Optimization method of traffic abnormality monitoring

Abstract

The invention discloses an optimization method of the traffic abnormality monitoring. The optimization method comprises the following steps: reading a learning table, acquiring a learning parameter, if the learning parameter is empty, computing the learning parameter and saving the learning parameter in a database; reading the current real-time traffic on the network, continuously updating the learning parameter value according to the current real-time traffic; and determining the current standard traffic value according to the formula: the current standard traffic value= (1-a)* last standard traffic value+a*the current real-time traffic; determining a threshold according to the formula: the threshold=middle value*(sample high value / sample low value); judging whether the current real-time traffic is in the range of current standard traffic value+ / -the threshold; if the current real-time traffic is not in this range, indicating that the current traffic is in abnormal, giving out an alarm when the abnormality occurs, and updating the learning parameter; updating a traffic sample table, and writing in the learning table data. By using the optimization method disclosed by the invention, the accuracy of the traffic monitoring of each day or under the same sampling frequency can be effectively improved, and the effectiveness of the traffic abnormality monitoring is guaranteed.

Description

technical field [0001] The invention relates to the technical field of abnormal flow monitoring in industrial control systems, in particular to an optimization method for abnormal flow monitoring. Background technique [0002] Network traffic monitoring is mainly to continuously collect network data, and monitor network traffic through continuous collection of network data. After the network traffic data is obtained, the statistics and calculations are carried out to obtain the performance indicators of the network and its main components. In the case of abnormal network traffic, the network traffic monitoring system can also send an alarm to the network manager, so that the fault can be dealt with in a timely manner. [0003] In recent years, industrial control system (hereinafter referred to as "industrial control") network security incidents have occurred frequently at home and abroad, which has aroused global attention. The characteristic of the industrial control netwo...

AI Technical Summary

Problems solved by technology

[0004] However, some of these products only have simple data collection and statistics without further calculations, let alone traffic anomaly monitoring; there are also some products whose traffic monitoring algorithms lack correction, rely too much on sample data, and fail to learn the relationship between samples. Change trend, only use a single formula, which cannot guarantee relatively accurate results

Images