Flow-based network node abnormity detection method and system

Abstract

The invention relates to a flow-based network node abnormity detection method and system. The method includes according to the historical network flow data of the node to be detected, acquiring a stable communication target set that includes a stable communication port set and a stable communication peer set; acquiring the multidimensional characteristic statistic threshold according to the stable communication target set and the historical network flow data of the node to be detected; and acquiring the real-time network flow data of the node to be detected, and detecting and evaluating the node to be detected according to the multi-dimensional feature statistical threshold. The method and system can detect the abnormal events such as the possible network attack in real time through the detailed division of the network flow features according to the network nodes forming the network flow data, thereby being high in detection accuracy.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a flow-based network node anomaly detection method and system. Background technique [0002] With the rapid development of computer and network technology, the scale of Internet users is increasing day by day. According to a report released by China Internet Network Information Center (CNNIC), as of December 2015, the number of Internet users in my country has reached 688 million, and the Internet penetration rate is 50.3%. At the same time, 89.0% of enterprises across the country use the Internet to work, and the Internet has become an indispensable and important infrastructure in people's production and life. At the same time, network security issues have become increasingly prominent, and frequent network security incidents have brought a huge threat to the Internet. Among them, network attacks and network theft are important threats to information systems. ...

AI Technical Summary

Problems solved by technology

The method based on statistical analysis is more effective for large-scale traffic anomaly detection, but the traditional method has a single detection index and poor applicability. It lacks detection capabilities for slow attacks and scans and anomalies with no obvious difference in protocol characteristics, especially, The observed traffic contains a large number of unstable normal traffic, which has an obvious hidden effect on abnormal traffic

The method based on signal processing regards network traffic as information flow, and then uses signal processing technology to detect anomalies, usually based on the amplitude of traffic characteristics, and the ability to detect concealed attacks with insignificant ch

Images