Network traffic anomaly detection method based on historical time point taking method

Abstract

The invention discloses a network traffic anomaly detection method based on a historical time point taking method, comprising the following steps: 1, deploying port mirroring routes at network trafficcollection points to capture full-traffic data packets to form a network traffic time series data source; 2, performing behavior feature statistics of network traffic on the network traffic time series data source by using a fixed time window to form network behavior time series feature vectors; 3, taking the Witt vector of each network behavior time series feature vector as input, selecting historical data by using the historical time point taking method, and cumulatively calculating abnormal deviation values by using an quantitative method of absolute changes, relative changes and trend changes respectively; and 4, cumulating the abnormal deviation values by using an evidence cumulating method, setting a threshold according to the abnormal deviation data distribution trend, and making an anomaly decision on the state of the current time window network behavior. The method reduces the calculation cost while continuously monitoring threat events and trends of the network, and improvesthe accuracy of network abnormal behavior monitoring.

Description

technical field [0001] The invention relates to a method for detecting abnormality of network flow, in particular to a method for detecting abnormality of network flow based on the historical time point method. Background technique [0002] With the development of the Internet, the network environment is becoming more and more diverse and complex. In addition to normal network traffic, various abnormal traffic on the network threatens the security and use of user hosts. How to monitor and manage network traffic in real time and detect abnormal network behavior has become a problem that needs to be solved in network security. [0003] However, due to the huge amount of network data, real-time monitoring and analysis of traffic has extremely high requirements for computer analysis, storage, and calculation. Network traffic anomaly detection methods are becoming more and more important. Most of the current network traffic anomaly detection technologies have some shortcomings, s...

AI Technical Summary

Problems solved by technology

[0003] However, due to the huge amount of network data, real-time monitoring and analysis of traffic has extremely high requirements for computer analysis, storage, and calculation. Network traffic anomaly detection methods are becoming more and more important. Most of the current network traffic anomaly detection technologies have some shortcomings, such as Signature-based anomaly detection technology to analyze and identify unexpected network behaviors, but this detection technology can only rely on predefined signature rule bases to discover network anomalies, and cannot detect unknown network anomalies; the same widely used machine-based Learning algorithm to classify network traffic as normal or abnormal. However, this classification method faces problems such as difficulty in obtaining training samples, high computing costs, and high false alarm rate, and cannot adapt to the dynamically changing complex network environment.

Images