Malicious traffic identification method and related equipment

The invention provides a malicious traffic identification method and related equipment. The method comprises the following steps: based on an obtained to-be-identified data set for training, selecting to obtain a base model; training the base model by using a guide aggregation algorithm to obtain a first training model; training the base model by using a lifting algorithm to obtain a second training model; training the base model by using a stack algorithm to obtain a third training model; selecting from the first training model, the second training model and the third training model based on a preset evaluation algorithm to obtain a first malicious traffic identification model; and identifying malicious traffic to be identified based on the first malicious traffic identification model to obtain a first final identification result. According to the embodiment of the invention, the malicious traffic recognition model is constructed based on three integration algorithms, the final recognition model is determine