Security analysis framework based on network traffic meta data

Abstract

The invention discloses a security analysis framework based on network traffic meta data. The framework comprises a data layer, an analysis layer, a supporting layer and a displaying layer; the meta data of users, application, location, operation and time relevant to network traffic are acquired, compressed and stored, by means of the key technology, core algorithm, assistant resource and model database of the supporting layer, the secure analysis and displaying of the network meta data are implemented. According to the framework, the network traffic is acquired, the traffic meta data are extracted, the suspected malicious attacks existing in the network traffic are detected by the big data technology, the accuracy of malicious attack detection can be improved, the emergency responding time can be prolonged, and the security of the IT environment is guaranteed effectively; the theoretical basis and guidance are provided for deep security analysis of the network big data, and the significant value can be brought to malicious unknown attack detection, attack tracing and forensic analysis, network security situation awareness and other aspects.

Description

technical field [0001] The invention relates to the technical field of computer network information security, in particular to a security analysis framework based on network traffic metadata. Background technique [0002] With the rapid development of network communication technology, the continuous deepening of Internet applications, and the increasingly rich information carried, the Internet has become an important infrastructure of human society. However, misconfigurations in the network, targeted attacks such as DDoS attacks, worm outbreaks, and advanced persistent threats occur from time to time, and the Internet is facing severe security challenges. [0003] Anomaly detection is valued by academia and industry because it can detect unknown attacks. Researchers have proposed a large number of anomaly detection methods and systems. However, with the continuous growth of network bandwidth and the continuous progress of network attack and defense games, the network itself ...

AI Technical Summary

Problems solved by technology

[0005] In short, in the face of the challenges of unknown targeted attacks such as APT, the current network security defense system has the following limitations: most of the detection methods of network attacks are based on known knowledge and characteristics, and lack the ability to perceive unknown threats; the detection points of network attacks Lag, usually only when the attack has already occurred can effectively detect the threat; the detection mode of network attack is generally based on real-time time points, lacking intelligent backtracking and correlation analysis capabilities for various security events

Images