CN114422267B - Flow detection method, device, equipment and medium - Google Patents
Flow detection method, device, equipment and medium Download PDFInfo
- Publication number
- CN114422267B CN114422267B CN202210202225.XA CN202210202225A CN114422267B CN 114422267 B CN114422267 B CN 114422267B CN 202210202225 A CN202210202225 A CN 202210202225A CN 114422267 B CN114422267 B CN 114422267B
- Authority
- CN
- China
- Prior art keywords
- time sequence
- target
- clustering
- graph
- flow
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 41
- 230000002159 abnormal effect Effects 0.000 claims abstract description 103
- 239000013598 vector Substances 0.000 claims abstract description 99
- 238000000034 method Methods 0.000 claims abstract description 25
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 14
- 238000005070 sampling Methods 0.000 claims description 38
- 238000001228 spectrum Methods 0.000 claims description 20
- 238000012545 processing Methods 0.000 claims description 18
- 238000004590 computer program Methods 0.000 claims description 15
- 238000012163 sequencing technique Methods 0.000 claims description 4
- 238000010586 diagram Methods 0.000 description 17
- 230000006870 function Effects 0.000 description 7
- 238000004891 communication Methods 0.000 description 6
- 230000003287 optical effect Effects 0.000 description 5
- 238000010276 construction Methods 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 4
- 238000004458 analytical method Methods 0.000 description 2
- 239000013307 optical fiber Substances 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 239000004065 semiconductor Substances 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 238000003064 k means clustering Methods 0.000 description 1
- 238000002372 labelling Methods 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000005096 rolling process Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
Landscapes
- Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Bioinformatics & Computational Biology (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- Physics & Mathematics (AREA)
- Bioinformatics & Cheminformatics (AREA)
- General Physics & Mathematics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Debugging And Monitoring (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the disclosure relates to a flow detection method, a device, equipment and a medium, wherein the method comprises the following steps: acquiring an access time sequence map of a to-be-detected end; wherein the access timing graph includes at least one target graph node having an abnormal traffic identification; performing graph representation learning on the access time sequence graph to obtain a time sequence vector corresponding to each graph node in the access time sequence graph; clustering the time sequence vectors according to a preset clustering algorithm to obtain a plurality of clustering categories; and acquiring a target cluster class to which the target map node belongs from the plurality of cluster classes, and determining the abnormal flow of the end to be detected based on the target cluster class. In the embodiment of the disclosure, the detection rate of the abnormal flow with unknown rules is improved, the network safety is ensured, the degree of automation of the abnormal flow marking under a long period of time is improved, and the labor cost consumed by performing the abnormal flow marking is reduced.
Description
Technical Field
The disclosure relates to the field of computer technology, and in particular, to a flow detection method, a flow detection device, a flow detection equipment and a flow detection medium.
Background
With the development of computer technology, network security is increasingly important, and abnormal traffic threatening network security can be detected through a traffic detection technology.
In the related art, a method of built-in rules can be used for detecting the flow, and the flow is screened according to the built-in rules, so that abnormal flow is identified.
However, for the above technical solution, if the rule corresponding to the abnormal traffic is unknown, the abnormal traffic cannot be identified, thereby causing a potential safety hazard of the network.
Disclosure of Invention
In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a flow detection method, a device, equipment and a medium.
In a first aspect, an embodiment of the present disclosure provides a flow detection method, including:
acquiring an access time sequence map of a to-be-detected end; wherein the access timing graph includes at least one target graph node having an abnormal traffic identification;
performing graph representation learning on the access time sequence graph to obtain a time sequence vector corresponding to each graph node in the access time sequence graph; wherein the target graph nodes correspond to target timing vectors;
Clustering the time sequence vectors according to a preset clustering algorithm to obtain a plurality of clustering categories;
and acquiring a target clustering class to which the target time sequence vector belongs from the plurality of clustering classes, and determining the abnormal flow of the end to be detected based on the target clustering class.
In an optional implementation manner, the acquiring the access timing diagram of the to-be-detected end includes:
acquiring access flow data of the to-be-detected end, and constructing an original input sequence according to the access flow data;
sampling the original input sequence to obtain a plurality of subsequences;
calculating a weight index corresponding to the subsequence, sequencing the subsequences from high to low according to the weight index, and taking the first N subsequences as a reference sequence; wherein, N is a positive integer;
and constructing a spectrum node of the access time sequence spectrum according to the reference sequence, constructing a spectrum edge of the access time sequence spectrum according to the time sequence relation of the reference sequence on the original input sequence, and constructing the access time sequence spectrum.
In an alternative embodiment, the method further comprises:
acquiring a historical input sequence comprising an abnormal time period, and sampling the abnormal time period in the historical input sequence to obtain the target map node;
And performing identification processing on the target map node by using the abnormal flow identification.
In an alternative embodiment, the method further comprises:
constructing the access timing graph comprising the target graph nodes according to timing.
In an optional implementation manner, the obtaining, from the plurality of cluster categories, a target cluster category to which the target timing vector belongs, and determining, based on the target cluster category, an abnormal traffic of the to-be-detected end includes:
inquiring whether each clustering category comprises the target time sequence vector, if so, determining the currently processed clustering category as the target clustering category;
obtaining an abnormal time period corresponding to all time sequence vectors belonging to the target clustering category, and determining the flow sent by the end to be detected in the abnormal time period as abnormal flow.
