Flow control device and method based on flow prediction and trusted network address learning

Abstract

The invention discloses a flow control device and a method based on flow prediction and trusted network address learning. The device comprises a forwarding engine and a flow analysis unit, wherein the forwarding engine is used for forwarding a network packet and calculating the network flow entering and leaving each target host, and reliable network addresses are collected from the network packetsent by each target host; when attack flow is detected, the network packet of the target host with attack flow is sampled, and the sample is sent to the flow analysis unit; according to the collectedreliable network address and the attack flow filtering rule returned by the flow analysis unit, flow control is carried out to the network packet sent to the target host; according to the received network packet sample, the flow analysis unit takes each TCP / IP protocol packet head field value as an item to extract a frequent item set satisfying preset minimum support to serve as an attack flow filtering rule applied to the target host corresponding to the network packet sample.

Description

technical field [0001] The invention relates to a device for realizing flow control, in particular to a flow control device and method based on flow prediction and self-learning of trusted network addresses. Background technique [0002] The network security border gateway is usually deployed at the entrance of the protected network. It checks the network data packets entering and exiting the protected network. Once a network intrusion is found, it will prevent network intrusion attempts through packet filtering and other methods to prevent network attacks. losses are minimized. The current common network attacks against the target host in the protected network can be divided into two categories: one is the vulnerability attack based on a small number of maliciously constructed packets; the other is the traffic attack based on a large number of network packets. The former includes various remote buffer overflow attacks, teardrop attacks, SQL injection attacks, etc., which c...

AI Technical Summary

Problems solved by technology

[0005] The technical problem to be solved by the present invention is to provide a flow control device and method based on flow prediction and trusted network address self-learning, which overcomes the problem that the fixed detection threshold is difficult to set in advance, and can quickly identify and forward during the flow control process Network traffic from a trusted remote host, and at the same time filter the rest of the traffic using attack packet filtering rules to truly ensure the traffic security of the target host

Images