Network node flow anomaly analysis method and system

Abstract

The invention discloses a network node flow anomaly analysis method. The method comprises the following steps: carrying out preprocessing on network flow data to obtain network nodes where the network flow data flow by; obtaining a connection behavior feature of each network node where the network flow data flow by; calculating a network flow connection diagram of the network node by using the connection behavior feature; and judging whether the flow of the network node is abnormal by using the network flow connection diagram. According to the network node flow anomaly analysis method disclosed by the invention, the connection behavior feature of each network node where the network flow data flow by is obtained, and flow anomaly analysis is carried out by using the network flow connection diagram formed by the connection behavior feature, thereby simplifying the network scale and reducing the calculated amount of detection. In general, by adoption of the network node flow anomaly analysis method disclosed by the invention, the difficulty of detecting the network flow data anomaly can be effectively reduced. In addition, the invention further discloses a network node flow anomaly analysis system correspondingly.

Description

technical field [0001] The invention relates to cloud computing technology, in particular to a method and system for analyzing network node flow abnormality. Background technique [0002] Network technology is constantly improving. While network applications bring convenience to people, they may also bring hidden dangers to people's information security. For example, recently more and more network applications will illegally use unauthorized ports or encrypt and hide transmission traffic data without permission. When users encounter malicious network applications, they will face huge information security risks. [0003] There are two existing solutions to the information security problem during traffic data transmission in the network. The first method is to use statistical data to detect traffic data anomalies, for example, to detect the size, time slot, quantity, and byte volume of packets of traffic data transmitted by network applications. Another solution is to perfor...

AI Technical Summary

Problems solved by technology

[0004] The above two anomaly detection methods for network traffic data are very difficult to implement. First of all, due to the large dynamic changes of the backbone network and the large scale of data traffic, the calculation amount of the traditional statistical data method is very large. large and difficult to detect

Moreover, some authorized network applications will also hide traffic data through encryption, increasing the difficulty of detection

Images