In an alternative embodiment, the method further comprises:
if the clustering category which is currently processed does not comprise the target time sequence vector, randomly selecting M time sequence vectors in the clustering category which is currently processed as sampling time sequence vectors; wherein M is a positive integer;
Analyzing and determining a sampling flow identifier corresponding to each sampling time sequence vector;
and counting the sampling flow identification, and judging whether the flow corresponding to the clustering category which is currently processed is the abnormal flow according to a counting result.
In a second aspect, embodiments of the present disclosure further provide a flow detection device, the device including:
the acquisition module is used for acquiring an access time sequence map of the end to be detected; wherein the access timing graph includes at least one target graph node having an abnormal traffic identification;
the learning module is used for performing graph representation learning on the access time sequence patterns to obtain time sequence vectors corresponding to each pattern node in the access time sequence patterns; wherein the target graph nodes correspond to target timing vectors;
the clustering module is used for carrying out clustering processing on the time sequence vectors according to a preset clustering algorithm to obtain a plurality of clustering categories;
the detection module is used for acquiring a target clustering category to which the target time sequence vector belongs from the plurality of clustering categories, and determining the abnormal flow of the end to be detected based on the target clustering category.
In a third aspect, the present disclosure provides a computer readable storage medium having instructions stored therein, which when run on a terminal device, cause the terminal device to implement the above-described method.
In a fourth aspect, the present disclosure provides an apparatus comprising: the computer program comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, wherein the processor realizes the method when executing the computer program.
In a fifth aspect, the present disclosure provides a computer program product comprising computer programs/instructions which when executed by a processor implement the above-described method.
Compared with the prior art, the technical scheme provided by the embodiment of the disclosure has the following advantages:
according to the flow detection method, an access time sequence map of a to-be-detected end is obtained; wherein the access timing graph includes at least one target graph node having an abnormal traffic identification; performing graph representation learning on the access time sequence graph to obtain a time sequence vector corresponding to each graph node in the access time sequence graph; wherein the target map node corresponds to the target timing vector; clustering the time sequence vectors according to a preset clustering algorithm to obtain a plurality of clustering categories; and acquiring a target clustering class to which the target timing sequence vector belongs from the plurality of clustering classes, and determining the abnormal flow of the end to be detected based on the target clustering class. Therefore, the embodiment of the disclosure can determine the map nodes belonging to the same cluster category as the target map nodes with the abnormal flow marks based on the information carried by the access time sequence map, so that the abnormal flow of the unknown rule is detected through the time sequence characteristics, the detection rate of the abnormal flow of the unknown rule is improved, the network safety is ensured, the automation degree of the abnormal flow marking under a long period is improved, and the labor cost consumed by performing the abnormal flow marking is reduced.
Drawings
The above and other features, advantages, and aspects of embodiments of the present disclosure will become more apparent by reference to the following detailed description when taken in conjunction with the accompanying drawings. The same or similar reference numbers will be used throughout the drawings to refer to the same or like elements. It should be understood that the figures are schematic and that elements and components are not necessarily drawn to scale.
Fig. 1 is a schematic flow chart of a flow detection method according to an embodiment of the disclosure;
fig. 2 is a flow chart of another flow detection method according to an embodiment of the disclosure;
fig. 3 is a schematic structural diagram of a flow rate detection device according to an embodiment of the disclosure;
fig. 4 is a schematic structural diagram of an electronic device according to an embodiment of the disclosure.
Detailed Description
Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure have been shown in the accompanying drawings, it is to be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustration purposes only and are not intended to limit the scope of the present disclosure.
It should be understood that the various steps recited in the method embodiments of the present disclosure may be performed in a different order and/or performed in parallel. Furthermore, method embodiments may include additional steps and/or omit performing the illustrated steps. The scope of the present disclosure is not limited in this respect.
The term "including" and variations thereof as used herein are intended to be open-ended, i.e., including, but not limited to. The term "based on" is based at least in part on. The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments. Related definitions of other terms will be given in the description below.
It should be noted that the terms "first," "second," and the like in this disclosure are merely used to distinguish between different devices, modules, or units and are not used to define an order or interdependence of functions performed by the devices, modules, or units.
It should be noted that references to "one", "a plurality" and "a plurality" in this disclosure are intended to be illustrative rather than limiting, and those of ordinary skill in the art will appreciate that "one or more" is intended to be understood as "one or more" unless the context clearly indicates otherwise.
The names of messages or information interacted between the various devices in the embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.
In order to solve the above-mentioned problems, embodiments of the present disclosure provide a flow detection method, which is described below with reference to specific embodiments.
Fig. 1 is a flow chart of a flow detection method according to an embodiment of the present disclosure, where the flow detection method may be performed by a flow detection device, and the device may be implemented by software and/or hardware, and may be generally integrated in an electronic device. As shown in fig. 1, the method includes:
step 101, obtaining an access time sequence map of a to-be-detected end; wherein the access timing graph includes at least one target graph node having an abnormal traffic identification.
The embodiment of the disclosure can be applied to situations such as big data security analysis, supervision units and the like, in the embodiment, the to-be-detected end sends traffic to access a destination internet protocol (Internet Protocol, IP) address and the like, in the embodiment, the to-be-detected end can be set according to an application scene, the embodiment is not limited, and for example, the to-be-detected end can be a source internet protocol (Internet Protocol, IP) address.
It can be understood that the access initiated by the to-be-detected end has a sequential time sequence relationship, the access characteristic of the to-be-detected end in the time sequence dimension can be represented by the access time sequence map, the construction method of the access time sequence map is various, the access time sequence map can be set according to application requirements and the like, and the embodiment is not limited.
