
\n \n
但是,對於那些不會顯示為錯誤的問題(比如流量突然下降或激增),該怎麼辦?
今天,我們很高興地宣佈向企業方案客戶提供流量異常通知。當 Cloudflare 偵測到流量發生意外變化時,這些通知就會觸發,為您提供瞭解系統健康情況的另一個寶貴視角。
流量的意外變化可能預示著很多事情。如果您經營的是一個電子商務網站,看到流量激增,這可能是個好訊息——也許是客戶蜂擁而至,也許是您剛剛在一個熱門電視節目上投放了廣告。不過,這也可能意味著出了問題:也許有人不小心關閉了一條防火牆規則,現在您看到了更多的惡意流量。無論是哪一種情況,您可能都想知道具體發生了什麼變化。
同樣,流量突然下降也可能意味著很多事情。也許現在是週五下午,所有員工都已下班,不再存取公司網站。又或者,您網站的連結被破壞了,現在潛在客戶無法存取您的網站。流量低的每一分鐘都可能使您損失潛在的收入,因此您會想要儘快瞭解情況並進行調查。
\n計算時間序列資料集的異常是很困難的。最簡單的方法是使用基本閾值。然而,正如我們之前在部落格中提到的,當試圖確定事情何時真正出錯時,簡單的閾值並不是很準確。邊緣情況太多,它們無法有效運作。
計算 HTTP 錯誤中的異常情況相對容易。我們知道,一般來說,錯誤數量應該非常低,因此任何峰值都是不好的,都是值得警惕的。這就是為什麼我們使用服務級別目標 (SLO) 來計算 HTTP 錯誤率通知的異常情況。
然而,分析總體 HTTP 流量的行為與 Cloudflare Security Events 更相似:有一些根據歷史趨勢計算的一般事件基線。與該基線的任何偏差都是值得警惕的。由於這些相似之處,我們決定,對於流量異常通知,也採用之前用於安全事件通知的相同計算方式:Z 值 (z-score)。這涉及到將當前值與平均值進行比較。當前值與平均值之間有多少個標準差,即為 Z 值。
HTTP 流量與 Z 值的關係圖。藍色為 HTTP 流量,紫色為流量的正 Z 值邊界,綠色為流量的負 Z 值邊界。
\n對於流量異常通知,我們將過去 5 分鐘(短時間段)的流量與過去 4 小時(長時間段)的平均流量進行比較。Z 值為正數時,表示激增;Z 值為負數時,表示下降。如果當前值與平均值的偏差超過 3.5 個標準差,我們就會發出提醒。我們每 5 分鐘測量一次,因此可以及時對任何流量激增或下降發出提醒。
綠色部分為長時間段,紅色部分為短時間段。
\n雖然我們的安全事件通知僅在安全事件出現激增時才會觸發(下降幾乎總是一件好事),但對於流量異常,我們會針對激增_和_下降都發送通知。這是因為 HTTP 流量下降可能表明存在問題,而流量激增可能是好事,也可能是壞事。
與安全事件一樣,流量異常通知也支援最小閾值。這意味著,即使我們確定某個事件超出了 3.5 個標準差的範圍,但如果事件數量微不足道,我們也不會發出提醒。激增必須至少達到 200 個請求,下降也必須至少達到 200 個請求。這樣可以減少通知的噪音,因為我們不會對小的增長和下降發出提醒。
\nCloudflare 在 Clickhouse 中儲存通過其網路的請求的採樣統計資料。每分鐘,我們都會從 Clickhouse 獲取 HTTP 流量並將其儲存在 VictoriaMetrics(一個時間序列資料儲存解決方案)的執行個體中。VictoriaMetrics 免費為我們提供現成可用的演算法函數,它非常適合我們的使用案例。我們選擇 VictoriaMetrics 有幾個原因。
首先,它易於設定和操作。作為一個團隊,我們希望透過最佳化來降低營運負擔,VictoriaMetrics 到目前為止一直非常出色。其次,VictoriaMetrics 具有橫向擴展能力,這意味著我們可以在高可用模式下執行它。對於這樣的系統,我們需要可靠的東西來為客戶計算時間敏感資訊,高可用性要求至關重要。最後,在我們的測試中,我們發現 VictoriaMetrics 使用的記憶體約為 Prometheus(一款類似的替代產品)的 ⅓。
當我們在 VictoriaMetrics 中儲存資料後,我們就可以對其執行查詢,並根據客戶提前建立的通知設定確定是否需要提醒客戶。為此,我們利用了現有的警示通知系統,我們最初於 2019 年在部落格中介紹了該系統。我們知道,我們可以依靠當前的通知系統在最後一英里向客戶傳遞這些重要通知。
從 HTTP 要求到通知的資料流程
\n要設定此通知,請瀏覽至儀表板的「通知」索引標籤。選取「流量異常」作為通知類型。與所有 Cloudflare 通知一樣,您可以命名和描述通知,並選擇您想要接收通知的方式。
儀表板中的流量異常通知
\n您可以選擇要對哪些網域進行流量異常監控,是否要包括 Cloudflare DoS 或 WAF 產品已經緩解的流量,以及是否要包括或排除特定的狀態碼。您還可以選擇是在流量激增時發出提醒、在流量下降時發出提醒,還是對二者均發出提醒。
我們很高興能利用該系統為我們的企業方案客戶提供有關其系統總體健康情況的寶貴通知。前往儀表板中的「通知」索引標簽,立即查看此新通知!
