Method and system for quantificationally calculating network abnormity index

Abstract

The invention provides a method for quantificationally calculating a network abnormity index. The method comprises the following steps of: selecting a certain number of router nodes as acquisition points of data in a network to be monitored, and setting a basic period and a report period for data acquisition; performing data acquisition on each data acquisition point to obtain relevant information comprising an active IP address, a target IP address, a source port, a target port, a protocol type, stream start time, stream end time, packet number, byte number and a TCP marker; counting and calculating the acquired data to obtain indexes of network data traffic, protocol components, IP and port distribution and behavior modes in the network to be monitored; and combining the indexes obtained by calculating at the current time with corresponding indexes obtained by calculating in the basic period, and calculating the network abnormity index which is used for expressing the abnormity degree of the network to be monitored. The method can effectively reflect the influence of a typical network security incident on the network security situation in time.

Description

technical field [0001] The invention relates to the field of network security, in particular to a quantitative calculation method and system for a network anomaly index. Background technique [0002] With the rapid development of information technology and Internet technology, malicious attacks on network information systems have become more and more diverse and complex. Therefore, technologies such as network security situation monitoring, evaluation and trend forecasting have gradually become research hotspots. As the research basis and technical means of the above-mentioned technologies, the network security index and index system have important theoretical significance and practical value, especially the index system research used to reflect the macro network security situation. [0003] From the perspective of the reflected network security characteristics, the network security index can be divided into usability index, abnormality index, effectiveness index, etc., amo...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to overcome the defect that the existing network anomaly detection method can only reflect the microscopic security situation of the network, but cannot reflect the macroscopic security situation of the network, thereby providing a method for detecting the overall security of the network

Images