A flow-based network node anomaly detection method and system

Abstract

The invention relates to a flow-based network node abnormity detection method and system. The method includes according to the historical network flow data of the node to be detected, acquiring a stable communication target set that includes a stable communication port set and a stable communication peer set; acquiring the multidimensional characteristic statistic threshold according to the stable communication target set and the historical network flow data of the node to be detected; and acquiring the real-time network flow data of the node to be detected, and detecting and evaluating the node to be detected according to the multi-dimensional feature statistical threshold. The method and system can detect the abnormal events such as the possible network attack in real time through the detailed division of the network flow features according to the network nodes forming the network flow data, thereby being high in detection accuracy.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a flow-based network node anomaly detection method and system. Background technique [0002] With the rapid development of computer and network technology, the scale of Internet users is increasing day by day. According to a report released by China Internet Network Information Center (CNNIC), as of December 2015, the number of Internet users in my country has reached 688 million, and the Internet penetration rate is 50.3%. At the same time, 89.0% of enterprises across the country use the Internet to work, and the Internet has become an indispensable and important infrastructure in people's production and life. At the same time, network security issues have become increasingly prominent, and frequent network security incidents have brought a huge threat to the Internet. Among them, network attacks and network theft are important threats to information systems. ...

AI Technical Summary

Problems solved by technology

The method based on statistical analysis is more effective for large-scale traffic anomaly detection, but the traditional method has a single detection index and poor applicability. It lacks detection capabilities for slow attacks and scans and anomalies with no obvious difference in protocol characteristics, especially, The observed traffic contains a large number of unstable normal traffic, which has an obvious hidden effect on abnormal traffic

The method based on signal processing regards network traffic as information flow, and then uses signal processing technology to detect anomalies, usually based on the amplitude of traffic characteristics, and the ability to detect concealed attacks with insignificant changes in traffic amplitude is insufficient.

The method based on machine learning first extracts and trains an automatic learning method that can judge abnormalities from known network traffic, and then applies it to unknown traffic for abnormal detection. Traditional methods also have the problem of low accuracy.

[0004] It can be seen that the detection objects of the existing network anomaly detection methods are all the observed traffic, a large number of different and constantly changing irrelevant normal traffic, which makes the normal traffic detection process of the victim node difficult to detail. As a result, the existing network anomaly detection methods have low detection accuracy and poor practicability

Images