CN117221242B - Network flow direction identification method, device and medium - Google Patents

Abstract

The invention discloses a network flow direction identification method, equipment and medium. The method comprises the following steps: acquiring MAC addresses of all access flows, and acquiring a communication relationship between the MAC addresses; based on the MAC address and the communication relation, establishing at least one MAC address bipartite graph; screening first flow with deterministic flow direction from the access flow corresponding to each MAC address bipartite graph; and identifying the flow directions of all access flows based on all the MAC address bipartite graphs and the first flows corresponding to all the MAC address bipartite graphs. By the scheme of the invention, the flow direction of the global network flow can be effectively identified, the maintenance cost of the global network flow direction identification is reduced, and the accuracy and the efficiency of the global network flow direction identification are improved.

Description

A network flow identification method, device and medium

Technical Field

The present invention relates to the field of computer network security, and in particular to a network flow direction identification method, device and medium.

Background Art

With the explosive development of unknown network applications, the amount of unknown traffic has increased dramatically. At the same time, the hidden dangers brought by massive unknown traffic cannot be ignored. In various network traffic analysis scenarios at the import and export boundaries of large regional networks, the analysis system needs to solve network security issues such as network threats or data leakage through effective traffic direction judgment.

In the related technology, the direction of network traffic is mainly determined by three methods: the LAN Internet Protocol (IP) address, the physical (Media Access Control, MAC) address or IP address of the internal network asset, and the traffic direction learned by MAC. However, the above three judgment methods have high standards for the network environment of the application. When both sides of the network boundary contain public network addresses, there are many internal asset addresses, or there is less learnable traffic, the direction of network traffic cannot be effectively determined. Therefore, how to efficiently and accurately determine the network boundary and identify the direction of network traffic is a technical problem commonly faced by various types of traffic analysis systems.

Summary of the invention

In view of this, the present invention proposes a network flow direction identification method, device and medium, which solves the problem that the network flow direction cannot be effectively determined during the network flow analysis process, achieves better network environment adaptability, reduces maintenance costs, and improves the accuracy and efficiency of network flow direction identification.

Based on the above purpose, an embodiment of the present invention provides a method for identifying a network flow direction, which specifically includes the following steps:

Obtain the MAC addresses of all access traffic and the communication relationship between the MAC addresses;

Based on the MAC addresses and the communication relationships, establish at least one MAC address bipartite graph;

Selecting first flows with deterministic flow directions from access flows corresponding to each MAC address bipartite graph respectively;

Based on all MAC address bipartite graphs and first flows corresponding to each MAC address bipartite graph, flow directions of all access flows are identified.

In some implementations, the step of establishing at least one MAC address bipartite graph based on the MAC address and the communication relationship includes:

At least one MAC address bipartite graph is established by using the MAC addresses as nodes and the communication relationships as connecting lines.

In some implementations, the step of screening the first traffic with a deterministic traffic direction from the access traffic corresponding to each MAC address bipartite graph includes:

According to the application scenario, a local traffic direction judgment library including at least one identification strategy is established;

Based on the identification strategy in the local traffic direction judgment library, the first traffic with a deterministic traffic direction is screened out from the access traffic corresponding to each MAC address bipartite graph.

In some implementations, the step of identifying the traffic direction of all access traffic based on all MAC address bipartite graphs and the first traffic corresponding to each MAC address bipartite graph includes:

For each MAC address bipartite graph, all MAC addresses included therein are divided into a first MAC address set and a second MAC address set located in two different network areas, and a first flow direction of the corresponding first flow is determined;

Based on the first traffic direction of each MAC address bipartite graph, the first MAC address set, and the second MAC address set, identifying the traffic direction of the access traffic corresponding to each of the MAC address bipartite graphs;

Based on the traffic directions of the access traffic corresponding to all the MAC address bipartite graphs respectively, the traffic directions of all the access traffic are obtained.

