Method for detecting HIDS abnormal traffic

Abstract

The invention intends to provide a method for detecting abnormal traffic, particularly a convenient method for detecting abnormal traffic by calculating the variation of self-similarity indexes. The method can distinguish normal and abnormal traffic and reduce the detection time, which comprises the following steps: Step 1, initiating the sample queue FQueue, initiating the Hurst queue and HQueue for saving Hurst indexes, and initiating the Hurst index variation queue DHQueue; Step 2, calculating the Hurst indexes of the queue FQueue, saving the Hurst indexes to the queue HQueue, adding new nodes to the sample queue FQueue, and delaying for 10 seconds; Step 3, calculating delta H of all the Hurst values in the queue HQueue according to the following formula: delta H = H(m) - H(m-1), and adding the values to the queue DHQueue; and Step 4, reading the last value H(last) in the queue DHQueue on a circulatory basis, under the condition that delta H(last) is more than 0.2, if the difference between H(last) and 2 is more than 0, giving a warning of wittyworm virus, and if H(last) is less than 0.3, giving a warning of DDOS (Distributed Denial of Service) attack.

Description

technical field [0001] The invention is a method for detecting abnormal flow, which provides a convenient method for detecting abnormal flow by calculating the change of self-similarity index, and belongs to the cross field of computer application technology and intrusion detection. Background technique [0002] In addition to normal network traffic, the network also includes a lot of malicious attack traffic, which often causes network congestion or even paralysis. We call this kind of traffic abnormal traffic. Two kinds of harmful abnormal traffic in the existing network are DDoS (distributed denial of service) and Viruses and Worms (viruses and worms). [0003] Network viruses and network attacks have brought great harm to the normal operation of the network, but there is no way to fundamentally eliminate DDoS attacks and worms. However, through some technical means, such as detection and filtering, the harm caused by these attacks can be mitigated to a certain extent. ...

AI Technical Summary

Problems solved by technology

[0006] (1) Unable to distinguish busy traffic from abnormal traffic, resulting in false positives or missed negatives

[0007] (2) The setting of the traffic threshold is related to the specific network, lacks universality, and requires the support of technical personnel

[0008] (3) It can only be detected when a large-scale attack breaks out, and the detection time is relatively long

Images