In an alternative embodiment, the access timing graph comprises a plurality of graph nodes, each graph node can represent flow characteristics of a to-be-detected end in a short period of time, and graph edges of the access timing graph can be determined according to a timing relation between every two graph nodes.
The construction method of the map node comprises the following two methods:
in the first method, the number of times that the to-be-detected end accesses to any destination IP address is counted in a plurality of preset time periods, and a plurality of map nodes are constructed according to the counted results.
And secondly, counting the access times of the to-be-detected end to a preset uniform resource positioning system (uniform resource locator, URL) in a plurality of preset time periods, and constructing a plurality of map nodes according to the counting result.
In order to improve automation of labeling the abnormal traffic, the access timing graph may include at least one target graph node with an abnormal traffic identifier, where the target graph node may be constructed in multiple manners, and the embodiment is not limited, for example, a history graph node with the abnormal traffic may be obtained as the target graph node, or a value in the history graph node under the normal traffic may be changed, and the changed history graph node may be taken as the target graph node. And the target graph nodes can be added to the current access time sequence graph according to the time sequence.
Step 102, performing graph representation learning on the access time sequence graph to obtain a time sequence vector corresponding to each graph node in the access time sequence graph, wherein the target graph node corresponds to the target time sequence vector.
Map nodes in the access time sequence map can be mapped into time sequence vectors through graph representation learning, wherein target map nodes are mapped into target time sequence vectors through graph representation learning, and the target time sequence vectors correspond to abnormal traffic as the target map nodes correspond to the abnormal traffic. The topology information in the access time sequence map can be well reserved through graph representation learning, and the distances between time sequence vectors corresponding to map nodes representing similar or similar flow information can be further approximate.
In each map node in the access time sequence map, the map node corresponding to the abnormal flow is different from the map node corresponding to the normal flow in the characteristic, so that after the map representation is learned, the distance between the time sequence vectors corresponding to the abnormal flow is closer, the distance between the time sequence vectors corresponding to the normal flow is also closer, and the distance between the time sequence vectors corresponding to the abnormal flow and the time sequence vectors corresponding to the normal flow is further.
In this embodiment, there are various methods for performing graph representation learning on the time series graph, which may be selected according to application scenarios, for example, the time series graph may be processed by using a graph representation learning model based on graph features, where the graph representation learning model based on graph features may be a graph rolling network (Graph Convolutional Networks, GCN) model or the like.
And step 103, clustering the time sequence vectors according to a preset clustering algorithm to obtain a plurality of clustering categories.
Further, after obtaining the timing vector corresponding to each timing node in the access timing map, a preset clustering algorithm may be used to perform clustering processing on the timing vector, and a plurality of clustering categories may be obtained through clustering processing, where the number of clustering categories, granularity of the clustering processing, and the like may be determined according to service requirements, and the embodiment is not limited. Among the clustering algorithms for clustering the timing vectors include, but are not limited to: k-means clustering algorithms or density-based clustering algorithms.
Step 104, obtaining a target clustering class to which the target time sequence vector belongs from the plurality of clustering classes, and determining the abnormal flow of the end to be detected based on the target clustering class.
In this embodiment, a plurality of clustering categories obtained by clustering are searched, and a target clustering category to which a target timing sequence vector belongs is determined therefrom, and because the flow corresponding to the target timing sequence vector is an abnormal flow, the flow corresponding to other timing sequence vectors included in the target clustering category is also an abnormal flow, so that the timing sequence vectors in the target clustering category can be analyzed, and thus the abnormal flow sent by each end to be detected is determined.
In an alternative embodiment, determining the abnormal flow specifically includes the steps of:
step a1, inquiring whether each clustering category comprises a target time sequence vector, and if the current clustering category comprises the target time sequence vector, determining the current clustering category as a target clustering category.
In this embodiment, there are various methods for querying whether the clustering class includes the target timing vector, and the method may be set according to the application scenario, which is not limited in this embodiment. For example, in some application scenarios, the target timing vector has an abnormal traffic identifier consistent with the target graph node, so that each cluster category can be searched according to the abnormal traffic identifier, if the abnormal traffic identifier is searched in the currently processed cluster category, the current processed cluster category is described as including the target timing vector, and the cluster category is further determined as the target cluster category.
Step a2, obtaining an abnormal time period corresponding to all time sequence vectors belonging to the target clustering category, and determining the flow sent by the end to be detected in the abnormal time period as abnormal flow.
Further, all time sequence vectors included in the target cluster category are obtained, a to-be-detected end and an abnormal time period corresponding to each time sequence vector are determined, and the flow sent by the to-be-detected end in the corresponding abnormal time period is determined to be abnormal flow.
For example, if the first cluster includes the target timing vector, the first timing vector and the second timing vector, and the to-be-detected end corresponding to the first timing vector is IP1, the corresponding time period is 1 day to 7 days; the to-be-detected end corresponding to the second time sequence vector is also IP1, and the corresponding time period is 3 days to 9 days. The traffic sent by IP1 on days 1 to 9 may be considered as abnormal traffic.
In some application scenarios, the currently processed cluster category does not include the target timing vector, and the timing vector in the cluster category can be sampled and detected, so as to further determine whether the cluster category corresponds to abnormal traffic, which specifically includes:
step b1, randomly selecting M time sequence vectors in the current processing clustering category as sampling time sequence vectors if the current processing clustering category does not comprise the target time sequence vector; wherein M is a positive integer.