In some implementations, the step of identifying the traffic direction of the access traffic corresponding to each of the MAC address bipartite graphs based on the first traffic direction of each MAC address bipartite graph, the first MAC address set, and the second MAC address set includes:

For each MAC address bipartite graph, based on a union-find algorithm, a first MAC address union-find set of the first MAC address set is established, and a second MAC address union-find set of the second MAC address set is established;

Obtain an external MAC address and an internal MAC address corresponding to the first flow in each MAC address bipartite graph, and determine a matching relationship between the external MAC address and the internal MAC address and the first MAC address set and the second MAC address set in the corresponding MAC address bipartite graph, respectively, based on a union-find set of the first MAC address and a union-find set of the second MAC address, and determine whether the first flow direction is an inline direction or an external direction;

Based on the matching relationship and whether the first traffic direction is an inline direction or an outline direction, a traffic direction of the access traffic corresponding to each of the MAC address bipartite graphs is identified.

In some implementations, the step of identifying the flow direction of the access flow corresponding to each of the MAC address bipartite graphs based on the matching relationship and whether the first flow direction is an inline direction or an outline direction includes:

For each of the MAC address bipartite graphs, if the first traffic direction is an external connection direction, and the external network MAC address is located in the first MAC address set and/or the internal network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the second MAC address set to the first MAC address set.

In some implementations, the step of identifying the flow direction of the access flow corresponding to each of the MAC address bipartite graphs based on the matching relationship and whether the first flow direction is an inline direction or an outline direction includes:

For each of the MAC address bipartite graphs, if the first traffic direction is an external connection direction, and the internal network MAC address is located in the first MAC address set and/or the external network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the first MAC address set to the second MAC address set.

In some implementations, the step of identifying the flow direction of the access flow corresponding to each of the MAC address bipartite graphs based on the matching relationship and whether the first flow direction is an inline direction or an outline direction includes:

For each of the MAC address bipartite graphs, if the first traffic direction is an inline direction, and the external network MAC address is located in the first MAC address set and/or the internal network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the first MAC address set to the second MAC address set.

In some implementations, the step of identifying the flow direction of the access flow corresponding to each of the MAC address bipartite graphs based on the matching relationship and whether the first flow direction is an inline direction or an outline direction includes:

For each of the MAC address bipartite graphs, if the first traffic direction is an inline direction, and the internal network MAC address is located in the first MAC address set and/or the external network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the second MAC address set to the first MAC address set.

According to another aspect of an embodiment of the present invention, a computer device is provided, comprising: at least one processor; and a memory, wherein the memory stores a computer program executable on the processor, and the computer program implements the steps of the above method when executed by the processor.

According to another aspect of the embodiments of the present invention, a computer-readable storage medium is provided, which stores a computer program that implements the above method steps when executed by a processor.

The present invention has at least the following beneficial technical effects: pre-analyzing the MAC addresses of all accessed traffic and their communication relationships to form at least one MAC address bipartite graph, which can quickly aggregate or divide the MAC addresses of all traffic, and at the same time screen out the first traffic with identifiable traffic direction from the accessed traffic corresponding to each MAC address bipartite graph, based on the first traffic of each MAC address bipartite graph and all MAC address bipartite graphs, the purpose of quickly identifying the traffic direction of global network traffic is achieved, forming a traffic direction judgment capability for global traffic, reducing the maintenance cost of global network flow direction identification while improving the accuracy and efficiency of global network flow direction identification.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can be obtained based on these drawings without paying creative work.

FIG1 is a flow chart of an embodiment of a network flow direction identification method provided by the present invention;

FIG2 is a schematic diagram of an embodiment of a network flow direction identification method provided by the present invention;

FIG3 is a schematic diagram of the structure of a computer device according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of the structure of an embodiment of a computer-readable storage medium provided by the present invention.

DETAILED DESCRIPTION

In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the embodiments of the present invention are further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

It should be noted that all expressions using "first" and "second" in the embodiments of the present invention are for distinguishing two non-identical entities with the same name or non-identical parameters. It can be seen that "first" and "second" are only for the convenience of expression and should not be understood as limitations on the embodiments of the present invention. The subsequent embodiments will not explain this one by one.

Based on the above purpose, the first aspect of the embodiment of the present invention provides an embodiment of a network flow direction identification method. As shown in FIG1 , the method comprises the following steps:

S100, obtaining MAC addresses of all access traffic and obtaining the communication relationship between the MAC addresses.

S200: Establish at least one MAC address bipartite graph based on the MAC addresses and communication relationships.

S300, filtering first flows with deterministic flow directions from access flows corresponding to respective MAC address bipartite graphs.

S400, identifying the traffic direction of all access traffic based on all MAC address bipartite graphs and the first traffic corresponding to each MAC address bipartite graph.

