Network traffic anomaly detection method and detection device

Abstract

The invention discloses a network traffic anomaly detection method and a detection device. The detection device comprises a data selection unit, a distribution analysis unit, an observation information entropy acquisition unit, a prediction unit, a confidence interval acquisition unit and an anomaly judging unit, wherein the data selection unit is used for selecting network index data to be detected and establishing an attribute record; the distribution analysis unit anomaly inspects the distribution situation of each attribute of the attribute record in connection initiated by and to each host computer in a network; the observation information entropy acquisition unit is used for acquiring observation information entropy according to the distribution situation of the attributes when a time interval reaches a set time threshold; the prediction unit predicts the information entropy of the network index data of the next time interval according to the observation information entropy; the confidence interval acquisition unit acquires a confidence interval needed by anomaly judgment according to the observation information entropy and the prediction information; and the anomaly judging unit analyzes the distribution of the observation information entropy in the confidence interval and determines whether network traffic is anomalous or not according to an analysis result. Through the method and the device, problems of not strong operability and relatively poorer flexibility in network traffic anomaly detection in the prior art are solved.

Description

(1) Technical field [0001] The invention relates to the technical field of network management and security, in particular to a method and device for detecting abnormal network traffic. (2) Background technology [0002] Abnormal network traffic refers to abnormalities caused by network attacks, network viruses, sudden network access, network failures, and new network users. Abnormal traffic is characterized by sudden onset and unknown aura characteristics, which can cause major losses or even fatal damage to the network and computers on the network in a short period of time (such as sudden access behavior caused by specific attack programs or worm outbreaks) . Therefore, it is of great significance to accurately and timely detect the abnormal behavior of network traffic and make a reasonable response to maintain the availability of the network, improve the reliability of the network and ensure the quality of network service. [0003] According to different detection method...

AI Technical Summary

Problems solved by technology

These methods can detect some abnormal traffic, but the entropy value of normal hosts will change dynamically with the change of network traffic, so these methods are less flexible in practical applications

Images