If the currently processed cluster category does not include the target time sequence vector, whether the cluster category corresponds to abnormal traffic can be further judged by sampling the time sequence vector in the cluster category.
Specifically, M timing vectors in the currently processed cluster category may be randomly selected as sampling timing vectors, where M may be determined according to parameters such as the number of timing vectors in the cluster category.
And b2, analyzing and determining a sampling flow identifier corresponding to each sampling time sequence vector.
In this embodiment, the alternative sampling flow identifier may be set according to the user requirement, for example, the sampling flow identifier may include: any one or more of website traffic identification, database traffic identification, mail traffic identification, domain name service traffic identification, file server identification, and abnormal traffic identification.
In an alternative embodiment, a corresponding relation between the sampling flow identifier and the keyword may be established, the original data corresponding to the sampling timing vector is obtained, the original data is retrieved according to the keyword, and the sampling flow identifier corresponding to the sampling timing vector is determined according to the hit keyword.
And b3, counting the sampled flow marks, and judging whether the flow corresponding to the current processed clustering category is abnormal flow or not according to the counting result.
Further, statistics can be performed on sampling flow identifiers corresponding to the M time sequence vectors, the most number of sampling flow identifiers are used as category identifiers of the current processing clustering category, if the category identifiers are abnormal flow identifiers, the flow corresponding to the clustering category is determined to be abnormal flow, and then the time sequence vectors in the clustering category can be analyzed, so that abnormal flow is determined.
In summary, according to the flow detection method of the embodiment of the present disclosure, an access timing diagram of a to-be-detected end is obtained; wherein the access timing graph includes at least one target graph node having an abnormal traffic identification; performing graph representation learning on the access time sequence graph to obtain a time sequence vector corresponding to each graph node in the access time sequence graph; clustering the time sequence vectors according to a preset clustering algorithm to obtain a plurality of clustering categories; and acquiring a target cluster class to which the target map node belongs from the plurality of cluster classes, and determining the abnormal flow of the end to be detected based on the target cluster class. Therefore, the embodiment of the disclosure can determine the map nodes belonging to the same cluster category as the target map nodes with the abnormal flow marks based on the information carried by the access time sequence map, so that the abnormal flow of the unknown rule is detected through the time sequence characteristics, the detection rate of the abnormal flow of the unknown rule is improved, the network safety is ensured, the automation degree of the abnormal flow marking under a long period is improved, and the labor cost consumed by performing the abnormal flow marking is reduced.
Based on the above embodiments, fig. 2 is a flow chart of another flow detection method provided in the embodiments of the present disclosure, as shown in fig. 2, where the obtaining an access timing chart of a to-be-detected end includes the following steps:
step 201, access flow data of a to-be-detected end is obtained, and an original input sequence is constructed according to the access flow data.
In this embodiment, the access traffic data records the access condition of the to-be-detected end, where the access traffic data may be set according to an application scenario, etc., and the embodiment is not limited, and the access traffic data may be, for example, network traffic data or a system access log. After the access flow data of the detection end is acquired, the access flow data can be analyzed, so that an original input sequence is constructed.
In an alternative implementation manner, a time period can be preset, access flow data in the preset time period is obtained, the access times of each end to be detected are counted according to a preset sub-time period, and the access times are ordered according to time sequence, so that an original input sequence is constructed. The preset time period and the preset sub-time period may be set according to the application scenario, for example, the preset time period may be any value from half a year to one year, and the preset sub-time period may be 1 day.
Step 202, sampling the original input sequence to obtain a plurality of subsequences.
In this embodiment, the original input sequence may be sampled by using a sliding window according to a sliding distance, so as to obtain a plurality of subsequences, where the sliding window length and the sliding distance may be set according to an application scenario, for example, the sliding window length may be 7, and the sliding distance may be 2.
For example, if the original input sequence is {12, 13, 10, 12, 11, 13, 15, 16, 11, 12}, the first subsequence is {12, 13, 10, 12, 11, 13, 15} and the second subsequence is {10, 12, 11, 13, 15, 16, 11}, of two subsequences obtained by sampling the original input sequence.
Step 203, calculating a weight index corresponding to the subsequences, sorting the subsequences from high to low according to the weight index, and taking the first N subsequences as a reference sequence, wherein N is a positive integer.
In this embodiment, the reference sequence is a sub-sequence with a stronger representativeness, and the weight index can represent the representativeness of the sub-sequence, so that the sub-sequence can be screened according to the weight index, and the reference sequence is determined, where the weight index includes, but is not limited to, an information gain of the sub-sequence or a repeated number of the sub-sequence, and further the sub-sequences are ordered according to the weight index from a large value to a small value, and the larger the value of the weight index is, the stronger the representativeness of the sub-sequence is, and the first N sub-sequences are taken as the reference sequence.
In an alternative embodiment, if the number of repetitions of the subsequence is used as a weight index, the number of repetitions of each subsequence in the subsequence obtained by sampling may be counted, and the subsequence with the repetition number of the first N sequences is used as a reference sequence.
In another alternative embodiment, if the information gain of the subsequence is used as a weight index, the information gain of the currently processed subsequence in the distance dimension relative to each original input sequence may be calculated, the subsequence with the largest information gain is extracted as a reference sequence, the currently extracted reference sequence is removed from the subsequences, and the subsequence with the largest information gain is extracted from the current subsequence again as the reference sequence, and the N reference sequences are sequentially extracted.