The above-mentioned network flow direction identification method pre-analyzes the MAC addresses of all accessed traffic and their communication relationships to form at least one MAC address bipartite graph, which can quickly aggregate or divide the MAC addresses of all traffic, and at the same time screen out the first traffic that can identify the traffic direction from the accessed traffic corresponding to each MAC address bipartite graph. Based on the first traffic of each MAC address bipartite graph and all MAC address bipartite graphs, the purpose of quickly identifying the traffic direction of the global network traffic is achieved, forming the traffic direction judgment capability for the global traffic, reducing the maintenance cost of the global network flow direction identification while improving the accuracy and efficiency of the global network flow direction identification.

The above step 200 specifically includes:

S210, using MAC addresses as nodes and communication relationships as connecting lines to establish at least one MAC address bipartite graph.

At the network boundary, MAC addresses can stably represent a large number of network assets and have a large coverage. During the traffic analysis process, the MAC addresses in all access traffic can be extracted, and the communication relationships corresponding to the MAC addresses can be extracted. With MAC addresses as nodes and communication relationships as connecting lines, at least one undirected graph can be established. The undirected graph is further drawn as a MAC address bipartite graph to obtain at least one MAC address bipartite graph. Among them, all MAC addresses included in the MAC address bipartite graph can be clearly divided into sets of two network areas based on the connecting lines.

The above-mentioned network flow direction identification method can form a global MAC address bipartite graph through only a short MAC address analysis during the network traffic analysis process, thereby quickly forming the ability to identify the direction of global network traffic, reducing the maintenance cost of global network flow direction identification while improving the accuracy and efficiency of global network flow direction identification.

The above step 300 specifically includes:

S310: Establish a local traffic direction determination library including at least one identification strategy according to an application scenario.

S320 , based on the identification strategy in the local traffic direction determination library, select the first traffic with a deterministic traffic direction from the access traffic corresponding to each MAC address bipartite graph.

Based on the application scenario, set one or more identification strategies that can locally identify the direction of traffic. This identification strategy does not need to have the ability to identify and cover the direction of global traffic, but it needs to have a high traffic matching probability and accurate traffic identification capabilities. For different network boundary environments, the optimal identification strategy is usually not completely consistent and can be flexibly configured based on the application scenario.

The traffic direction includes the internal direction and the external direction. The internal direction may include the communication behavior initiated by the external network assets to the internal network assets in the internal and external network environments. The external direction may include the communication behavior initiated by the internal network assets to the external network assets in the internal and external network environments.

In some embodiments, the identification strategy may include, but is not limited to, one or more of the following:

1. Based on the intranet environment, configure the external Domain Name System (DNS) access that appears with a high probability as external traffic, or configure the traffic initiated by the LAN IP address as external traffic.

2. For an environment with fixed network assets in a certain direction, such as fixed network assets such as servers, interfaces or network devices, identify the traffic direction based on the direction of the fixed network assets.

3. For an environment with a network service interface with a determined access direction, identify the traffic direction based on the access direction of the interface.

4. For an environment where a certain direction is determined to be a network in a certain region, the traffic direction is identified based on the communication behavior of IPs outside the region. For example, for an area within Sichuan Province, the traffic direction initiated by IPs outside Sichuan Province is regarded as inline direction traffic.

After completing the setting of one or more identification strategies, the preparation of the local traffic direction judgment library can be completed, the access traffic can be analyzed, and the traffic that meets the identification strategies in the local traffic direction judgment library can be screened out. The screened out traffic is used as the first traffic. At the same time, the traffic direction identification result corresponding to the first traffic is obtained and the traffic direction of the first traffic is marked.

By putting all traffic direction identification results into the MAC address bipartite graph, once individual traffic direction identification results are inconsistent with the majority traffic direction identification results, that is, there is a conflict between a few traffic direction identification results and other traffic direction identification results in the MAC address bipartite graph, the erroneous identification strategies that filter out erroneous traffic direction identification results can be automatically shielded and warned in the local traffic direction judgment library, and relevant technical personnel can also discover the erroneous identification strategies in time and correct them.

