Network anomaly recognition detection method and device

Abstract

A network anomaly recognition detection method and a device thereof provided by the invention use a distributed framework to process a large amount of real-time network data to improve the data processing speed and enrich the relationship between feature values between common feature values, and add, when detecting, the connection of network traffic in time to enable effective improvement of the detection rate of network anomalies, therefore, the specific types of abnormal traffic of the network may be identified by simply dividing the traffic into normal and abnormal traffic.

Description

technical field [0001] The invention relates to the field of network information security, in particular to a network anomaly identification and detection method and device. Background technique [0002] In recent years, the scale of the network has continued to expand, and various network applications have become popular rapidly. The network has brought great convenience to people's life, work and study, and people are increasingly dependent on the network. However, at the same time, the addition of large-scale networks, complex and diverse devices, and various new applications has also brought A series of problems, network security issues are becoming more and more prominent, which poses a greater challenge to ensure the normal operation of the network. Abnormalities in the network will occupy bandwidth resources and cause network congestion, causing network packet loss and increased delay. In severe cases, it may even cause network pain. It will also waste a large amount...

AI Technical Summary

Problems solved by technology

However, this method can only detect whether there is an intrusion in the network, and cannot identify the type of intrusion. It is just an anomaly detection technology; this method uses a shallow neural network learning model, which does not have the advantages of deep learning

[0006] For traffic detection, most of the existing works only focus on using the characteristics of abnormal traffic itself to judge whether the traffic is abnormal, but ignore the connection of network traffic in time

Images