And 204, constructing a graph node of the access time sequence graph according to the reference sequence, constructing a graph edge of the access time sequence graph according to the time sequence relation of the reference sequence on the original input sequence, and constructing the access time sequence graph.
Furthermore, the reference sequence can be used as a graph node of the time sequence graph, the reference sequence belonging to the same original input sequence is determined, and then according to the time sequence relation of the reference sequence in the same original input sequence, a graph edge is constructed between two reference sequences adjacent in time sequence, so that an access time sequence graph is constructed according to the graph node and the graph edge.
For example: if the original input sequence is {12, 13, 10, 12, 11, 13, 15, 16, 11, 12}, the reference sequence determined according to the weight index is: the first reference sequence {12, 13, 10, 12, 11, 13, 15} and the second reference sequence {10, 12, 11, 13, 15, 16, 11} are set to be {10, 12, 11, 16, 11}, and since the timing of the first reference sequence precedes the timing of the second reference sequence in the original input sequence, a map edge directed from the first reference sequence to the second reference sequence can be established between the first reference sequence and the second reference sequence, and the first reference sequence and the second reference sequence are set as map nodes.
In this embodiment, an access timing graph including the target graph node may also be constructed, specifically including:
firstly, a historical input sequence comprising abnormal time periods is obtained, sampling processing is carried out on the abnormal time periods in the historical input sequence, and a target map node is obtained.
In this embodiment, the time sequence of the history input sequence is before the time sequence of the original input sequence, and in the history input sequence, there is an abnormal time period corresponding to the abnormal traffic, so that the abnormal time period in the history input sequence can be sampled and processed to obtain the target graph node with the same length as the graph node in the access time sequence graph. It should be noted that the number of the target map nodes may be one or more, which is not limited in this embodiment.
Further, the target map node is identified by using the abnormal flow identification. The target graph nodes can be distinguished from other graph nodes through the abnormal flow identification, so that the target graph nodes can be conveniently indexed later.
And finally, constructing an access time sequence map comprising the target map nodes according to the time sequence.
In this embodiment, the target graph nodes are sampled from the history input sequence, so that the timing of the target graph nodes is earlier than the timing of the graph nodes sampled from the original input sequence, and thus the construction of the access timing graph can be performed before the target graph nodes are arranged in front of other graph nodes according to the timing.
In summary, according to the flow detection method in the embodiment of the disclosure, the reference sequence is determined according to the weight index, the data with higher representativeness is reserved, and redundant data is screened out, so that the constructed access timing diagram can better reflect whether the end to be detected has abnormal flow or not, and meanwhile, the calculation power and the labor consumed for determining the abnormal flow are reduced, and the access timing diagram is determined based on the access flow data and contains more comprehensive information.
Fig. 3 is a schematic structural diagram of a flow detection device according to an embodiment of the present disclosure, where the flow detection device may be implemented by software and/or hardware, and may be generally integrated in an electronic device. As shown in fig. 3, the apparatus includes:
The acquisition module 301 is configured to acquire an access timing diagram of a to-be-detected end; wherein the access timing graph includes at least one target graph node having an abnormal traffic identification;
the learning module 302 is configured to perform graph representation learning on the access timing diagram to obtain a timing vector corresponding to each diagram node in the access timing diagram; wherein the target graph nodes correspond to target timing vectors;
the clustering module 303 is configured to perform clustering processing on the timing vectors according to a preset clustering algorithm to obtain a plurality of clustering categories;
the detection module 304 is configured to obtain a target cluster class to which the target timing vector belongs from the plurality of cluster classes, and determine an abnormal flow of the to-be-detected end based on the target cluster class.
Optionally, the acquiring module 301 is configured to:
acquiring access flow data of the to-be-detected end, and constructing an original input sequence according to the access flow data;
sampling the original input sequence to obtain a plurality of subsequences;
calculating a weight index corresponding to the subsequence, sequencing the subsequences from high to low according to the weight index, and taking the first N subsequences as a reference sequence; wherein, N is a positive integer;
And constructing a spectrum node of the access time sequence spectrum according to the reference sequence, constructing a spectrum edge of the access time sequence spectrum according to the time sequence relation of the reference sequence on the original input sequence, and constructing the access time sequence spectrum.
Optionally, the apparatus further comprises:
the first sampling module is used for acquiring a historical input sequence comprising an abnormal time period, and sampling the abnormal time period in the historical input sequence to obtain the target map node;
and the identification module is used for carrying out identification processing on the target map node by using the abnormal flow identification.
Optionally, the apparatus further comprises:
and the construction module is used for constructing the access time sequence map comprising the target map nodes according to time sequence.
Optionally, the detection module 304 is configured to:
inquiring whether each clustering category comprises the target time sequence vector, if so, determining the currently processed clustering category as the target clustering category;
obtaining an abnormal time period corresponding to all time sequence vectors belonging to the target clustering category, and determining the flow sent by the end to be detected in the abnormal time period as abnormal flow.
Optionally, the apparatus further comprises:
the second sampling module is used for randomly selecting M time sequence vectors in the current clustering category as sampling time sequence vectors if the current clustering category does not comprise the target time sequence vector; wherein M is a positive integer;
the analysis module is used for analyzing and determining the sampling flow identification corresponding to each sampling time sequence vector;
and the judging module is used for counting the sampling flow identification and judging whether the flow corresponding to the clustering category which is currently processed is the abnormal flow according to the counting result.