The above-mentioned network flow direction identification method analyzes the access traffic by setting the identification strategy to establish a local traffic direction judgment library to obtain the traffic with identifiable traffic direction. It can realize that only a small or local network flow direction judgment library is needed to associate with the global network traffic. In most application scenarios, the local traffic direction judgment library is simpler, clearer and more stable to implement. It is no longer necessary to maintain a large number of network traffic direction judgment methods or network asset area judgment methods, which greatly reduces the maintenance cost of global network flow direction identification. At the same time, based on the MAC address bipartite graph, it can timely discover and eliminate erroneous identification strategies, thereby ensuring the correctness of global flow direction identification.

Specifically, the above step 400 includes:

S410: For each MAC address bipartite graph, divide all MAC addresses included therein into a first MAC address set and a second MAC address set located in two different network areas, and determine a first flow direction of a corresponding first flow.

S420: Based on the first traffic direction of each MAC address bipartite graph, the first MAC address set, and the second MAC address set, identify the traffic direction of the access traffic corresponding to each MAC address bipartite graph.

S430, obtaining the traffic directions of all access traffic based on the traffic directions of the access traffic corresponding to all MAC address bipartite graphs.

Preliminary analysis is performed on the MAC addresses and communication relationships of all access traffic to obtain at least one MAC address bipartite graph, and the MAC addresses corresponding to each MAC address bipartite graph can be divided into MAC address sets of two different network areas. Among them, the network area may include an external network area and an internal network area, and the MAC address set corresponding to the internal network area includes the internal network MAC address, and the MAC address set corresponding to the external network area includes the external network MAC address. The MAC address collections of the two network areas can respectively represent the network asset collections of the areas on both sides of the network boundary. After each MAC address bipartite graph divides all the MAC addresses included in each of the two network areas into sets, the flow direction of the first flow corresponding to each MAC address bipartite graph is determined, and then the flow direction of the access flow corresponding to each MAC address bipartite graph is determined. When the flow direction of the access flow corresponding to each of the MAC address bipartite graphs is determined, the flow direction identification of the global flow can be completed.

The above-mentioned network flow direction identification method, during the traffic analysis process, forms a MAC address set of different network areas for the MAC address bipartite graph, and determines the traffic direction of the first traffic corresponding to the MAC address bipartite graph, thereby quickly forming the ability to identify the global network traffic direction, reducing the maintenance cost of global network flow direction identification while improving the accuracy and efficiency of global network flow direction identification.

Specifically, the above step 420 includes:

S421 , for each MAC address bipartite graph, based on a union-find algorithm, establish a first MAC address union-find set of the first MAC address set, and establish a second MAC address union-find set of the second MAC address set.

S422, obtain the external network MAC address and the internal network MAC address corresponding to the first flow in each MAC address bipartite graph, and based on the first MAC address union-find set and the second MAC address union-find set, determine the matching relationship between the external network MAC address and the internal network MAC address and the first MAC address set and the second MAC address set in the corresponding MAC address bipartite graph, and determine whether the first flow direction is the inline direction or the external direction.

S423: Based on the matching relationship and whether the first traffic direction is an inline direction or an outline direction, identify the traffic direction of the access traffic corresponding to each MAC address bipartite graph.

Based on the union-find algorithm, a union-find tree is established for the MAC address sets of the two areas corresponding to each MAC address bipartite graph, and the union-find sets corresponding to the MAC address sets of the two areas are obtained, that is, the establishment of the first MAC address union-find set of the first MAC address set is completed, and the establishment of the second MAC address union-find set of the second MAC address set is completed.

At the same time, obtain the external network MAC address and the internal network MAC address corresponding to each first flow in each MAC address bipartite graph. Through the first MAC address union-find set and the second MAC address union-find set, respectively query which MAC address set includes the external network MAC address and which MAC address set includes the internal network MAC address, and obtain the matching relationship between the external network MAC address and the internal network MAC address and the first MAC address set and the second MAC address set in the corresponding MAC address bipartite graph. Further, through the matching relationship and the flow direction of the first flow, identify the flow direction of each MAC address bipartite graph's access flow.

The above-mentioned network flow direction identification method, by determining the matching relationship between the external network MAC address and the internal network MAC address of the first flow and the first MAC address set and the second MAC address set, enables the first MAC address set and the second MAC address set to learn the first flow with identifiable flow direction, identify the flow direction of the access flow corresponding to each MAC address bipartite graph, and realize the rapid formation of flow direction identification capability for global flow, while reducing the maintenance cost of global network flow direction identification, and improving the accuracy and efficiency of global network flow direction identification.

