

(3a) if satisfied Then it is judged that the low frequency characteristic of the inflow traffic of the lth port is normal;

(3b) if satisfied Then it is judged that the high-frequency characteristics of the inflow traffic of the lth port of the machine are normal;

(3c) If satisfied Then it is judged that the low frequency characteristic of the outgoing traffic of the lth port is normal;

(3d) if satisfied Then it is judged that the high frequency characteristics of the outgoing traffic of the lth port are normal;

(3e) If (3a) and (3b) are satisfied at the same time, or (3c) and (3d) are satisfied at the same time, then go to (3f), otherwise judge that the flow of the lth port is abnormal;

(3f) if and Then it is judged that the traffic of the lth port is normal; otherwise, it is judged that the traffic of the lth port is abnormal.

It should be noted that, according to the above judgment steps, the label l(z _n ) of whether each traffic is abnormal can be obtained, that is, 1 indicates that the traffic is abnormal, and 0 indicates that the traffic is normal. According to the embodiment of the present invention, the above judgment step can be used not only for training and learning of free parameters, but also for online judgment of abnormal traffic.

FIG. 8 is a schematic structural diagram of an apparatus for detecting abnormal network traffic according to an embodiment of the present invention. The apparatus for detecting abnormal network traffic in FIG. 8 includes: a data collection module 801 , a feature extraction module 802 , a semantic extraction module 803 , a similarity calculation module 804 , a traffic state judgment module 805 and a confirmation module 806 .

The data collection module 801 is configured to collect current flow data within the current time period of multiple ports and historical flow data corresponding to the current time period.

The implementation form of the data acquisition module 801 can be a database. In an example, a current database can be established to keep all the flow data of the current day; and a historical database can be established to save the historical flow data of one year. Among them, in the process of using the historical database to collect the traffic data, the state of the traffic data can also be manually judged, and the traffic data considered to be normal can be saved in the historical traffic database. In this way, after collecting data for a whole year, the historical traffic database can accurately detect abnormal traffic.

Specifically, a mapping database may also be established for mapping the correspondence between upstream and downstream devices and their ports. The mapping database is connected to the current database and the historical database respectively. When detecting abnormal traffic on the network, the information of all devices and ports in a certain computer room can be obtained through the mapping database, and the current database can be obtained from the current database according to the information of all devices and ports. and according to the specific date of the day, request the historical traffic of the relevant date from the historical traffic database.

The feature extraction module 802 is configured to use a preset filter to extract the current traffic feature and the historical traffic feature of the port from the current traffic data and the historical traffic data, respectively.

The semantic extraction module 803 is configured to extract the high-level semantics of the current traffic and the high-level semantics of the historical traffic of the port from the current traffic feature and the historical traffic feature, respectively.

The similarity calculation module 804 is configured to calculate the semantic similarity between the current traffic and the historical traffic of the port according to the high-level semantics of the current traffic and the high-level semantics of the historical traffic.

The traffic state judgment module 805 is configured to judge whether the semantic similarity falls within the preset first value range, and obtain the judgment result of the current traffic state of the port.

The confirmation module 806 is configured to confirm the faulty port according to the judgment result of the current traffic state of each port.

FIG. 9 is a schematic diagram of a hardware structure of an apparatus for detecting abnormal network traffic according to an embodiment of the present invention. As shown in FIG. 9 , the apparatus for detecting abnormal network traffic in the embodiment of the present invention includes: a processor 901 , a memory 902 , a communication interface 903 , and a bus 910 . Among them, the processor 901, the memory 902 and the communication interface 903 are connected through the bus 910 and complete the mutual communication.

Specifically, the above-mentioned processor 901 may include a central processing unit 901 (CPU), or a specific integrated circuit (ASIC), or may be configured as one or more integrated circuits implementing embodiments of the present invention.