The flow detection device provided by the embodiment of the disclosure can execute the flow detection method provided by any embodiment of the disclosure, and has the corresponding functional modules and beneficial effects of the execution method.
In order to implement the above embodiments, the present disclosure also proposes a computer program product comprising a computer program/instruction which, when executed by a processor, implements the flow detection method in the above embodiments
Fig. 4 is a schematic structural diagram of an electronic device according to an embodiment of the disclosure.
Referring now in particular to fig. 4, a schematic diagram of an electronic device 400 suitable for use in implementing embodiments of the present disclosure is shown. The electronic device 400 in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and the like, and stationary terminals such as digital TVs, desktop computers, and the like. The electronic device shown in fig. 4 is merely an example and should not be construed to limit the functionality and scope of use of the disclosed embodiments.
As shown in fig. 4, the electronic device 400 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 401, which may perform various suitable actions and processes according to a program stored in a Read Only Memory (ROM) 402 or a program loaded from a storage means 408 into a Random Access Memory (RAM) 403. In the RAM403, various programs and data necessary for the operation of the electronic device 400 are also stored. The processing device 401, the ROM 402, and the RAM403 are connected to each other by a bus 404. An input/output (I/O) interface 405 is also connected to bus 404.
In general, the following devices may be connected to the I/O interface 405: input devices 406 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; an output device 407 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 408 including, for example, magnetic tape, hard disk, etc.; and a communication device 409. The communication means 409 may allow the electronic device 400 to communicate with other devices wirelessly or by wire to exchange data. While fig. 4 shows an electronic device 400 having various means, it is to be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may be implemented or provided instead.
In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a non-transitory computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network via communications device 409, or from storage 408, or from ROM 402. When executed by the processing device 401, the computer program performs the above-described functions defined in the flow rate detection method of the embodiment of the present disclosure.
It should be noted that the computer readable medium described in the present disclosure may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present disclosure, however, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.
In some implementations, the clients, servers may communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol ), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the internet (e.g., the internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed networks.
The computer readable medium may be contained in the electronic device; or may exist alone without being incorporated into the electronic device.
The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: acquiring an access time sequence map of a to-be-detected end; wherein the access timing graph includes at least one target graph node having an abnormal traffic identification; performing graph representation learning on the access time sequence graph to obtain a time sequence vector corresponding to each graph node in the access time sequence graph; wherein the target map node corresponds to the target timing vector; clustering the time sequence vectors according to a preset clustering algorithm to obtain a plurality of clustering categories; and acquiring a target clustering class to which the target timing sequence vector belongs from the plurality of clustering classes, and determining the abnormal flow of the end to be detected based on the target clustering class. Therefore, the embodiment of the disclosure can determine the map nodes belonging to the same cluster category as the target map nodes with the abnormal flow marks based on the information carried by the access time sequence map, so that the abnormal flow of the unknown rule is detected through the time sequence characteristics, the detection rate of the abnormal flow of the unknown rule is improved, the network safety is ensured, the automation degree of the abnormal flow marking under a long period is improved, and the labor cost consumed by performing the abnormal flow marking is reduced.
Computer program code for carrying out operations of the present disclosure may be written in one or more programming languages, including, but not limited to, an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).
The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The units involved in the embodiments of the present disclosure may be implemented by means of software, or may be implemented by means of hardware. Wherein the names of the units do not constitute a limitation of the units themselves in some cases.
The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a system on a chip (SOC), a Complex Programmable Logic Device (CPLD), and the like.
In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
The foregoing description is only of the preferred embodiments of the present disclosure and description of the principles of the technology being employed. It will be appreciated by persons skilled in the art that the scope of the disclosure referred to in this disclosure is not limited to the specific combinations of features described above, but also covers other embodiments which may be formed by any combination of features described above or equivalents thereof without departing from the spirit of the disclosure. Such as those described above, are mutually substituted with the technical features having similar functions disclosed in the present disclosure (but not limited thereto).
Moreover, although operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order. In certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the present disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.
Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are example forms of implementing the claims.
Claims (8)
1. A flow rate detection method, comprising:
acquiring an access time sequence map of a to-be-detected end; wherein the access timing graph includes at least one target graph node having an abnormal traffic identification;
performing graph representation learning on the access time sequence graph to obtain a time sequence vector corresponding to each graph node in the access time sequence graph; wherein the target graph nodes correspond to target timing vectors;
clustering the time sequence vectors according to a preset clustering algorithm to obtain a plurality of clustering categories;
acquiring a target clustering class to which the target time sequence vector belongs from the plurality of clustering classes, and determining abnormal flow of the end to be detected based on the target clustering class;
the acquiring the access time sequence map of the to-be-detected end comprises the following steps:
acquiring access flow data of the to-be-detected end, and constructing an original input sequence according to the access flow data;
Sampling the original input sequence to obtain a plurality of subsequences;
calculating a weight index corresponding to the subsequence, sequencing the subsequences from high to low according to the weight index, and taking the first N subsequences as a reference sequence; wherein, N is a positive integer;
and constructing a spectrum node of the access time sequence spectrum according to the reference sequence, constructing a spectrum edge of the access time sequence spectrum according to the time sequence relation of the reference sequence on the original input sequence, and constructing the access time sequence spectrum.
