Network threat evaluation method based on multi-granularity anomaly detection

Abstract

The invention relates to a network threat evaluation method based on multi-granularity anomaly detection, and can effectively solve the problem that the existing threat situation evaluation technology based on a network data packet or a network flow cannot be well suitable for rapidly and accurately identifying an attack event and perceiving a threat situation in a high-speed network environment. The network threat evaluation method comprises the following steps: analyzing a time slice including an abnormal network flow by utilizing a packet-based coarse granularity anomaly detection; performing flow reassembly of the network flow of the abnormal time slice and extracting a flow characteristic attribute through flow-based fine granularity anomaly detection, and judging the attack type by utilizing a flow characteristic anomaly detection algorithm; and finally, quantifying and evaluating the serious degree of the threat event in a current network according to the detected threat event. The method disclosed by the invention is easy to operate and can detect the serious degree of the threat event subjected by the network precisely in real time; network workers can easily know the security threat subjected by the current network in time; and effectively emergency response measures can be taken in time.

Description

technical field [0001] The invention relates to network security technology, in particular to a network threat assessment method based on multi-granularity anomaly detection based on network traffic network security threat assessment. Background technique [0002] With the rapid development of Internet technology, the Internet has gradually become an indispensable part of people's production and life, which greatly facilitates people's production and life. At the same time, the increasingly complex network environment has also produced a variety of network attacks, which have brought huge economic losses to society and posed a huge challenge to national security. Although there are many security products such as firewalls, intrusion detection equipment, and intrusion prevention systems, they face complex and diverse attack detection requirements in high-speed network environments. On the one hand, detection methods based on statistics or simple packet pattern matching cannot...

AI Technical Summary

Problems solved by technology

[0004] In view of the above situation, in order to overcome the defects of the prior art, the purpose of the present invention is to provide a network threat assessment method based on multi-granularity anomaly detection, which can effectively solve the problem that the existing threat situation assessment technology based on network data packets or network traffic cannot It is well adapted to the problem of quickly and accurately identifying attack events and perceiving threat situations in a high-speed network environment

Images