A method and system for monitoring network traffic exception

Abstract

The invention discloses a method and a system to monitor a network flow rate abnormality, and solves the problem that the prior exchanger image technology is adopted to monitor the flow rate abnormality to cause the problems such as exchanger performance loss, data package lose, etc. The method comprises the steps that: first of all, the flow rate abnormality port in the exchanger is positioned through a coarse granularity monitoring way, then the image port of the exchanger is automatically adjusted, and the abnormality port flow rate is copied to the image port, finally, a fine granularity monitoring way is adopted to analyze the image port flow rate to get the flow rate abnormality reason. The invention improves the traditional exchanger image technology, only when the flow rate is abnormal, the exchanger image is triggered, the exchanger image function is not used within most of the time, so the load is not increased to influence the exchanger function; in addition, the image port is adjusted through the way which is dynamic and has an aim, thereby avoiding the circumstance that a plurality of ports are imaged to one port to cause the package to be lost.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method and system for monitoring abnormal network traffic. Background technique [0002] In the field of network security, network traffic anomaly refers to the irregular and significant changes in the traffic in the network. Local events such as transient network congestion, distributed denial of service attacks, large-scale scanning, or global events such as network routing abnormalities can cause network abnormalities. Therefore, monitoring and analysis of network traffic abnormalities is very important for network security emergency response departments. [0003] At present, an abnormal monitoring method is to use switch mirroring technology. The switching device copies the traffic of multiple network ports to the mirror port. The mirror port is a monitoring port. The mirror port is deployed with a monitoring and analysis system. analysis to determine whether there is an ab...

AI Technical Summary

Problems solved by technology

[0009] The technical problem to be solved by the present invention is to provide a method and system for monitoring network traffic anomalies, so as to solve the existing problems of using switch mirroring technology to monitor traffic anomalies, resulting in switch performance loss, data packet loss, etc.

Images