Network traffic abnormality detection method and system

Abstract

The invention discloses a network traffic abnormality detection method and system. The method comprises the steps of sampling network traffic, thereby obtaining time sequences composed of traffic data samples through sampling; extracting sample subsequences from the time sequences according to time windows of preset sizes; inputting the sample subsequences into a classification model for model training by taking the sample subsequences as input samples, thereby determining parameters of the classification model; and testing to obtain normal and abnormal classification results of the network traffic according to the classification model of which parameters are determined. According to the network traffic abnormality detection method and system provided by the invention, the extracted time sequence composed of the traffic data samples are taken as the samples for model training and classification detection, the fact that network traffic changes have continuity and correlation in time is taken into consideration, and time information is introduced into abnormal traffic detection and classification. Compared with the prior art, the method and the system have the advantage that the accuracy of carrying out abnormal behavior detection on the network traffic can be improved.

Description

technical field [0001] The invention relates to the technical field of network information security, in particular to a method and system for detecting network traffic anomalies. Background technique [0002] With the development of computer network technology and the continuous expansion of the coverage of network facilities, the network system is becoming more and more complex, and the network equipment is becoming more and more diverse, which increases the chance of abnormal network traffic. Abnormal network traffic refers to the situation where the traffic behavior of the network deviates from its normal behavior. Abnormal network traffic will bring great harm to the network and the computers on the network. Reliability and availability are of great significance. [0003] In recent years, the detection methods for network traffic anomalies are mostly using machine learning methods to train models. These studies use K-Means clustering methods, Support Vector Machines (Su...

AI Technical Summary

Problems solved by technology

However, the existing methods have the following disadvantages: For the collected network traffic data samples, a single traffic data sample is used as the input sample for model training during model training. This method does not consider the influence of historical information on current data, so the network The accuracy of traffic anomaly detection is low

Images