Abnormal flow detection system and abnormal flow detection method based on service model

Abstract

The invention discloses an abnormal flow detection system and an abnormal flow detection method based on a service model. The abnormal flow detection system comprises a data acquisition and analysis device, a first data detection device, and a second data detection device. The data acquisition and analysis device is used for acquisition and analysis of original target flow data of a target networkport. The first data detection device is used to filter the analyzed target flow data according to a preset flow information white list and a preset flow information black list, and is used to transmit the first flow data of the original target flow data, which is not matched with the flow information white list and the flow information black list, to the second data detection device. The seconddata detection device is used to carry out the flow attack determining of the first flow data according to a preset flow attack analysis module, and is used to identify abnormal flow data from the first flow data. By adopting the method and the system provided by the invention, problems of conventional abnormal flow detection methods such as detection lag, high detection costs, and limited detection capability are effectively solved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an abnormal traffic detection system and method based on a business model. Background technique [0002] With the increasing scale of the network and the increasing types of services carried, the development of the Internet has brought great convenience to people. However, these also greatly increase the chances of various anomalies in the network, and bring greater challenges to network monitoring. Network traffic anomaly analysis is a key part of network monitoring, and it is of great significance to accurately and timely detect anomalies to improve network availability and reliability. [0003] The current abnormal traffic monitoring is based on the feature library. Since each identified attack has a signature, by capturing data packets on the network and comparing it with the signature database, it is analyzed whether it has a known attack pattern, so as to detect ...

AI Technical Summary

Problems solved by technology

[0004] 1. The detection of new anomalies is lagging, and the signature database cannot be upgraded to detect new anomalies;

[0005] 2. The ability to detect encrypted traffic is very limited;

[0006] 3. The performance of the algorithm is related to the complexity of the payload (payload) feature. With the increase of the types of abnormal traffic and the complexity of the payload feature, the detection cost is high and the algorithm performance is poor;

[0007] 4. The cost is too high. Because the abnormal traffic detection and analysis based on payload characteristics needs to analyze every data packet passing through the network, with the growth of the network, it will inevitably become the bottleneck of the network, and it needs to continuously improve the abnormal performance to solve it.

Images