Network anomaly detection method, system and electronic device

Abstract

The present application relates to a network anomaly detection method, a system and an electronic device. The method comprises the following steps of: a) drawing a network structure topology diagram according to the network structure of the network node and the communication link under the distributed network; B, establishing a corresponding Bayesian network model according to the network structure topology diagram; C, inputting the pre-classified event into the Bayesian network model, the Bayesian network model adopts a probability calculation formula combining a Bayesian conditional probability formula and a time function T (t) to calculate the conditional probabilities of the pre-classified events belonging to different types of anomalies, and obtains an anomaly type classification result of the pre-classified events according to the maximum conditional probability. The application establishes a Bayesian network model aiming at the topological structure of a real network environment, which can have better flexibility and expansibility, improve the detection accuracy rate, and carry out network anomaly detection combined with a time function, thereby improving the sensitivity ofthe model to the anomaly detection in a certain period of time, and effectively reducing the false alarm rate and the false alarm rate.

Description

technical field [0001] The present application belongs to the technical field of network security systems, and in particular relates to a network anomaly detection method, system and electronic equipment. Background technique [0002] With the popularity of the Internet and the rapid development of the network, the Internet has penetrated into thousands of households, bringing a lot of convenience to people's life and work. But network technology is also a double-edged sword, and its rapid development and wide application have brought unprecedented challenges. With the rapid development of the Internet information age, the distributed and borderless open nature of the network, people enjoy the convenience brought by the open structure in the Internet environment. However, the security issues that the TCP / IP protocol itself does not consider and seldom consider. Network security issues seriously affect the stable operation of the network and the normal trial of users, and ev...

AI Technical Summary

Problems solved by technology

However, the above method only analyzes the data collected from the network at the data level, and the parameter range of the benchmark is difficult to determine, which leads to a series of defects such as poor flexibility and high false positive rate.

The key is that the traditional detection model only analyzes the abnormal information for a single host, and is not combined with the existing network distributed multi-node host environment. However, in the actual network environment operation, it is difficult for the traditional discriminant model to determine the various models The required parameter benchmark range makes the traditional method more difficult to distinguish, and there is a certain false positive rate and false negative rate

Images