Memory 902 may include mass storage 902 for data or instructions. By way of example and not limitation, memory 902 may include an HDD, floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus 910 (USB) drive or a combination of two or more of the above. Memory 902 may include removable or non-removable (or fixed) media, where appropriate. Where appropriate, memory 902 may be internal or external to the resource interface device. In particular embodiments, memory 902 is non-volatile solid state memory 902 . In particular embodiments, memory 902 includes read only memory 902 (ROM). Where appropriate, the ROM may be a mask programmed ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), electrically rewritable ROM (EAROM) or flash memory or A combination of two or more of the above.

The communication interface 903 is mainly used to implement communication between modules, apparatuses, units, and/or devices in the embodiments of the present invention.

That is, the apparatus for detecting abnormal network traffic can be implemented to include: a processor 901 , a memory 902 , a communication interface 903 and a bus 910 . The processor 901, the memory 902 and the communication interface 903 are connected through the bus 910 and complete the communication with each other. The memory 902 is used for storing program codes; the processor 901 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 902, so as to perform the above-mentioned detection of abnormal network traffic method, so as to realize the method and apparatus for detecting abnormal network traffic described in conjunction with FIG. 1 to FIG. 8 .

FIG. 10 is a schematic layout diagram of a test scene according to an embodiment of the present invention. The network devices shown in Figure 10 include: two firewalls (FW13 and FW14), two switches (SW07 and SW08), two routers (RT05 and RT06), and an abstract SAE gateway pool (SAEGW). The current traffic data is from 11:10 to 11:40 on March 14, 2016. The purpose of the experiment is to verify the effectiveness of the proposed scheme, and to test the ability of low-frequency and high-frequency features to capture the short-term behavior of current traffic and historical traffic.

Table 2 and Table 3 show the semantic similarity of the traffic features of the computer room and equipment, respectively.

Table 2

table 3

Referring to Table 2, although the current low-frequency characteristics and historical low-frequency characteristics of the computer room inflow are within the range of decision formula (1a), the current low-frequency characteristics are reduced by about 1/6 compared with the historical low-frequency characteristics. The current high-frequency characteristics are about 6 times more than the historical high-frequency characteristics, so it can be determined that abnormal traffic and potential equipment failures have occurred in the equipment room.

Referring to Table 3, by extracting the short-term traffic characteristics of the devices in the equipment room one by one, it is found that the current high-frequency characteristics of the two devices, FW13 and FW14, are significantly larger than their historical high-frequency characteristics. Ports where abnormal traffic occurs on FW13 and FW14. Referring to Figure 11 and Figure 12, the data in Figure 11 is the normal traffic data collected from the Trunk2 port at 11:40 on March 23, 2015, and the data in Figure 12 is collected from Trunk2 at 11:40 on March 14, 2016. Abnormal traffic on the port. Comparing the flow curves of some ports of FW13 in Figure 11 and Figure 12, it is found that the port Trunk2 has a traffic singularity point (refer to the arrow in Figure 12), which verifies the effectiveness of the proposed scheme for abnormal traffic detection.

Referring to Table 3, the high-frequency characteristics of RT06 do not satisfy the formula (1c), and its current low-frequency characteristics are significantly smaller than the historical low-frequency characteristics. The calculation shows that the low-frequency and high-frequency characteristics of the Trunk1 port of RT06 are obviously abnormal. Referring to Figure 13 and Figure 14, the data in Figure 13 is the normal traffic data collected from the Trunk1 port at 11:40 on March 23, 2015, and the data in Figure 14 is collected from Trunk1 at 11:40 on March 14, 2016. Abnormal traffic data when the port fails. Comparing the traffic curves of some ports of RT06 in Figure 13 and Figure 14, it is found that the port Trunk1 does not collect traffic (that is, the traffic curve indicated by the arrow in Figure 13), which means that the port Trunk1 is faulty, which verifies that the proposed solution is effective for abnormal traffic. Validity of detection.

Referring to Table 3, the current inflow characteristics and outflow characteristics of RT06, FW13, and FW14 devices are relatively matched, while the inflow characteristics and outflow characteristics of the SW08 device do not match. . This also illustrates the importance of using historical traffic to detect abnormal traffic from another aspect.

