Whole-network abnormal flow identification method based on flow characteristic distribution

Abstract

The invention discloses a whole-network abnormal flow identification method based on flow characteristic distribution. The method comprises the following steps: firstly performing coarse-grained abnormality identification on network data flow in the whole network, extracting node pairs having abnormal flow from the whole network, determining a characteristic category of the abnormal flow, then performing fine-grained abnormality identification based on the extracted characteristic category and the abnormal nodes, determining an abnormal flow characteristic value, and finally collecting an abnormal flow set from the abnormal nodes based on the determined abnormal flow characteristic value. According to the method disclosed by the invention, the abnormal flow identification is performed on the network data flow in the whole network by adopting a hierarchical method, thereby not only improving the accuracy, but also bringing no huge measurement and calculation workload, the abnormal nodes in the whole network are accurately located, and the IP address, the port number and other flow characteristic values of the abnormal flow in the normal node pairs are obtained, and by adoption of the method disclosed by the invention, the abnormal flow can be classified so as to judge the reasons causing the network abnormality.

Description

technical field [0001] The invention relates to the technical field of detecting network anomalies, in particular to a network-wide abnormal flow identification method based on flow characteristic distribution. Background technique [0002] At present, various network anomalies often occur in the Internet environment, such as botnets. Botnets constitute an attack platform, which can be used to effectively launch various attacks, which can cause the entire basic information network or important application systems to Paralysis can also lead to a large amount of confidentiality or personal privacy leaks; such as worm outbreaks, worms that spread through loopholes often cause serious damage in the early stages of the outbreak, and a large number of attacks and network detections will seriously affect the speed of the network and even cause Network paralysis; another example is network congestion. When the network is congested, data loss, delay increase, and throughput decrease ...

AI Technical Summary

Problems solved by technology

[0006] The technical problem mainly solved by the present invention is to provide a network-wide abnormal flow identification method based on the distribution of traffic characteristics, which solves the problem that in the prior art, it is difficult to detect network-wide abnormal flows and cannot identify abnormal flows in the entire network, and Unable to determine the cause of network anomalies

Images