Netflow sampling processing method based on abnormal feedback

Abstract

The invention discloses a NetFlow sampling processing method based on abnormal feedback. This method is based on the principle of NetFlow, uses the analysis results output by the abnormal analysis server to extract the characteristic values ​​of the NetFlow records corresponding to the abnormal traffic, the feedback device performs abnormal detection based on the statistical results, outputs the behavior characteristic parameters of the prevention strategy, and sends them to the routing traffic The collection point and the collection server, the routing traffic collection point adjusts the sampling rate of abnormal traffic packets, and the collection server adjusts the traffic receiving weight of the routing traffic collection point. The present invention makes full use of the analysis results of abnormal analysis, automatically adjusts the sampling rate of routing traffic collection points in real time, adjusts the collection strategy of the collection server, avoids the collection of invalid traffic, reduces the receiving pressure from routing traffic collection points, and realizes real-time monitoring of network traffic status. Feedback and utilization.

Description

technical field [0001] The invention belongs to the technical field of network flow sampling processing, in particular to a NetFlow sampling processing method based on abnormal feedback. Background technique [0002] With the development of the Internet, the number of network users and access devices is increasing, which puts pressure on the safe operation of the computer network, and due to the upgrade of the operating system and the patching of vulnerabilities, virus attacks that invade hosts and then destroy them account for a large proportion of the attacks. The proportion is gradually decreasing, and these attacks turn into malicious consumption of limited resources of the network or occupation of the system, thereby destroying the ability of the system to provide external services, but traditional system upgrades cannot detect and prevent such attacks. Therefore, the real-time monitoring work of the computer network status is very necessary. The real-time monitoring o...

AI Technical Summary

Problems solved by technology

However, after analyzing the results of NetFlow data, the network administrator will carry out the next step, and cannot intervene in time for abnormalities in the network. Therefore, there is collection of invalid traffic, which increases the receiving pressure from routing traffic collection points, and cannot Real-time feedback and utilization of network traffic status

Images