NetFlow sampling processing method based on abnormity feedback

Abstract

The invention discloses a NetFlow sampling processing method based on abnormity feedback. The method includes that by taking the NetFlow principle as the basis, and by means of the analysis result output by an abnormity analysis server, the eigenvalues recorded by the NetFlow corresponding to the abnormal flow are extracted, a feeder performs the abnormity detection based on the statistic result, outputs the behavior characteristic parameters of a prevention strategy, transmits the parameters to a routing flow acquisition point and an acquisition server, the routing flow acquisition point adjusts the sampling rate of an abnormal flow package, and the acquisition server adjusts the flow reception weight for the routing flow acquisition point. The NetFlow sampling processing method makes full use of the analysis result of abnormal analysis, automatically adjusts the sampling rate of the routing flow acquisition point in real time, adjusts the acquisition strategy of the acquisition server, prevents the invalid flow acquisition, reduces the receiving pressure from the routing flow acquisition point and realizes the real-time feedback and utilization of the network flow state.

Description

technical field [0001] The invention belongs to the technical field of network flow sampling processing, in particular to a NetFlow sampling processing method based on abnormal feedback. Background technique [0002] With the development of the Internet, the number of network users and access devices is increasing, which puts pressure on the safe operation of the computer network, and due to the upgrade of the operating system and the patching of vulnerabilities, virus attacks that invade hosts and then destroy them account for a large proportion of the attacks. The proportion is gradually decreasing, and these attacks turn into malicious consumption of limited resources of the network or occupation of the system, thereby destroying the ability of the system to provide external services, but traditional system upgrades cannot detect and prevent such attacks. Therefore, the real-time monitoring work of the computer network status is very necessary. The real-time monitoring o...

AI Technical Summary

Problems solved by technology

However, after analyzing the results of NetFlow data, the network administrator will carry out the next step, and cannot intervene in time for abnormalities in the network. Therefore, there is collection of invalid traffic, which increases the receiving pressure from routing traffic collection points, and cannot Real-time feedback and utilization of network traffic status

Images