2. The method as recited in claim 1, further comprising:
acquiring a historical input sequence comprising an abnormal time period, and sampling the abnormal time period in the historical input sequence to obtain the target map node;
and performing identification processing on the target map node by using the abnormal flow identification.
3. The method as recited in claim 2, further comprising:
constructing the access timing graph comprising the target graph nodes according to timing.
4. The method of claim 1, wherein the obtaining the target cluster class to which the target timing vector belongs from the plurality of cluster classes and determining the abnormal traffic of the to-be-detected end based on the target cluster class comprises:
Inquiring whether each clustering category comprises the target time sequence vector, if so, determining the currently processed clustering category as the target clustering category;
obtaining an abnormal time period corresponding to all time sequence vectors belonging to the target clustering category, and determining the flow sent by the end to be detected in the abnormal time period as abnormal flow.
5. The method as recited in claim 4, further comprising:
if the clustering category which is currently processed does not comprise the target time sequence vector, randomly selecting M time sequence vectors in the clustering category which is currently processed as sampling time sequence vectors; wherein M is a positive integer;
analyzing and determining a sampling flow identifier corresponding to each sampling time sequence vector;
and counting the sampling flow identification, and judging whether the flow corresponding to the clustering category which is currently processed is the abnormal flow according to a counting result.
6. A flow rate detection device, comprising:
the acquisition module is used for acquiring an access time sequence map of the end to be detected; wherein the access timing graph includes at least one target graph node having an abnormal traffic identification;
The learning module is used for performing graph representation learning on the access time sequence patterns to obtain time sequence vectors corresponding to each pattern node in the access time sequence patterns; wherein the target graph nodes correspond to target timing vectors;
the clustering module is used for carrying out clustering processing on the time sequence vectors according to a preset clustering algorithm to obtain a plurality of clustering categories;
the detection module is used for acquiring a target clustering category to which the target time sequence vector belongs from the plurality of clustering categories and determining the abnormal flow of the end to be detected based on the target clustering category;
wherein, the acquisition module is used for:
acquiring access flow data of the to-be-detected end, and constructing an original input sequence according to the access flow data;
sampling the original input sequence to obtain a plurality of subsequences;
calculating a weight index corresponding to the subsequence, sequencing the subsequences from high to low according to the weight index, and taking the first N subsequences as a reference sequence; wherein, N is a positive integer;
and constructing a spectrum node of the access time sequence spectrum according to the reference sequence, constructing a spectrum edge of the access time sequence spectrum according to the time sequence relation of the reference sequence on the original input sequence, and constructing the access time sequence spectrum.
7. An electronic device, the electronic device comprising:
a processor;
a memory for storing the processor-executable instructions;
the processor is configured to read the executable instructions from the memory and execute the instructions to implement the flow detection method according to any one of claims 1-5.
8. A computer readable storage medium, characterized in that the storage medium stores a computer program for executing the flow detection method according to any one of the preceding claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210202225.XA CN114422267B (en) | 2022-03-03 | 2022-03-03 | Flow detection method, device, equipment and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210202225.XA CN114422267B (en) | 2022-03-03 | 2022-03-03 | Flow detection method, device, equipment and medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114422267A CN114422267A (en) | 2022-04-29 |
| CN114422267B true CN114422267B (en) | 2024-02-06 |
Family
ID=81262828
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210202225.XA Active CN114422267B (en) | 2022-03-03 | 2022-03-03 | Flow detection method, device, equipment and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114422267B (en) |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115473789B (en) * | 2022-09-16 | 2024-02-27 | 深信服科技股份有限公司 | Alarm processing method and related equipment |
| CN115237081B (en) * | 2022-09-22 | 2022-12-02 | 蘑菇物联技术（深圳）有限公司 | Method, apparatus, and medium for determining post-processing device with exception |
| CN115514620B (en) * | 2022-11-15 | 2023-03-10 | 阿里云计算有限公司 | Anomaly detection method and cloud network platform |
| CN115995282B (en) * | 2023-03-23 | 2023-06-02 | 山东纬横数据科技有限公司 | Expiratory flow data processing system based on knowledge graph |
| CN116112292B (en) * | 2023-04-12 | 2023-06-09 | 湖南丛茂科技有限公司 | Abnormal behavior detection method, system and medium based on network flow big data |
| CN118171271A (en) * | 2024-05-14 | 2024-06-11 | 深圳震有科技股份有限公司 | Safety monitoring method, system and terminal for database |
Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111949803A (en) * | 2020-08-21 | 2020-11-17 | 深圳供电局有限公司 | Method, device and equipment for detecting network abnormal user based on knowledge graph |
| CN112541022A (en) * | 2020-12-18 | 2021-03-23 | 网易（杭州）网络有限公司 | Abnormal object detection method, abnormal object detection device, storage medium and electronic equipment |
| CN112685396A (en) * | 2020-12-30 | 2021-04-20 | 平安普惠企业管理有限公司 | Financial data violation detection method and device, computer equipment and storage medium |