"],"published_at":[0,"2023-10-31T13:01:11.000+00:00"],"updated_at":[0,"2024-10-10T00:22:21.604Z"],"feature_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/3RQpVK10wAWDLGUodLeq0o/44b9d5c9b7105ca3d3c45b060fc9947b/introducing-http-traffic-anomalies-notifications.png"],"tags":[1,[[0,{"id":[0,"6QktrXeEFcl4e2dZUTZVGl"],"name":[0,"產品新聞"],"slug":[0,"product-news"]}],[0,{"id":[0,"6cjyAFDpR8zwR4Ylx8wKYu"],"name":[0,"Notifications"],"slug":[0,"notifications"]}],[0,{"id":[0,"2s3r2BdfPas9oiGbGRXdmQ"],"name":[0,"網路服務"],"slug":[0,"network-services"]}]]],"relatedTags":[0],"authors":[1,[[0,{"name":[0,"Cathy Chi"],"slug":[0,"cathy-chi"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/3uaVjJ4BaoWy0sAXQWryO0/9f75957f3d8c34bdc27d598ebd6c9aa0/cathy-chi.jpg"],"location":[0,null],"website":[0,null],"twitter":[0,null],"facebook":[0,null]}],[0,{"name":[0,"Natasha Wissmann"],"slug":[0,"natasha"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/3otfuZ5gyTxanmbLcCJRcY/400f4289aac00c755772f23ade33c674/natasha.jpg"],"location":[0,null],"website":[0,null],"twitter":[0,null],"facebook":[0,null]}]]],"meta_description":[0,null],"primary_author":[0,{}],"localeList":[0,{"name":[0,"Introducing notifications for HTTP Traffic Anomalies Config"],"enUS":[0,"English for Locale"],"zhCN":[0,"Translated for Locale"],"zhHansCN":[0,"No Page for Locale"],"zhTW":[0,"Translated for Locale"],"frFR":[0,"Translated for Locale"],"deDE":[0,"Translated for Locale"],"itIT":[0,"No Page for Locale"],"jaJP":[0,"Translated for Locale"],"koKR":[0,"Translated for Locale"],"ptBR":[0,"No Page for Locale"],"esLA":[0,"No Page for Locale"],"esES":[0,"Translated for Locale"],"enAU":[0,"No Page for Locale"],"enCA":[0,"No Page for Locale"],"enIN":[0,"No Page for Locale"],"enGB":[0,"No Page for Locale"],"idID":[0,"No Page for Locale"],"ruRU":[0,"No Page for Locale"],"svSE":[0,"No Page for Locale"],"viVN":[0,"No Page for Locale"],"plPL":[0,"No Page for Locale"],"arAR":[0,"No Page for Locale"],"nlNL":[0,"No Page for Locale"],"thTH":[0,"No Page for Locale"],"trTR":[0,"No Page for Locale"],"heIL":[0,"No Page for Locale"],"lvLV":[0,"No Page for Locale"],"etEE":[0,"No Page for Locale"],"ltLT":[0,"No Page for Locale"]}],"url":[0,"https://blog.cloudflare.com/introducing-http-traffic-anomalies-notifications"],"metadata":[0,{"title":[0,"推出 HTTP 流量異常通知"],"description":[0,null],"imgPreview":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/230vzoJXvY4e0OSjyFIOFc/88e5e19cb3d87c5a3ac75deefebfe6fc/introducing-http-traffic-anomalies-notifications-ZSzPbJ.png"]}]}],"locale":[0,"zh-tw"],"translations":[0,{"posts.by":[0,"作者:"],"footer.gdpr":[0,"GDPR"],"lang_blurb1":[0,"本貼文還提供以下語言版本:{lang1}。"],"lang_blurb2":[0,"本貼文還提供以下語言版本:{lang1} 和{lang2}。"],"lang_blurb3":[0,"本貼文還提供以下語言版本:{lang1},{lang2} 和{lang3}。"],"footer.press":[0,"新聞"],"header.title":[0,"Cloudflare 部落格"],"search.clear":[0,"清除"],"search.filter":[0,"篩選"],"search.source":[0,"來源"],"footer.careers":[0,"人才招募"],"footer.company":[0,"公司"],"footer.support":[0,"支援"],"footer.the_net":[0,"theNet"],"search.filters":[0,"篩選器"],"footer.our_team":[0,"我們的團隊"],"footer.webinars":[0,"網路研討會"],"page.more_posts":[0,"更多貼文"],"posts.time_read":[0,"閱讀時間:{time} 