Method and device for detecting abnormal flow

Abstract

The embodiment of the invention discloses an abnormal flow detection method and device, and relates to the network technology field. The data marked as normal and the data marked as abnormal in the training data in advance are used for training to obtain a first classifier configured to distinguish the normal flow data and the abnormal flow data; and the data marked as concrete attack in the training data is employed to perform training to obtain a second classifier for distinguishing various concrete attacks. The method comprises: obtaining the target data corresponding the flow to be detected; classifying the target data by using the first classifier, and obtaining a first classification result; determining whether the first classification result is abnormal or not; if the first classification result is abnormal, employing the second classifier to classify the target data, and obtaining a second classification result; and determining the concrete attack according to the flow to be detected according to the second classification result. According to the embodiment of the invention, the detection precision of the abnormal flow is improved.

Description

technical field [0001] The invention relates to the field of network technology, in particular to a method and device for detecting abnormal traffic. Background technique [0002] With the rapid development of computer networks, there are more and more threatening behaviors attacking computer networks, and the harm caused by these behaviors is usually unpredictable. Therefore, it is necessary to detect the intrusion attack behavior of the computer network in time. [0003] Network traffic is data traffic generated on the network by devices connected to the network. Network intrusion attacks are often accompanied by changes in network traffic, and the most direct manifestation of network security problems is often in changes in network traffic. The abnormally changing network traffic generated by intrusion attacks is called abnormal traffic, so the detection of abnormal traffic is of great significance for timely discovery of network intrusion attacks. [0004] At present,...

AI Technical Summary

Problems solved by technology

As a large amount of network traffic is generated, the traffic data in the database will also change accordingly, resulting in an increasing difference between the normal traffic data and various abnormal traffic data in the training data. Therefore, using the above abnormal traffic The detection accuracy of the detection method is low

Images