It should be clear that each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment may be referred to each other, and each embodiment focuses on the differences from other embodiments. place. For the apparatus embodiment, reference may be made to the description part of the method embodiment for relevant places. Embodiments of the present invention are not limited to the specific steps and structures described above and shown in the figures. Those skilled in the art may make various changes, modifications and additions, or change the order between steps, after comprehending the spirit of the embodiments of the present invention. Also, for the sake of brevity, detailed descriptions of known methods and techniques are omitted here.

The embodiments of the present invention may be implemented in other specific forms without departing from the spirit and essential characteristics thereof. For example, the algorithms described in particular embodiments may be modified without departing from the basic spirit of the embodiments of the invention in system architecture. Accordingly, the present embodiments are to be regarded in all respects as illustrative and not restrictive, and the scope of the embodiments of the present invention is defined by the appended claims rather than the foregoing description, and falls within the meaning and equivalence of the claims All changes within the scope of the present invention are thus included in the scope of the embodiments of the present invention.

Claims (12)

1. a detection method for abnormal network flow, is characterized in that, comprises: Collect current flow data in the current time period of multiple ports and historical flow data corresponding to the current time period; Using a preset filter, extract the current flow characteristics and historical flow characteristics of the port from the current flow data and the historical flow data, respectively; Extracting the high-level semantics of the current traffic of the port and the high-level semantics of the historical traffic from the current traffic characteristics and the historical traffic characteristics respectively; According to the high-level semantics of the current traffic and the high-level semantics of the historical traffic, calculating the semantic similarity between the current traffic and the historical traffic of the port; Judging whether the semantic similarity falls within a preset first value range, and obtaining a judgment result of the current traffic state of the port; The faulty port is confirmed according to the judgment result of the current traffic state of each of the ports. 2. The method for detecting abnormal network traffic according to claim 1, wherein the high-level semantics of the current traffic and historical traffic of the port are extracted from the current traffic feature and the historical traffic feature respectively. High-level semantics, including: The high-level semantics of the current traffic and the high-level semantics of the historical traffic of the port are extracted from the current traffic characteristics and the historical traffic characteristics by using the multiplication method. 3. The method for detecting abnormal network traffic according to claim 1, wherein the high-level semantics of the current traffic of the port and the historical traffic are extracted from the current traffic feature and the historical traffic feature respectively. High-level semantics, including: Calculate the chi-square statistical distance between the high-level semantics of the current traffic and the high-level semantics of the historical traffic, and use the chi-square statistical distance as the semantic similarity between the current traffic and the historical traffic of the port. 4. The method for detecting abnormal network traffic according to claim 1, characterized in that, by judging whether the semantic similarity of the port falls within a preset first value interval, the current traffic state of the port is obtained judgments, including: Judging whether the semantic similarity of the port falls within a preset first value interval; If the semantic similarity of the port falls within the preset first value range, the current traffic state of the port is judged to be normal; If the semantic similarity of the port does not fall within the preset first value range, the current traffic state of the port is determined to be abnormal. 5. The method for detecting abnormal network traffic according to claim 1, characterized in that, by judging whether the semantic similarity of the port falls into a preset first value interval, the current traffic state of the port is obtained judgments, including: Judging whether the semantic similarity of the port falls within a preset first value interval; If the semantic similarity of the port falls within the preset first value range, calculating the semantic similarity between the current incoming flow and the current outgoing flow in the current flow of the port; Judging whether the semantic similarity between the current incoming flow and the current outgoing flow in the current flow of the port falls within a preset second value range; If the semantic similarity between the current incoming traffic and the current outgoing traffic in the current traffic of the port falls within the preset second value range, the current traffic state of the port is judged to be normal; If the semantic similarity between the current incoming traffic and the current outgoing traffic in the current traffic of the port does not fall within the preset second value range, the current traffic state of the port is determined to be abnormal. 