
\n \n
但是,对于那些不会显示为错误的问题(比如流量突然下降或激增),该怎么办?
今天,我们很高兴地宣布向 Enterprise 方案客户提供流量异常通知。当 Cloudflare 检测到流量发生意外变化时,这些通知就会触发,为您提供了解系统运行状况的另一个宝贵视角。
流量的意外变化可能预示着很多事情。如果您经营的是一个电子商务网站,看到流量激增,这可能是个好消息——也许是客户蜂拥而至,也许是您刚刚在一个热门电视节目上投放了广告。不过,这也可能意味着出了问题:也许有人不小心关闭了一条防火墙规则,现在您看到了更多的恶意流量。无论是哪一种情况,您可能都想知道具体发生了什么变化。
同样,流量突然下降也可能意味着很多事情。也许现在是周五下午,所有员工都已下班,不再访问公司网站。又或者,您网站的链接被破坏了,现在潜在客户无法访问您的网站。流量低的每一分钟都可能使您损失潜在的收入,因此您会想要尽快了解情况并进行调查。
\n计算时间序列数据集的异常是很困难的。最简单的方法是使用基本阈值。然而,正如我们之前在博客中提到的,当试图确定事情何时真正出错时,简单的阈值并不是很准确。边缘情况太多,它们无法有效运作。
计算 HTTP 错误中的异常情况相对容易。我们知道,一般来说,错误数量应该非常低,因此任何峰值都是不好的,都是值得警惕的。这就是为什么我们使用服务级别目标 (SLO) 来计算 HTTP 错误率通知的异常情况。
然而,分析总体 HTTP 流量的行为与 Cloudflare Security Events 更相似:有一些根据历史趋势计算的一般事件基线。与该基线的任何偏差都是值得警惕的。由于这些相似之处,我们决定,对于流量异常通知,也采用之前用于安全事件通知的相同计算方式:Z 值 (z-score)。这涉及到将当前值与平均值进行比较。当前值与平均值之间有多少个标准差,即为 Z 值。
HTTP 流量与 Z 值的关系图。蓝色为 HTTP 流量,紫色为流量的正 Z 值边界,绿色为流量的负 Z 值边界。
\n对于流量异常通知,我们将过去 5 分钟(短时间段)的流量与过去 4 小时(长时间段)的平均流量进行比较。Z 值为正数时,表示激增;Z 值为负数时,表示下降。如果当前值与平均值的偏差超过 3.5 个标准差,我们就会发出提醒。我们每 5 分钟测量一次,因此可以及时对任何流量激增或下降发出提醒。
绿色部分为长时间段,红色部分为短时间段。
\n虽然我们的安全事件通知仅在安全事件出现激增时才会触发(下降几乎总是一件好事),但对于流量异常,我们会针对激增_和_下降都发送通知。这是因为 HTTP 流量下降可能表明存在问题,而流量激增可能是好事,也可能是坏事。
与安全事件一样,流量异常通知也支持最小阈值。这意味着,即使我们确定某个事件超出了 3.5 个标准差的范围,但如果事件数量微不足道,我们也不会发出提醒。激增必须至少达到 200 个请求,下降也必须至少达到 200 个请求。这样可以减少通知的噪音,因为我们不会对小的增长和下降发出提醒。
\nCloudflare 在 Clickhouse 中存储通过其网络的请求的采样统计信息。每分钟,我们都会从 Clickhouse 获取 HTTP 流量并将其存储在 VictoriaMetrics(一个时间序列数据存储解决方案)的实例中。VictoriaMetrics 免费为我们提供开箱即用的算法函数,它非常适合我们的用例。我们选择 VictoriaMetrics 有几个原因。
首先,它易于配置和操作。作为一个团队,我们希望通过优化来降低运营负担,VictoriaMetrics 到目前为止一直非常出色。其次,VictoriaMetrics 具有横向扩展能力,这意味着我们可以在高可用模式下运行它。对于这样的系统,我们需要可靠的东西来为客户计算时间敏感信息,高可用性要求至关重要。最后,在我们的测试中,我们发现 VictoriaMetrics 使用的内存约为 Prometheus(一款类似的替代产品)的 ⅓。
当我们在 VictoriaMetrics 中存储数据后,我们就可以对其运行查询,并根据客户提前创建的通知配置确定是否需要提醒客户。为此,我们利用了现有的提醒通知系统,我们最初于 2019 年在博客中介绍了该系统。我们知道,我们可以依靠当前的通知系统在最后一英里向客户传递这些重要通知。
从 HTTP 请求到通知的数据流
\n要配置此通知,请导航至仪表板的“通知”选项卡。选择“流量异常”作为通知类型。与所有 Cloudflare 通知一样,您可以命名和描述通知,并选择您想要接收通知的方式。
仪表板中的流量异常通知
\n您可以选择要对哪些域进行流量异常监控,是否要包括 Cloudflare DoS 或 WAF 产品已经缓解的流量,以及是否要包括或排除特定的状态代码。您还可以选择是在流量激增时发出提醒、在流量下降时发出提醒,还是对二者均发出提醒。
我们很高兴能利用该系统为我们的 Enterprise 方案客户提供有关其系统总体运行状况的宝贵通知。前往仪表板中的“通知”选项卡,立即查看此新通知!
