Abnormal traffic detection method

Abstract

The invention discloses an abnormal traffic detection method. The method comprises the following steps: receiving messages; counting the number of the messages according to a message type, storing the number in an IP hash array, and storing traffic characteristics in the IP hash array; storing IP information of the messages whose number ranks are in the former N positions in a sequencing array, wherein N is a natural number; receiving new IP information, updating the IP information of the messages in the former N positions, and storing the IP information in the sequencing array; and in the updated sequencing array, checking whether messages of corresponding types occur abnormal traffic behaviors according to set characteristic values. By adopting the abnormal traffic detection method in the technical scheme of the invention, the problem that the current abnormal traffic detection method cannot solve report leakage and wrong report, the abnormal traffic detection method in the technical scheme can be used for calculating targets with traffic and other indexes ranking in former positions in the entire network in real time and detecting detailed behaviors of these targets to accurately and timely find attacks and greatly reduce the report leakage rate and the wrong report rate.

Description

technical field [0001] The invention relates to the technical field of computer systems, in particular to an abnormal flow detection method. Background technique [0002] Botnets have the characteristics of simple attack methods, large impact, and difficulty in tracing, which makes distributed denial of service attacks (Distributed Denial of Service, DDoS,) rapidly grow and become increasingly rampant. A botnet composed of tens of thousands of hosts provides the required bandwidth and hosts for DDoS attacks, forming a huge attack and network traffic, causing great harm to the attacked network. With the continuous improvement and development of DDoS attack technology, operators such as Internet Service Provider (Internet Service Provider, ISP), Internet Content Provider (Internet Content Provider, ICP) and Internet Data Center (Internet Data Center, IDC) face security and operational challenges. Operators must detect and clean traffic before DDoS threats affect key services ...

AI Technical Summary

Problems solved by technology

[0003] Because the harm of DDOS attack is huge, it will not only quickly make the attacked server unable to provide services normally, but also cause the entire network to be congested. other servers, so it is especially important to find out the attacks in the network in time

[0004] Current attack detection methods generally use fixed thresholds or establish traffic dynamic baselines, both of which have obvious shortcomings

The fixed threshold will cause misjudgment and missed judgment because the threshold is set too large or too small; and if the traffic dynamic baseline is used, the target with a small traffic is prone to sudden situations due to the small base, resulting in misjudgment. Large targets may be missed due to small changes

It is a common defect of these two methods to falsely report the burst traffic of normal business

However, in the initial stage of establishing a traffic dynamic baseline for each new target, it is impossible to detect attacks, and if the attack traffic is used to establish a baseline, it may even become impossible to detect attacks that occur on this target in the future

Images