| WO2021109314A1 (en) * | 2019-12-06 | 2021-06-10 | 网宿科技股份有限公司 | Method, system and device for detecting abnormal data |
| CN113010896A (en) * | 2021-03-17 | 2021-06-22 | 北京百度网讯科技有限公司 | Method, apparatus, device, medium and program product for determining an abnormal object |
| CN113312447A (en) * | 2021-03-10 | 2021-08-27 | 天津大学 | Semi-supervised log anomaly detection method based on probability label estimation |
| CN113360580A (en) * | 2021-05-31 | 2021-09-07 | 北京百度网讯科技有限公司 | Abnormal event detection method, device, equipment and medium based on knowledge graph |
| CN113554175A (en) * | 2021-09-18 | 2021-10-26 | 平安科技（深圳）有限公司 | Knowledge graph construction method and device, readable storage medium and terminal equipment |
| CN113704008A (en) * | 2021-03-09 | 2021-11-26 | 腾讯科技（深圳）有限公司 | Anomaly detection method, problem diagnosis method and related products |
| CN113852603A (en) * | 2021-08-13 | 2021-12-28 | 京东科技信息技术有限公司 | Method and device for detecting abnormality of network traffic, electronic equipment and readable medium |
| CN114117134A (en) * | 2021-11-09 | 2022-03-01 | 南京星云数字技术有限公司 | Abnormal feature detection method, device, equipment and computer readable medium |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11277425B2 (en) * | 2019-04-16 | 2022-03-15 | International Business Machines Corporation | Anomaly and mode inference from time series data |
-
2022
- 2022-03-03 CN CN202210202225.XA patent/CN114422267B/en active Active
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2021109314A1 (en) * | 2019-12-06 | 2021-06-10 | 网宿科技股份有限公司 | Method, system and device for detecting abnormal data |
| CN111949803A (en) * | 2020-08-21 | 2020-11-17 | 深圳供电局有限公司 | Method, device and equipment for detecting network abnormal user based on knowledge graph |
| CN112541022A (en) * | 2020-12-18 | 2021-03-23 | 网易（杭州）网络有限公司 | Abnormal object detection method, abnormal object detection device, storage medium and electronic equipment |
| CN112685396A (en) * | 2020-12-30 | 2021-04-20 | 平安普惠企业管理有限公司 | Financial data violation detection method and device, computer equipment and storage medium |
| CN113704008A (en) * | 2021-03-09 | 2021-11-26 | 腾讯科技（深圳）有限公司 | Anomaly detection method, problem diagnosis method and related products |
| CN113312447A (en) * | 2021-03-10 | 2021-08-27 | 天津大学 | Semi-supervised log anomaly detection method based on probability label estimation |
| CN113010896A (en) * | 2021-03-17 | 2021-06-22 | 北京百度网讯科技有限公司 | Method, apparatus, device, medium and program product for determining an abnormal object |
| CN113360580A (en) * | 2021-05-31 | 2021-09-07 | 北京百度网讯科技有限公司 | Abnormal event detection method, device, equipment and medium based on knowledge graph |
| CN113852603A (en) * | 2021-08-13 | 2021-12-28 | 京东科技信息技术有限公司 | Method and device for detecting abnormality of network traffic, electronic equipment and readable medium |
| CN113554175A (en) * | 2021-09-18 | 2021-10-26 | 平安科技（深圳）有限公司 | Knowledge graph construction method and device, readable storage medium and terminal equipment |
| CN114117134A (en) * | 2021-11-09 | 2022-03-01 | 南京星云数字技术有限公司 | Abnormal feature detection method, device, equipment and computer readable medium |
Non-Patent Citations (1)
| Title |
|---|
| 基于生成对抗网络的***日志级异常检测算法;夏彬;白宇轩;殷俊杰;;计算机应用;第40卷(第10期);第2960-2966页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114422267A (en) | 2022-04-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN114422267B (en) | Flow detection method, device, equipment and medium | |
| CN109587008B (en) | Method, device and storage medium for detecting abnormal flow data | |
| CN112200173B (en) | Multi-network model training method, image labeling method and face image recognition method | |
| CN115277261B (en) | Abnormal machine intelligent identification method, device and equipment based on industrial control network virus | |
| CN114780338A (en) | Host information processing method and device, electronic equipment and computer readable medium | |
| CN110634050B (en) | Method, device, electronic equipment and storage medium for identifying house source type | |
| CN113033707B (en) | Video classification method and device, readable medium and electronic equipment | |
| CN116756616A (en) | Data processing method, device, computer readable medium and electronic equipment | |
| CN111478861A (en) | Traffic identification method and device, electronic equipment and storage medium | |
| CN116483891A (en) | Information prediction method, device, equipment and storage medium | |
| CN114140723B (en) | Multimedia data identification method and device, readable medium and electronic equipment | |
| CN111628913B (en) | Online time length determining method and device, readable medium and electronic equipment | |
| CN112379967A (en) | Simulator detection method, device, equipment and medium | |
| CN113051400A (en) | Method and device for determining annotation data, readable medium and electronic equipment | |
| CN115729797A (en) | Code similarity function detection method and device, electronic equipment and storage medium | |
| CN111382233A (en) | Similar text detection method and device, electronic equipment and storage medium | |
| CN117857388B (en) | Switch operation information detection method and device, electronic equipment and computer medium | |
| CN114547491A (en) | Time sequence map construction method, device, equipment and medium | |
| CN116541421B (en) | Address query information generation method and device, electronic equipment and computer medium | |
| CN111507734B (en) | Method and device for identifying cheating request, electronic equipment and computer storage medium | |
| CN117235744B (en) | Source file online method, device, electronic equipment and computer readable medium | |
| CN116821160A (en) | Correlation updating method, device, equipment and medium based on user behavior track information | |
| CN116992115A (en) | Recommendation method and device, storage medium and electronic equipment | |
| CN114330578A (en) | Object classification method and device, readable medium and electronic equipment | |
| CN117077036A (en) | Model stability detection method, device and equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |