Network flow monitoring method and device

Abstract

The invention discloses a network flow monitoring method and device. The method includes detecting the current network flow, comparing the current network flow with a baseline value, and giving off alarm when the current network flow is greater than or equal to the baseline value, wherein the baseline value is determined based on weighted average value variance of network flow at the same moment in the history, and the weight coefficients for network flow of each same historical moment are different. The network flow of same historical moments refers to the network flow that is detected at the same moment of a historical day before the current detection time. In this way, the network flow of same historical moments changes greatly, and the flow variation can be timely known and reflected during determining of the baseline value. False alarm due to incapability of knowing flow changing timely can be prevented, and the accuracy of determining network flow abnormity can be improved.

Description

technical field [0001] The invention relates to the field of network monitoring, in particular to a network flow monitoring method and equipment. Background technique [0002] With the development of Internet technology, people pay more and more attention to network security, network information statistics and behavior analysis. By monitoring the network traffic, the user's network behavior can be effectively obtained, so that the monitoring personnel can grasp the network dynamics in real time. [0003] Monitoring whether network traffic is abnormal is an application of network traffic monitoring. To judge whether the network traffic is abnormal, it is usually to compare the detected network traffic with a baseline value. If the detected network traffic is greater than or equal to the baseline value, it is determined that the network traffic is abnormal at this time. It can be seen that the determination of the baseline value plays a vital role in judging abnormal networ...

AI Technical Summary

Problems solved by technology

However, if there are large fluctuations in the historical network traffic at the same time that is relatively close to the current detection time, and this fluctuation is normal, the baseline value predicted by the existing method sometimes cannot sensitively reflect these fluctuations. The ups and downs of network traffic at the same time in history can easily lead to false positives

Images