Specifically, the above step 423 includes:

S4231, for each MAC address bipartite graph, if the first traffic direction is an external connection direction, and the external network MAC address is located in the first MAC address set and/or the internal network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the second MAC address set to the first MAC address set.

S4232, for each MAC address bipartite graph, if the first traffic direction is an external connection direction, and the internal network MAC address is located in the first MAC address set and/or the external network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the first MAC address set to the second MAC address set.

S4233, for each MAC address bipartite graph, if the first traffic direction is an inline direction, and the external network MAC address is located in the first MAC address set and/or the internal network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the first MAC address set to the second MAC address set.

S4234, for each MAC address bipartite graph, if the first traffic direction is an inline direction, and the internal network MAC address is located in the first MAC address set and/or the external network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the second MAC address set to the first MAC address set.

The external network MAC address and the internal network MAC address corresponding to the first flow with a deterministic flow direction are matched with the MAC address sets located in different network areas respectively. When it is determined that the MAC address set includes the external network MAC address corresponding to the first flow, it is determined that the MAC address set has a matching relationship with the external network MAC address. When it is determined that the MAC address set includes the internal network MAC address corresponding to the first flow, it is determined that the MAC address set has a matching relationship with the internal network MAC address. Further, based on the matching relationship and the first flow direction, the flow direction of the access flow corresponding to the corresponding MAC address bipartite graph is marked. When the flow direction marking of the access flow corresponding to all MAC address bipartite graphs is completed, the flow direction of the global flow can be determined.

Based on the preliminary analysis of the communication relevance of all access traffic, a MAC address bipartite graph is established to divide the MAC addresses in the network into two different MAC address sets. Subsequently, only the area of any MAC address in any MAC address set is determined to determine the area where the MAC addresses of all access traffic corresponding to the MAC address bipartite graph are located. That is, when only the external network MAC address of the first traffic is confirmed to be in the first MAC address set, it can be determined that all MAC addresses included in the first MAC address set are external network MAC addresses, and all MAC addresses included in the second MAC address set are internal network MAC addresses.

When the first traffic direction is an external connection direction, and it is confirmed that the external network MAC address is located in the first MAC address set, or it is confirmed that the internal network MAC address is located in the second MAC address set, or it is confirmed that the external network MAC address is located in the first MAC address set and the internal network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the second MAC address set to the first MAC address set.

When the first traffic direction is an external connection direction, and it is confirmed that the external network MAC address is located in the second MAC address set, or it is confirmed that the internal network MAC address is located in the first MAC address set, or it is confirmed that the external network MAC address is located in the second MAC address set and the internal network MAC address is located in the first MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the first MAC address set to the second MAC address set.

When the first traffic direction is an inline direction, and it is confirmed that the external network MAC address is located in the first MAC address set, or it is confirmed that the internal network MAC address is located in the second MAC address set, or it is confirmed that the external network MAC address is located in the first MAC address set and the internal network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the first MAC address set to the second MAC address set.

When the first traffic direction is an inline direction, and it is confirmed that the external network MAC address is located in the second MAC address set, or it is confirmed that the internal network MAC address is located in the first MAC address set, or it is confirmed that the external network MAC address is located in the second MAC address set and the internal network MAC address is located in the first MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the second MAC address set to the first MAC address set.

After marking the traffic direction of the access traffic corresponding to all MAC address bipartite graphs, for subsequent access traffic, by analyzing the MAC addresses and communication relationships of the subsequent access traffic, determine which specific MAC address bipartite graph the subsequent access traffic is divided into, and determine the matching relationship between the two MAC addresses corresponding to the subsequent access traffic and the first MAC address set or the second MAC address set of the MAC address bipartite graph, and finally mark the traffic direction of the subsequent access traffic as the traffic direction of the access traffic corresponding to the MAC address bipartite graph according to the matching relationship.

The above-mentioned network flow direction identification method determines the matching relationship between the external network MAC address and the internal network MAC address corresponding to the first flow and the first MAC address set and the second MAC address set, so that the first MAC address set and the second MAC address set learn the network flow with determined direction, and identifies the flow corresponding to all MAC addresses in the first MAC address set and the second MAC address set through the flow direction learning result, and then performs subsequent flow direction identification, quickly forming the flow direction identification capability for global flow, reducing the maintenance cost of global network flow direction identification while improving the accuracy and efficiency of global network flow direction identification.

