Burst traffic detection method based on dynamic threshold

Abstract

The invention relates to a burst traffic detection method based on dynamic threshold. By means of the method, the burst traffic in a high-speed network environment can be effectively detected on line in real time, and the problem that a fixed threshold method cannot well adapt to the dynamically changing network environment is solved. According to the technical scheme, a threshold is dynamically adjusted according to the source IP entropy value of the normal historical traffic, a sliding window mechanism is introduced, and burst traffic is detected by comparing whether the difference value between the current detection value and the average entropy value of a sliding window exceeds the dynamic threshold; the method comprises steps as follows: generation of an initial sliding window, generation of a reference value, generation of the current detection value, abnormality judgment of the current detection value, processing of normal traffic and processing of burst traffic. The detection method is rapid, simple, high in detection rate and low in false rate, the network safety is effectively guaranteed, and the detection method has high practicability and huge economic and social benefits.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a dynamic threshold-based burst flow detection method for network burst flow detection. Background technique [0002] With the continuous development of Internet technology, especially the continuous emergence of various Web applications, the Internet has increasingly become an indispensable part of people's daily work, life, and study. Along with the substantial growth of normal network application traffic, various abnormal traffic also follows, especially the sudden traffic caused by DDoS attacks, which seriously affects network communication and network services. It is of great practical significance and practical value to quickly and accurately detect network burst traffic, thereby further providing reliable basis for network traffic management and control. The burst traffic refers to a large amount of network traffic (that is, network data packets) that suddenly ap...

AI Technical Summary

Problems solved by technology

[0004] In view of the above situation, in order to overcome the defects of the prior art, the object of the present invention is to provide a burst traffic detection method based on a dynamic threshold, which can effectively realize real-time online detection of burst traffic in a high-speed network environment, and solve the problem of using a fixed threshold. The method cannot adapt well to the problem of dynamically changing network environment

Images