Full-network traffic abnormality extraction method

Abstract

The invention discloses a full-network traffic abnormality extraction method. The method comprises the following steps: step one, selecting monitoring nodes of an autonomous system; step two, segmenting network data stream of each monitoring node with the fixed time interval within a determined time slot, wherein each monitoring node obtain data stream files of multiple continuous periods; step three, constructing and applying a traffic abnormality detector to pre-detect the data stream files of each monitoring node, and determining the abnormal data stream file; step four, performing iterative calculation on the data stream in the abnormal data stream file of each monitoring node to pre-select candidate abnormal data stream sets; step five, summarizing all candidate abnormal data stream sets to form a full-network candidate abnormal data stream set; step six, excavating the full-network candidate abnormal data stream sets using association rules so as to find the real abnormal data stream set. Through the adoption of the method disclosed by the invention, the abnormal data stream can be efficiently and accurately captured based on the MapReduce parallel programming model.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method for extracting abnormal data streams from the entire network traffic. Background technique [0002] With the development of the network, abnormal network behaviors include network failures, user misoperations, network attacks, and network virus propagation. These abnormal behaviors often cause the network traffic on one or more links in the network to deviate from the normal phenomenon. Although abnormal data traffic does not show obvious abnormal characteristics on a single or multiple links, the sum of abnormal data traffic of multiple links in the network is relatively large. Therefore, traffic anomalies are extremely harmful and destructive to the network and various devices running on the network. [0003] In the prior art, methods for detecting abnormal network data traffic include non-statistical-based anomaly detection methods such as: based on neur...

AI Technical Summary

Problems solved by technology

However, the efficiency of non-statistical anomaly detection methods is greatly reduced when the number of samples is large, and the complexity of the algorithm process makes them difficult to deploy on the online real-time anomaly detection system. Unsatisfactory real-time performance and detection

Images