In some embodiments, a schematic diagram of a network flow direction identification method is shown in FIG2. The network flow direction identification method in this embodiment includes the preparation of a local flow direction judgment library, a flow learning step, and a MAC address direction confirmation step. Among them, the flow learning step and the MAC address direction confirmation step are continuously performed based on the continuous flow analysis. Once the network environment changes, such as the MAC address changes, the changes in the network environment can be exposed in time in the MAC address bipartite graph of the flow analysis, and the MAC address bipartite graph can be continuously maintained to ensure that the flow direction identification method is synchronized with the flow direction identification capability of the actual network environment.

The above-mentioned network flow direction identification method pre-analyzes the MAC addresses of all accessed traffic and their communication relationships to form at least one MAC address bipartite graph, which can quickly aggregate or divide the MAC addresses of all traffic, and at the same time screen out the first traffic that can identify the traffic direction from the accessed traffic corresponding to each MAC address bipartite graph. Based on the first traffic of each MAC address bipartite graph and all MAC address bipartite graphs, the purpose of quickly identifying the traffic direction of the global network traffic is achieved, forming the traffic direction judgment capability for the global traffic, reducing the maintenance cost of the global network flow direction identification while improving the accuracy and efficiency of the global network flow direction identification.

Based on the same inventive concept, according to another aspect of the present invention, as shown in FIG3 , an embodiment of the present invention further provides a computer device 30, which includes a processor 310 and a memory 320, wherein the memory 320 stores a computer program 321 that can be run on the processor, and the processor 310 executes the steps of the above method when executing the program.

Based on the same inventive concept, according to another aspect of the present invention, as shown in FIG. 4 , an embodiment of the present invention further provides a computer-readable storage medium 40 , which stores a computer program 410 that performs the above method when executed by a processor.

Finally, it should be noted that a person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium of the program can be a disk, an optical disk, a read-only storage memory (ROM) or a random access memory (RAM), etc. The above-mentioned computer program embodiments can achieve the same or similar effects as the corresponding above-mentioned arbitrary method embodiments.

It will also be appreciated by those skilled in the art that various exemplary logic blocks, modules, circuits and algorithm steps described in conjunction with the disclosure herein can be implemented as electronic hardware, computer software or a combination of the two. In order to clearly illustrate this interchangeability of hardware and software, a general description has been given to the functions of various schematic components, blocks, modules, circuits and steps. Whether this function is implemented as software or hardware depends on specific applications and the design constraints imposed on the entire system. Those skilled in the art can implement the function in various ways for each specific application, but this implementation decision should not be interpreted as causing a departure from the disclosed scope of the embodiments of the present invention.

The above are exemplary embodiments disclosed in the present invention, but it should be noted that various changes and modifications may be made without departing from the scope of the embodiments disclosed in the present invention as defined in the claims. The functions, steps and/or actions of the method claims according to the disclosed embodiments described herein do not need to be performed in any particular order. The serial numbers of the embodiments disclosed in the above embodiments of the present invention are for description only and do not represent the advantages and disadvantages of the embodiments. In addition, although the elements disclosed in the embodiments of the present invention may be described or required in individual form, they may also be understood as multiple unless explicitly limited to the singular.

It should be understood that, as used herein, the singular forms "a", "an" are intended to include the plural forms as well, unless the context clearly supports an exception. It should also be understood that, as used herein, "and/or" refers to any and all possible combinations including one or more of the associated listed items.

A person skilled in the art should understand that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of the disclosure of the embodiments of the present invention (including the claims) is limited to these examples; under the idea of the embodiments of the present invention, the technical features in the above embodiments or different embodiments can also be combined, and there are many other changes in different aspects of the above embodiments of the present invention, which are not provided in detail for the sake of simplicity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the protection scope of the embodiments of the present invention.