"],"published_at":[0,"2023-10-31T13:01:11.000+00:00"],"updated_at":[0,"2024-10-10T00:22:21.604Z"],"feature_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/3RQpVK10wAWDLGUodLeq0o/44b9d5c9b7105ca3d3c45b060fc9947b/introducing-http-traffic-anomalies-notifications.png"],"tags":[1,[[0,{"id":[0,"6QktrXeEFcl4e2dZUTZVGl"],"name":[0,"产品新闻"],"slug":[0,"product-news"]}],[0,{"id":[0,"6cjyAFDpR8zwR4Ylx8wKYu"],"name":[0,"Notifications"],"slug":[0,"notifications"]}],[0,{"id":[0,"2s3r2BdfPas9oiGbGRXdmQ"],"name":[0,"网络服务"],"slug":[0,"network-services"]}]]],"relatedTags":[0],"authors":[1,[[0,{"name":[0,"Cathy Chi"],"slug":[0,"cathy-chi"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/3uaVjJ4BaoWy0sAXQWryO0/9f75957f3d8c34bdc27d598ebd6c9aa0/cathy-chi.jpg"],"location":[0,null],"website":[0,null],"twitter":[0,null],"facebook":[0,null]}],[0,{"name":[0,"Natasha Wissmann"],"slug":[0,"natasha"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/3otfuZ5gyTxanmbLcCJRcY/400f4289aac00c755772f23ade33c674/natasha.jpg"],"location":[0,null],"website":[0,null],"twitter":[0,null],"facebook":[0,null]}]]],"meta_description":[0,null],"primary_author":[0,{}],"localeList":[0,{"name":[0,"Introducing notifications for HTTP Traffic Anomalies Config"],"enUS":[0,"English for Locale"],"zhCN":[0,"Translated for Locale"],"zhHansCN":[0,"No Page for Locale"],"zhTW":[0,"Translated for Locale"],"frFR":[0,"Translated for Locale"],"deDE":[0,"Translated for Locale"],"itIT":[0,"No Page for Locale"],"jaJP":[0,"Translated for Locale"],"koKR":[0,"Translated for Locale"],"ptBR":[0,"No Page for Locale"],"esLA":[0,"No Page for Locale"],"esES":[0,"Translated for Locale"],"enAU":[0,"No Page for Locale"],"enCA":[0,"No Page for Locale"],"enIN":[0,"No Page for Locale"],"enGB":[0,"No Page for Locale"],"idID":[0,"No Page for Locale"],"ruRU":[0,"No Page for Locale"],"svSE":[0,"No Page for Locale"],"viVN":[0,"No Page for Locale"],"plPL":[0,"No Page for Locale"],"arAR":[0,"No Page for Locale"],"nlNL":[0,"No Page for Locale"],"thTH":[0,"No Page for Locale"],"trTR":[0,"No Page for Locale"],"heIL":[0,"No Page for Locale"],"lvLV":[0,"No Page for Locale"],"etEE":[0,"No Page for Locale"],"ltLT":[0,"No Page for Locale"]}],"url":[0,"https://blog.cloudflare.com/introducing-http-traffic-anomalies-notifications"],"metadata":[0,{"title":[0,"推出 HTTP 流量异常通知"],"description":[0,null],"imgPreview":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/230vzoJXvY4e0OSjyFIOFc/88e5e19cb3d87c5a3ac75deefebfe6fc/introducing-http-traffic-anomalies-notifications-ZSzPbJ.png"]}]}],"locale":[0,"zh-cn"],"translations":[0,{"posts.by":[0,"作者"],"footer.gdpr":[0,"GDPR"],"lang_blurb1":[0,"这篇博文也有 {lang1} 版本。"],"lang_blurb2":[0,"这篇博文也有 {lang1} 和{lang2}版本。"],"lang_blurb3":[0,"这篇博文也有 {lang1}、{lang2} 和{lang3}版本。"],"footer.press":[0,"新闻"],"header.title":[0,"Cloudflare 博客"],"search.clear":[0,"清除"],"search.filter":[0,"过滤"],"search.source":[0,"来源"],"footer.careers":[0,"招聘"],"footer.company":[0,"公司"],"footer.support":[0,"支持"],"footer.the_net":[0,"theNet"],"search.filters":[0,"过滤器"],"footer.our_team":[0,"我们的团队"],"footer.webinars":[0,"网络研讨会"],"page.more_posts":[0,"更多帖子"],"posts.time_read":[0,"{time} 分钟阅读时间"],"search.language":[0,"语言"],"footer.community":[0,"社区"],"footer.resources":[0,"资源"],"footer.solutions":[0,"解决方案"],"footer.trademark":[0,"商标"],"header.subscribe":[0,"订阅"],"footer.compliance":[0,"合规性"],"footer.free_plans":[0,"Free 