ISP anomalous traffic detection method and system

Abstract

The invention discloses an ISP anomalous traffic detection method and a system, belonging to the field of information safety. The method comprises the following steps: capturing a network data packet; distinguishing a dangerous network data stream to determine a dangerous area; extracting the dangerous mode of the dangerous network data stream sent to the dangerous area; matching the dangerous mode with a memory detector, and meanwhile updating the antibody concentration of the memory detector; and according to the antibody concentration of the memory detector, determining the value at risk of the anomalous traffic of a network. The system of the invention comprises a network data packet acquisition module, a danger identification module, a dangerous area identification module, a network anomalous traffic mode identification module and a danger assessment module. The invention can solve the problems of low misinformation rate, poor self-adaption ability or no self-adaption ability. The invention also adopts the tolerance mechanism of the network anomalous traffic to cause the system to have the ability of detecting the anomalous network traffic caused by a large number of sudden normal network accesses.

Description

technical field [0001] The invention relates to the field of information security, in particular to an ISP abnormal traffic detection method and system. Background technique [0002] Traditional network anomaly traffic detection technology includes signature-based detection technology and anomaly detection technology. Signature-based abnormal network traffic detection technology (such as DDOS attack traffic, port scanning attack traffic, etc.) can only be detected when the signature database has saved the dangerous network data flow signature in advance, otherwise it will escape detection ; The traditional anomaly detection technology establishes a normal behavior model, and then compares it with the established normal behavior model. If it exceeds a certain threshold, an abnormality is detected, otherwise it is normal. Therefore, anomaly detection technology has the capability of unknown abnormal traffic. Commonly used anomaly detection methods include: MULTOPS method, D-W...

AI Technical Summary

Problems solved by technology

[0007] The purpose of the present invention is to provide a detection method and detection system for ISP abnormal traffic in view of the shortcomings of the prior art, which can solve the problems of low false alarm rate, poor or no self-adaptability, and also adopts the network The tolerance mechanism for abnormal traffic allows it to detect abnormal network traffic caused by a large number of sudden normal network access

Images