Computer traffic abnormality detection and analysis system

Abstract

The invention discloses a computer traffic abnormality detection and analysis system. A network traffic monitoring process is divided into three phases of (1), collecting network data; (2), processingdata; and (3), detecting abnormality. According to the system, through utilization of main network traffic of a single link, a detection range is relatively wide, and correlation of abnormal behaviors between links or OD streams can be effectively discovered. When a data stream monitoring object is changed, a detection policy can be made flexibly, and a detection rate of the system for the traffic is improved.

Description

Technical field [0001] The invention relates to the technical field of computer system equipment, in particular to a computer flow abnormality detection and analysis system. Background technique [0002] The rapid development of the Internet has fundamentally changed the way people live and work, and greatly improved work efficiency. However, with the increase of people’s dependence on the Internet, the harm of abnormal traffic is also expanding, and the abnormal traffic currently affecting the normal operation of the Internet There are mainly DDOS attacks, network worms, uncontrollable P2P applications and some traffic that can affect network bandwidth and performance. Summary of the invention [0003] The purpose of the present invention is to provide a computer flow abnormality detection and analysis system to solve the existing technical defects and unachievable technical requirements. [0004] In order to achieve the above objective, the present invention provides the followin...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to provide a computer traffic anomaly detection and analysis system to solve existing technical defects and technical requirements that cannot be met