A Method of Abnormal Traffic Detection

Abstract

The invention discloses an abnormal flow detection method. The method comprises steps that detection equipment counts and detects target IPs of messages; the detection equipment selects an abnormal target IP and sends a notice to cleaning equipment; and the cleaning equipment performs IP statistics, feature code statistics and message length probability statistics of the message including the abnormal target IP and then performs cleaning and filtering. The invention solves the problem that a conventional abnormal flow detection device is poor in detection performance and unsatisfactory in cleaning effect, and improves the detection and cleaning accuracy.

Description

technical field [0001] The invention relates to the field of statistical analysis of network traffic, in particular to a method for detecting abnormal traffic. Background technique [0002] Denial of Service attack (DoS, Denial of Service) refers to using various service requests to exhaust the system resources of the attacked network, so that the attacked network cannot process the requests of legitimate users. With the rise of botnets, and due to the characteristics of simple attack methods, large impact, and difficulty in tracing, distributed denial of service attacks (DDoS, Distributed Denial of Service) have grown rapidly and become increasingly rampant. A botnet composed of tens of thousands of hosts provides the required bandwidth and hosts for DDoS attacks, forming a huge attack and network traffic, causing great harm to the attacked network. [0003] With the continuous improvement and development of DDoS attack technology, operators such as Internet Service Provid...

AI Technical Summary

Problems solved by technology

[0005] The current abnormal traffic detection method generally adopts the method of deploying detection equipment in bypass and deploying cleaning equipment in series. The detection equipment generally not only detects the abnormal target IP, but also tries to find out the IP of the attack, that is, the source IP, and then announces to the cleaning equipment Abnormal, the cleaning device performs a simple filtering and cleaning with a specific cleaning strategy for the abnormal. The defect of this method is that the detection device needs to perform statistical detection on a large number of targets, which consumes a lot of performance. In addition, trying to find out the attack IP , not only will greatly reduce the performance, but also the accuracy rate is not ideal, and the cleaning strategy of the cleaning equipment is too simple, which will cause accidental killing or unclean cleaning, and have a bad experience for users in the network

Images