Claims (8)

1. A network flow direction identification method, characterized by comprising: Obtain the MAC addresses of all access traffic and the communication relationship between the MAC addresses; Based on the MAC addresses and the communication relationships, establish at least one MAC address bipartite graph; Selecting first flows with deterministic flow directions from access flows corresponding to each MAC address bipartite graph respectively; Based on all MAC address bipartite graphs and first flows corresponding to each MAC address bipartite graph, identifying the flow direction of all access flows; The step of selecting the first flow with a deterministic flow direction from the access flow corresponding to each MAC address bipartite graph includes: According to the application scenario, a local traffic direction judgment library including at least one identification strategy is established; Based on the identification strategy in the local traffic direction judgment library, first traffic with a deterministic traffic direction is screened out from the access traffic corresponding to each MAC address bipartite graph; The step of identifying the flow direction of all access flows based on all MAC address bipartite graphs and the first flow corresponding to each MAC address bipartite graph comprises: For each MAC address bipartite graph, all MAC addresses included therein are divided into a first MAC address set and a second MAC address set located in two different network areas, and a first flow direction of the corresponding first flow is determined; Based on the first traffic direction of each MAC address bipartite graph, the first MAC address set, and the second MAC address set, identifying the traffic direction of the access traffic corresponding to each of the MAC address bipartite graphs; Based on the traffic directions of the access traffic corresponding to all the MAC address bipartite graphs, the traffic directions of all the access traffic are obtained; The step of identifying the flow direction of the access flow corresponding to each MAC address bipartite graph based on the first flow direction of each MAC address bipartite graph, the first MAC address set, and the second MAC address set comprises: For each MAC address bipartite graph, based on a union-find algorithm, a first MAC address union-find set of the first MAC address set is established, and a second MAC address union-find set of the second MAC address set is established; Obtain an external MAC address and an internal MAC address corresponding to the first flow in each MAC address bipartite graph, and determine a matching relationship between the external MAC address and the internal MAC address and the first MAC address set and the second MAC address set in the corresponding MAC address bipartite graph, respectively, based on a union-find set of the first MAC address and a union-find set of the second MAC address, and determine whether the first flow direction is an inline direction or an external direction; Based on the matching relationship and whether the first traffic direction is an inline direction or an outline direction, a traffic direction of the access traffic corresponding to each of the MAC address bipartite graphs is identified. 2. The method according to claim 1, characterized in that the step of establishing at least one MAC address bipartite graph based on the MAC address and the communication relationship comprises: At least one MAC address bipartite graph is established by using the MAC addresses as nodes and the communication relationships as connecting lines. 3. The method according to claim 1 is characterized in that the step of identifying the flow direction of the access flow corresponding to each of the MAC address bipartite graphs based on the matching relationship and whether the first flow direction is an inline direction or an outline direction comprises: For each of the MAC address bipartite graphs, if the first traffic direction is an external connection direction, and the external network MAC address is located in the first MAC address set and/or the internal network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the second MAC address set to the first MAC address set. 4. The method according to claim 1, characterized in that the step of identifying the flow direction of the access flow corresponding to each of the MAC address bipartite graphs based on the matching relationship and whether the first flow direction is an inline direction or an outline direction comprises: For each of the MAC address bipartite graphs, if the first traffic direction is an external connection direction, and the internal network MAC address is located in the first MAC address set and/or the external network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the first MAC address set to the second MAC address set. 5. The method according to claim 1, characterized in that the step of identifying the flow direction of the access flow corresponding to each of the MAC address bipartite graphs based on the matching relationship and whether the first flow direction is an inline direction or an outline direction comprises: For each of the MAC address bipartite graphs, if the first traffic direction is an inline direction, and the external network MAC address is located in the first MAC address set and/or the internal network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the first MAC address set to the second MAC address set. 6. The method according to claim 1, characterized in that the step of identifying the flow direction of the access flow corresponding to each of the MAC address bipartite graphs based on the matching relationship and whether the first flow direction is an inline direction or an outline direction comprises: For each of the MAC address bipartite graphs, if the first traffic direction is an inline direction, and the internal network MAC address is located in the first MAC address set and/or the external network MAC address is located in the second MAC address set, the traffic direction of the access traffic corresponding to the MAC address bipartite graph is marked as flowing from the second MAC address set to the first MAC address set. 7. A computer device comprising: at least one processor; and A memory storing a computer program executable on the processor, wherein the processor executes the steps of the method according to any one of claims 1 to 6 when executing the program. 8. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, performs the steps of the method according to any one of claims 1 to 6.