Method and unit for extracting traffic attack message characteristics on network equipment

Abstract

The invention discloses a method and a unit for extracting traffic attack message characteristics on network equipment. The method comprises the steps of: selecting a network message type which needs to extract message characteristics and is taken as an attack traffic type; taking a header field of a message with the selected type as an item, and finding all frequent item sets which meet the requirement of minimum support in the received network message with the selected type; performing descending sort on all the found frequent item sets according to element numbers, and then performing descending sort on the frequent item sets with the same element number according to the support; and sequentially selecting a group of minimum sets of frequent item sets which meet the requirement of a message filtration proportion threshold value as the attack message characteristics of the message with the selected type from the sorted frequent item sets. The method and the unit overcome the one sidedness of a traffic characteristic extraction method, can accurately filter, avoid error killing, and guarantee the normal pass of valid network traffic.

Description

technical field [0001] The invention relates to security protection of network equipment, in particular to a method and unit for extracting characteristics of traffic attack messages on network equipment. Background technique [0002] The network devices in the network system, such as switches and routers, are common, which are responsible for the forwarding of network packets and are key network devices in the network system. But these devices are often subject to traffic attacks. Denial of Service attack (Denial of Service, referred to as DoS) and distributed denial of service attack (Distributed Denial of Service, referred to as DDoS) are the most common traffic attack techniques. Denial of service attack means that the attacker uses reasonable service requests to occupy too many service resources of the attacked party, so that legitimate users cannot get service responses. Distributed denial of service attack is a group behavior of DoS attacking the same target from mu...

AI Technical Summary

Problems solved by technology

This traffic attack signature detection method only relies on a single packet field value to describe the traffic attack packet characteristics, which is one-sided. If traffic control is implemented based on this, it may lead to accidental killing

Images