Method for detecting network attack by traffic

Abstract

The invention relates to a method for detecting a network attack by traffic, which comprises the following steps of: deploying network traffic analyzers in series on an internet connection link of a protected network, monitoring sizes of traffic of all network messages by the traffic analyzers, and obtaining original network traffic data; and when the same traffic network message appears by more than ten times in less than 5 seconds, determining the traffic network as the network attack. The method has the advantage that the network attack can be rapidly identified.

Description

Technical field [0001] The invention relates to a method for detecting network attacks through flow. Background technique [0002] With the popularization of the Internet, network information security has become more and more important, and network information security has also become an important research field that has attracted much attention. Due to the flaws in the design of the Internet itself and its openness, it is extremely vulnerable to attacks. With the emergence of "Stuxnet", "DUQU", "Flame" and other super cyber weapon viruses, cyberspace security has entered a higher-level cybersecurity technology confrontation stage. These new-stage cyber security threats have the characteristics of continuous attack process, complex attack techniques, sophisticated attack methods, concealed attack behaviors, huge attack resources, and precise attack targets. They pose a serious threat to the security of national infrastructure network facilities and important information system...

AI Technical Summary

Problems solved by technology

These new-stage network security threats have the characteristics of continuous attack process, complex attack techniques, sophisticated attack methods, concealed attack behavior, huge attack resources, and precise attack targets, which pose a serious threat to the security of national infrastructure network facilities and important information systems.

[0003] The current method of identifying network attacks is mainly based on previous experience, that is, the information code that was originally confirmed to be a network attack can only be confirmed after it appears repeatedly, and the new attack information code cannot be confirmed immediately.