Device and method for detecting network access abnormality based on data stream behavior analysis

Abstract

The invention relates to a device for detecting network access abnormality based on data stream behavior analysis, comprising a flow information collection module, an abnormal behavior detection module and an abnormal flow processing module, wherein the flow information collection module is respectively connected with the abnormal behavior detection module and the abnormal flow processing module;and the abnormal behavior detection module is connected with the abnormal flow processing module. The invention also relates to a method for using the device. In the method, obvious abnormal flow data is filtered out firstly, then a network behavior model is used to detect the filtered flow data, and the network behavior model is automatically updated; and finally, the flow is blocked according to detection results. The device and method provided by the invention is utilized to establish a normal network behavior model. The model is compared with real-time data so as to detect whether real-time flow is abnormal; and the network behavior model is dynamically modified, abnormal flow sources are analyzed, and the abnormal flow is blocked, thus identifying the abnormal flow quickly and effectively and improving the accuracy of the detection.

Description

technical field [0001] The present invention relates to the field of network technology, in particular to the field of network access anomaly detection devices and methods, in particular to a network access anomaly detection device and method based on data flow behavior analysis. Background technique [0002] Currently, the existing network flow traffic analysis techniques are divided into the following categories: [0003] 1. By summing up the network traffic and setting a threshold to judge whether there is any abnormality in the network traffic. For example, through the SNMP interface on the network device, regularly obtain the data flow of the relevant network port, such as the total number of unicast packets, the total number of bytes of unicast packets, etc., and compare them with the preset threshold to determine whether abnormal. [0004] 2. By analyzing single or several consecutive data packets, it is judged whether the data packets belong to abnormal traffic. F...

AI Technical Summary

Problems solved by technology

[0007] The purpose of the present invention is to overcome the above-mentioned shortcomings in the prior art, and provide a method that can quickly and efficiently summarize traffic behavior in the application environment of large-scale data traffic analysis, identify abnormal traffic, and effectively avoid the undetectable increase in slow abnormal traffic. network access anomaly detection device and method based on data flow behavior analysis, which improves the detection accuracy, and the application method is relatively simple, the application cost is low, and the scope of application is wide

Images