Information entropy variance analysis-based abnormal traffic detection method

Abstract

The invention discloses an information entropy variance analysis-based abnormal traffic detection method. According to the method, a large quantity of Internet user access logs are obtained, and collected data is processed via a system; attack behaviors or abnormal behaviors can be rapidly identified and recorded via big data mining, association and statistical analysis; invasive attack alarm information data can be formed; a complete attack path can be constructed via relevant invasive attack data analysis, and therefore an object of invasion tracking and positioning can be attained. Via use of the abnormal traffic detection method, behavior after events can be traced and machine learning of user access behaviors can be realized, a false alarm rate of a system can be lowered, a network traffic detectability set is put forward, a baseline for normal network traffic is described, and reference is provided for abnormity detection.

Description

technical field [0001] The invention belongs to the field of information, in particular to an abnormal traffic detection method based on variance analysis of information entropy. Background technique [0002] Glossary: [0003] DDoS: Distributed Denial of Service (DDoS: Distributed Denial of Service) attack refers to the use of client / server technology to combine multiple computers as an attack platform to launch a DDoS attack on one or more targets. [0004] CC: (Challenge Collapsar) The attacker uses the proxy server to generate legitimate requests to the victim host to achieve DDOS and camouflage. [0005] CNNIC: China Internet Network Information Center (CNNIC for short). [0006] TCP: TCP (Transmission Control Protocol) is a connection-oriented, reliable, byte-stream-based transport layer communication protocol defined by RFC 793 of the IETF. [0007] With the rapid development of the Internet and the advent of the network society, the relationship between the networ...

AI Technical Summary

Problems solved by technology

[0015] 1. At present, the Internet is developing extremely fast and has become the era of big data, and the cost of user interaction data in the Internet is also increasing. Most of the original methods are to identify attacks by performing feature detection on the TCP packet protocol. And when the amount of data doubles, such a solution will not be able to carry

[0016] 2. The detection method is too cumbersome, and the real-time response speed of attack identification is relatively slow

[0017] 3. Due to the distributed and deceptive characteristics of DDOS, traditional detection methods based on feature matching have been difficult to work

Some algorithms can only be used to detect SYN FLOOD attacks, but cannot detect other DoS / DDoS attacks; some algorithms use the self-similarity characteristics of network traffic for analysis; some filter the source IP address to detect and defend DDoS attack

Each algorithm has its own defects, requires certain prior knowledge, and it is difficult to distinguish normal traffic from bursts

Images