6. The method for detecting abnormal network traffic according to claim 1, characterized in that, by using a preset filter, the current traffic of the port is extracted from the current traffic data and the historical traffic data respectively. Characteristics and historical traffic characteristics, including: Using the preset filter, extract the initial flow characteristics of each port from the current flow data and the historical flow data, respectively, where the initial flow characteristics include initial current flow characteristics and initial historical flow characteristics; Feature activation is performed on the initial current traffic feature and the initial historical traffic feature, respectively, to obtain the current traffic feature and the historical traffic feature of the port. 7. The method for detecting abnormal network traffic according to claim 1, characterized in that, by using a preset filter, the current traffic of the port is extracted from the current traffic data and the historical traffic data respectively. Characteristics and historical traffic characteristics, including: Using the preset filter, extract low-frequency traffic characteristics and/or high-frequency traffic characteristics of each port from the current traffic data and the historical traffic data, respectively, where the low-frequency traffic characteristics include current low-frequency traffic characteristics and historical low-frequency traffic characteristics, the high-frequency traffic characteristics include current high-frequency traffic characteristics and historical high-frequency traffic characteristics; The current low-frequency traffic characteristics and the current high-frequency traffic characteristics are used as the current traffic characteristics of the port, and the historical low-frequency traffic characteristics and the historical high-frequency traffic characteristics are used as the historical traffic characteristics of the port. 8 . The method for detecting abnormal network traffic according to claim 1 , wherein the current traffic of the port is extracted from the current traffic data and the historical traffic data respectively by using a preset filter. 9 . Characteristics and historical traffic characteristics, including: Using the preset filter, the inflow flow characteristics and/or the outflow flow characteristics of each port are extracted from the current flow data and the historical flow data, respectively, where the inflow characteristics include the current inflow characteristics and Historical inflow flow characteristics, the outflow flow characteristics include current outflow flow characteristics and historical outflow flow characteristics; The current inflow flow characteristic and the current outflow flow characteristic are used as the current flow characteristic of the port, and the historical inflow flow characteristic and the historical outflow flow characteristic are taken as the historical flow characteristic of the port. 9 . The method for detecting abnormal network traffic according to claim 1 , wherein, in the process of judging whether the semantic similarity of the port falls into a preset first value range, the current traffic of the port is obtained. 10 . After the judgment result of the state, the detection method further includes: Calculate the error between the judgment result of the current flow state of each port and the pre-marking result, and add the errors of the various ports to obtain the overall error of all ports; Utilize the overall error to update the free parameters of the preset filter to obtain an updated filter; Using the updated filter, re-extract the current traffic characteristics and historical traffic characteristics of each port, obtain the overall error between the judgment results of the current traffic status of all ports and the corresponding pre-marking results, and use the The overall error updates the free parameter of the previous filter, until the value of the free parameter of the current filter overflows the preset first value interval, and the filter corresponding to the minimum overall error is set as the optimal filter; The faulty port is determined according to the judgment result of the current traffic state of each port corresponding to the optimal filter. 10. An apparatus for detecting abnormal network traffic, comprising: a data collection module, used for collecting current flow data in the current time period of multiple ports and historical flow data corresponding to the current time period; a feature extraction module, configured to extract the current traffic feature and the historical traffic feature of the port from the current traffic data and the historical traffic data, respectively, by using a preset filter; A semantic extraction module, used for extracting the high-level semantics of the current traffic of the port and the high-level semantics of the historical traffic from the current traffic feature and the historical traffic feature respectively; a similarity calculation module, configured to calculate the semantic similarity between the current traffic and the historical traffic of the port according to the high-level semantics of the current traffic and the high-level semantics of the historical traffic; A traffic state judgment module, configured to judge whether the semantic similarity falls within a preset first value range, and obtain a judgment result of the current traffic state of the port; The confirmation module is used for confirming the faulty port according to the judgment result of the current traffic state of each of the ports. 11. A detection device for abnormal network traffic, comprising a memory, a processor and a program stored in the memory and running on the processor, wherein the processor implements the program as claimed in claim 1- when executing the program. 9. The method for detecting abnormal network traffic according to any one of the items. 12 . A computer-readable storage medium having a program stored thereon, wherein when the program is executed by a processor, the method for detecting abnormal network traffic according to any one of claims 1 to 9 is implemented. 13 .