A kind of network behavior detection method and device

Abstract

The invention provides a network behavior detecting method and device and belongs to the field of network auditing. The method and device is characterized in that a plurality of buffer areas are arranged through the collecting buffer area transverse expansion technology, high-speed data collecting under a 10 gigabit network environment is achieved, a network communication behavior feature knowledge database is built on the basis of a tree-like logic model, a finite automata is built and determined according to four vocabulary trees, respectively corresponding to a data link layer, a network layer, a transmission layer and an application layer, obtained after the analysis of the network communication behavior feature knowledge database so as to improve a multi-mode matching algorithm AC-BM, and fast matching of network communication behavior features is achieved. Compared with traditional data packet detecting and data auditing technologies, the network behavior detecting method and device is high in feature matching efficiency, low in algorithm complexity, reasonable in knowledge database design and beneficial to upgrading and expansion.

Description

technical field [0001] The invention relates to the field of network auditing, in particular to a network behavior detection method and device. Background technique [0002] With the development of network technology, various new network applications emerge in an endless stream. At the same time, the rapid expansion of the network scale has increased the network bandwidth. Identifying network applications and network communication behaviors in high-speed networks has become a new requirement in the field of network auditing. At present, the detection methods commonly used in the industry are to complete high-speed network data capture and network communication behavior analysis through dedicated hardware equipment, or to use the traditional "message feature" matching method to sequentially match the features in the rule feature library. The former detection method has high hardware cost and long development cycle, which is not conducive to secondary development and expansio...

AI Technical Summary

Problems solved by technology

The former detection method has high hardware cost and long development cycle, which is not conducive to secondary development and expansion. The latter detection method has low algorithm efficiency, high time and space complexity, and unreasonable feature library design, which is not conducive to upgrade and expansion.

Images