Rapid detection method for network flow anomaly

Abstract

The invention discloses a rapid detection method for network flow anomaly, which aims to solve the problem of slow detection speed of the existing detection method for the network flow anomaly. The technical scheme of the invention is as follows: adopting a Hurst index which is used for describing the fractal characteristics of network flow to judge the occurrence of the anomaly; solving the Hurst index through the iteration of the sampled latest flow data; establishing an abnormal judgment threshold through the change of the Hurst index; and carrying out flow anomaly detection directly, and detecting the network flow anomaly in real time, thereby improving the speed of detecting the network flow anomaly.

Description

technical field [0001] The invention relates to a method for detecting abnormality of network flow, in particular to a fast method for detecting abnormality of network flow. Background technique [0002] With the development of the Internet, the network environment is becoming more and more complex. All kinds of sudden and fast anomalies and attacks often catch the anomaly detection system off guard. The rapidity and real-time performance of anomaly detection have become more and more important. However, the existing anomaly detection methods focus on the accuracy of detection, which cannot keep up with the needs of Internet development. [0003] The document "Network-Based Anomaly Detection Using an Elman Network, International Conference on Computer Communication and Mobile Computing (ICCNMC2005), 2005, pp.471-480" discloses a method for detecting network traffic anomalies using a simple recurrent neural network generation model, This method applies the aggregated informa...

AI Technical Summary

Problems solved by technology

However, there are still some defects in this method: First, the scheme is still generated based on the feature library, and the feature library must be established and trained and learned in advance, and the feature library itself is subjectively established and cannot reflect the characteristics of the network itself, so it is still difficult to guarantee detection accuracy

Secondly, the solution does not consider the problem of detection speed. However, for various sudden and fast abnormalities and attacks that appear in large numbers today, detection speed is undoubtedly an important technical indicator.

Finally, there is a lag in the feature library matching itself, and training and learning occur after the abnormality occurs, so it is difficult to ensure real-time detection

Images