A network flow analysis and traceability system based on a big data architecture

Abstract

The invention provides a network flow analysis and traceability system based on a big data architecture. The system comprises an external interface, a security big data platform, acquisition equipment, shunting equipment and a rapid retrieval and data association module, and is used for tracing and evidence collection of an original message, analysis of an application protocol and alarming. The interactive analysis module is used for performing statistical aggregation, monitoring early warning, data modeling and rule linkage; And the preprocessing module is used for carrying out log processing, session merging, DPI analysis and security policy providing. According to the invention, the adopted architecture is high in universality, integration of manufacturers is easy, and the reliability of real-time traffic can be ensured.

Description

technical field [0001] The invention relates to the field of big data technology, in particular to a network traffic analysis and traceability system based on a big data architecture. Background technique [0002] Today, with the increasing number of network security problems, traditional security products (such as IDS, malicious signatures, antivirus software) cannot cope with greater network security threats, such as 0-day attacks, APT advanced persistent attacks, so the new The first generation of network security technology has been valued by the industry, and the new generation of network security technology is mainly through the combination of big data, artificial intelligence technology and network security technology. [0003] In the case of large traffic, the existing technology usually adopts a dedicated acquisition device combined with a large storage server architecture. This architecture usually cannot guarantee the reliability of real-time traffic for analysis-...

AI Technical Summary

Problems solved by technology

[0003] In the case of large traffic, the existing technology usually uses a dedicated collection device combined with a large storage server architecture, which usually cannot guarantee the reliability of real-time traffic for analysis-intensive security services

[0004] With a distributed big data architecture, there is no most suitable means of storing a large number of small file messages, usually only the storage and query of messages can be used for backtracking and forensics, but such messages are not used in actual network security applications. It is often not easy to achieve business scenarios such as association and aggregation analysis

Images