计划"],"footer.impact_ESG":[0,"影响/ESG"],"posts.follow_on_X":[0,"在 X 上关注"],"footer.help_center":[0,"帮助中心"],"footer.network_map":[0,"网络地图"],"header.please_wait":[0,"请稍候"],"page.related_posts":[0,"相关帖子"],"search.result_stat":[0,"针对 {search_keyword} 的第 {search_range} 个搜索结果(共 {search_total} 个结果)"],"footer.case_studies":[0,"案例研究"],"footer.connect_2024":[0,"Connect 2024"],"footer.terms_of_use":[0,"服务条款"],"footer.white_papers":[0,"白皮书"],"footer.cloudflare_tv":[0,"Cloudflare TV"],"footer.community_hub":[0,"社区中心"],"footer.compare_plans":[0,"比较各项计划"],"footer.contact_sales":[0,"联系销售"],"header.contact_sales":[0,"联系销售团队"],"header.email_address":[0,"电子邮件地址"],"page.error.not_found":[0,"未找到页面"],"footer.developer_docs":[0,"开发人员文档"],"footer.privacy_policy":[0,"隐私政策"],"footer.request_a_demo":[0,"请求演示"],"page.continue_reading":[0,"继续阅读"],"footer.analysts_report":[0,"分析报告"],"footer.for_enterprises":[0,"企业级服务"],"footer.getting_started":[0,"开始使用"],"footer.learning_center":[0,"学习中心"],"footer.project_galileo":[0,"Project Galileo"],"pagination.newer_posts":[0,"较新的帖子"],"pagination.older_posts":[0,"较旧的帖子"],"posts.social_buttons.x":[0,"在 X 上讨论"],"search.icon_aria_label":[0,"搜索"],"search.source_location":[0,"来源/位置"],"footer.about_cloudflare":[0,"关于 Cloudflare"],"footer.athenian_project":[0,"Athenian Project"],"footer.become_a_partner":[0,"成为合作伙伴"],"footer.cloudflare_radar":[0,"Cloudflare Radar"],"footer.network_services":[0,"网络服务"],"footer.trust_and_safety":[0,"信任与安全"],"header.get_started_free":[0,"免费开始使用"],"page.search.placeholder":[0,"搜索 Cloudflare"],"footer.cloudflare_status":[0,"Cloudflare 状态"],"footer.cookie_preference":[0,"Cookie 首选项"],"header.valid_email_error":[0,"必须是有效的电子邮件地址。"],"search.result_stat_empty":[0,"显示第 {search_range} 个结果(共 {search_total} 个结果)"],"footer.connectivity_cloud":[0,"全球连通云"],"footer.developer_services":[0,"开发人员服务"],"footer.investor_relations":[0,"投资者关系"],"page.not_found.error_code":[0,"错误代码:404"],"search.autocomplete_title":[0,"请输入查询内容。按回车键发送"],"footer.logos_and_press_kit":[0,"标识与媒体资料包"],"footer.application_services":[0,"应用程序服务"],"footer.get_a_recommendation":[0,"获得推荐"],"posts.social_buttons.reddit":[0,"在 Reddit 上讨论"],"footer.sse_and_sase_services":[0,"SSE 和 SASE 服务"],"page.not_found.outdated_link":[0,"您可能使用了过期的链接,或者输入了错误的地址。"],"footer.report_security_issues":[0,"报告安全问题"],"page.error.error_message_page":[0,"抱歉,我们找不到您要打开的页面。"],"header.subscribe_notifications":[0,"订阅以接收新文章的通知:"],"footer.cloudflare_for_campaigns":[0,"Cloudflare for Campaigns"],"header.subscription_confimation":[0,"订阅已确认。感谢订阅!"],"posts.social_buttons.hackernews":[0,"在 Hacker News 上讨论"],"footer.diversity_equity_inclusion":[0,"多元、公平与包容"],"footer.critical_infrastructure_defense_project":[0,"关键基础设施防护项目"]}]}" ssr="" client="load" opts="{"name":"PostCard","value":true}" await-children="">2023-09-26
现在,检测到国家/地区和 ASN 流量异常时,Cloudflare Radar 会在 Outage Center 显示出来,并通过 API 发布异常信息。我们还推出了 Radar 通知,使用户能够订阅有关流量异常的通知...
2022-01-17
我们很高兴地宣布,使用我们的 Free 计划的客户现在可以获得有关 HTTP DDoS 攻击的实时警报,这些攻击由 Cloudflare 自动检测并缓解。实时 DDoS 警报最初是在一年多前发布的,但已向 Pro 计划或更高版本的客户提供。...
2021-12-11
早在 2019 年,我们就在博文中介绍了我们全新的通知中心。该通知中心可作为配置账户通知的集中中心。从那时起,我们已经讨论了很多关于可设置的新型通知,但并没有过多地讨论通知平台本身的更新。那么,通知有什么新功能呢?...
2021-12-03
我们的核心应用程序安全性功能(例如 WAF、防火墙规则和速率限制)有助于确保数百万互联网资产的安全。当攻击流量被阻止时,它们都会安静地执行此操作,而不会产生任何通知,因为我们的重点始终是首先停止恶意请求。...