分鐘"],"search.language":[0,"語言"],"footer.community":[0,"社群"],"footer.resources":[0,"資源"],"footer.solutions":[0,"解決方案"],"footer.trademark":[0,"商標"],"header.subscribe":[0,"訂閱"],"footer.compliance":[0,"合規性"],"footer.free_plans":[0,"免費方案"],"footer.impact_ESG":[0,"影響力/ESG"],"posts.follow_on_X":[0,"在 X 上進行關注"],"footer.help_center":[0,"幫助中心"],"footer.network_map":[0,"網路分佈圖"],"header.please_wait":[0,"請稍候"],"page.related_posts":[0,"相關貼文"],"search.result_stat":[0,"針對 {search_keyword} 的第 {search_range} 個搜尋結果(共 {search_total} 個結果)"],"footer.case_studies":[0,"案例研究"],"footer.connect_2024":[0,"Connect 2024"],"footer.terms_of_use":[0,"服務條款"],"footer.white_papers":[0,"白皮書"],"footer.cloudflare_tv":[0,"Cloudflare TV"],"footer.community_hub":[0,"社群中心"],"footer.compare_plans":[0,"比較各項方案"],"footer.contact_sales":[0,"連絡銷售團隊"],"header.contact_sales":[0,"連絡銷售團隊"],"header.email_address":[0,"電子郵件地址"],"page.error.not_found":[0,"找不到頁面"],"footer.developer_docs":[0,"開發人員文件"],"footer.privacy_policy":[0,"隱私權原則"],"footer.request_a_demo":[0,"請求示範"],"page.continue_reading":[0,"繼續閱讀"],"footer.analysts_report":[0,"分析報告"],"footer.for_enterprises":[0,"企業適用"],"footer.getting_started":[0,"開始使用"],"footer.learning_center":[0,"學習中心"],"footer.project_galileo":[0,"Galileo 專案"],"pagination.newer_posts":[0,"較新貼文"],"pagination.older_posts":[0,"較舊貼文"],"posts.social_buttons.x":[0,"在 X 上進行討論"],"search.icon_aria_label":[0,"搜尋"],"search.source_location":[0,"來源/地點"],"footer.about_cloudflare":[0,"關於 Cloudflare"],"footer.athenian_project":[0,"Athenian 專案"],"footer.become_a_partner":[0,"成為合作夥伴"],"footer.cloudflare_radar":[0,"Cloudflare Radar"],"footer.network_services":[0,"網路服務"],"footer.trust_and_safety":[0,"信任和安全"],"header.get_started_free":[0,"免費開始使用"],"page.search.placeholder":[0,"搜尋 Cloudflare"],"footer.cloudflare_status":[0,"Cloudflare 狀態"],"footer.cookie_preference":[0,"Cookie 喜好設定"],"header.valid_email_error":[0,"必須是有效電子郵件。"],"search.result_stat_empty":[0,"第 {search_range} 筆搜尋結果(共 {search_total} 筆)"],"footer.connectivity_cloud":[0,"全球連通雲"],"footer.developer_services":[0,"開發人員服務"],"footer.investor_relations":[0,"投資人關係"],"page.not_found.error_code":[0,"錯誤代碼:404"],"search.autocomplete_title":[0,"插入查詢。按下 Enter 鍵即可傳送"],"footer.logos_and_press_kit":[0,"標誌與新聞資料包"],"footer.application_services":[0,"應用程式服務"],"footer.get_a_recommendation":[0,"取得建議"],"posts.social_buttons.reddit":[0,"在 Reddit 上進行討論"],"footer.sse_and_sase_services":[0,"SSE 和 SASE 服務"],"page.not_found.outdated_link":[0,"您可能使用了過時的連結,或者可能輸入了錯誤的位址。"],"footer.report_security_issues":[0,"報告網路安全問題"],"page.error.error_message_page":[0,"抱歉,我們找不到您想要的頁面。"],"header.subscribe_notifications":[0,"訂閱以接收新文章的通知:"],"footer.cloudflare_for_campaigns":[0,"Cloudflare for Campaigns"],"header.subscription_confimation":[0,"訂閱已確認。感謝訂閱!"],"posts.social_buttons.hackernews":[0,"在 Hacker News 上進行討論"],"footer.diversity_equity_inclusion":[0,"多樣性、公平性和包容性"],"footer.critical_infrastructure_defense_project":[0,"關鍵基礎架構防禦專案"]}]}" ssr="" client="load" opts="{"name":"PostCard","value":true}" await-children="">2023-09-26
現在,Cloudflare Radar 會在偵測到國家/地區和 ASN 流量異常時在服務中斷中心顯示它們,並透過 API 發佈異常資訊。我們還發佈了 Radar 通知,讓使用者能夠訂閱有關流量異常的通知...
2022-01-17
我們很高興地宣佈,使用免費方案的客戶現在也可獲得 HTTP DDoS 攻擊的即時警示。Cloudflare 可自動偵測並緩解此類攻擊。即時 DDoS 警示在一年多前初始發佈,但先前只提供給使用 Pro 方案或更高級別方案的客戶。...