Method for detecting and classifying all-network flow abnormity on line

Abstract

The invention discloses a method for detecting and classifying all-network flow abnormity on line. The method comprises the following steps of: (I) acquiring network flow (NetFlow), namely, receiving a NetFlow data packet transmitted from a border router by adopting a NetFlow collector, resolving the data packet and aggregating data streams to form data suitable for statistical analysis, and transmitting the data to a central control board through network to store in a database; (II) building a flow matrix taking the entropy of flow characteristics as measure; (III) detecting the flow abnormity on line by adopting a main increment component analyzing method; and (IV) constructing sample points in four-dimensional space by utilizing residual vector acquired through on-line detection and classifying the flow abnormity on line by adopting an increment k-mean value clustering method. The method has the advantages of detecting the flow abnormity on line, classifying the flow abnormity on line in real time, meeting the requirement on the real-time detection and classification of the flow abnormity better and laying the technical foundation for subsequently defending against network attack, along with lower time complexity and storage expenditure.

Description

technical field [0001] The invention relates to a method for detecting and classifying Internet flow security, in particular to a method for online detecting and classifying abnormal flow of the whole network. Background technique [0002] Along with the rapid development of the Internet, all kinds of network attacks are becoming more and more rampant, and the problem of network security has attracted more and more attention from people. In order to effectively contain these network attacks, network administrators must discover abnormal behaviors of network traffic in real time from a large amount of network monitoring data, such as denial of service attacks (DoS), distributed denial of service attacks (DDoS), flash crowd (flash crowd) ), etc., and take corresponding defensive measures in time. [0003] At present, most of the network traffic anomaly detection and classification methods adopt offline batch processing method for the traffic of a single link. This requires t...

AI Technical Summary

Problems solved by technology

For the first time, Lakhina et al. used the traffic matrix as a data source, and applied the subspace method based on principal component analysis to successfully detect abnormal behaviors that are difficult to appear on a single link on the entire network view, but this method is still an offline processing method.

[0004] The above-mentioned network traffic anomaly detection and classification methods are all offline processing methods, so they cannot be immediately identified when an attack occurs a

Images