Abnormal flow mode recognition method based on Benford's law

Abstract

The invention discloses an abnormal flow mode recognition method based on the Benford's law. Features which have the highest distinguishing capacity in a normal network environment and an abnormal network environment respectively are selected by means of the Benford's law to serve as metrics; and blended data sets of different attack types are acquired according to the metrics respectively, and the various attack types are recognized by means of differences among mode patterns corresponding to the various blended data sets. By means of the mode patterns, the different attack types can be recognized, and the number of abnormal sessions can be deduced. Compared with other abnormality detection technologies, the method has the advantages that only the practical distribution and the fitting degree need to be computed, the computing amount is little, and the computing process is simpler. For different attack types, the features always can be adopted as the classification standard, and therefore the method has the better applicability.

Description

technical field [0001] The invention belongs to a network flow pattern recognition method, in particular to an abnormal flow pattern recognition method based on Benford's law. Background technique [0002] With the rapid development of the Internet, the popularity of the network is becoming wider and wider. The Internet has become an inseparable part of our work life and is closely related to our personal interests. Once an abnormality occurs in the network, the harm caused is immeasurable. Intrusion detection system is one of the important technologies to ensure network security. Abnormal flow identification refers to the detection and classification of abnormal flow in the process of intrusion detection. And it is a key indicator that affects the performance of the intrusion detection system. [0003] In recent years, abnormal flow identification has been extensively studied in statistical or data mining methods. However, data mining often requires a large number of tr...

AI Technical Summary

Problems solved by technology

When the number of training samples is insufficient, the detection effect will be greatly reduced, and the recognition effect of the model may not be as good as the traditional statistical analysis method based on manual feature extraction

Moreover, since the real-time computation of data mining is relatively expensive, it will make detection very challenging in high-volume environments.

Images