Detecting abnormal packet traffic using fingerprints for plural protocol types

An apparatus for detecting abnormal network data, comprising:

• processing circuitry configured to
• obtain a network data packet;
• for each of two or more protocol types corresponding to the network data packet:
• extract one or more feature fields from the network data packet based on at least one fingerprint generation algorithm that corresponds to the respective protocol type;
• and
• generate, according to the at least one fingerprint generation algorithm and the extracted one or more feature fields, one or more data packet fingerprints;
• obtain a data packet fingerprint set corresponding to the network data packet that includes the data packet fingerprints generated for the two or more protocol types;
• match at least one data packet fingerprint in the data packet fingerprint set and a reference data packet fingerprint in a reference data packet fingerprint library;
• calculate a confidence corresponding to the network data packet based on confidence correlation information corresponding to each of the at least one matched data packet fingerprint;
• obtain a reference confidence;
• and
• determine an abnormality detection result of the network data packet based on the reference confidence and the calculated confidence.

A non-transitory computer-readable storage medium storing computer-readable instructions thereon, which, when executed by a computer device, cause the computer device to perform a method for detecting abnormal network data, the method comprising:

• obtaining a network data packet;
• for each of two or more protocol types corresponding to the network data packet:
• extracting one or more feature fields from the network data packet based on at least one fingerprint generation algorithm that corresponds to the respective protocol type;
• and
• generating, according to the at least one fingerprint generation algorithm and the extracted one or more feature fields, one or more data packet fingerprints;
• obtaining a data packet fingerprint set corresponding to the network data packet that includes the data packet fingerprints generated for the two or more protocol types;
• matching at least one data packet fingerprint in the data packet fingerprint set and a reference data packet fingerprint in a reference data packet fingerprint library;
• calculating a confidence corresponding to the network data packet based on confidence correlation information corresponding to each of the at least one matched data packet fingerprint;
• obtaining a reference confidence;
• and
• determining an abnormality detection result of the network data packet based on the reference confidence and the calculated confidence.