Network data flow detection method and device

Abstract

The embodiment of the invention discloses a network data flow detection method and device. The method can be applied to a malicious traffic detection scene. According to the method, through judging the type of a cluster according to the size of the cluster, the method does not depend on the universality and accuracy of a training set, does not need the support of a high-quality training set, and effectively reduces the cost problem caused by the high-quality training set. The method achieves the self-adaptive malicious traffic recognition in different network environments, and is less dependent on human experience, and is more adaptive to the network. The method comprises the following steps: extracting feature vectors of a plurality of network data streams for the plurality of network data streams; then clustering the plurality of data streams based on a preset clustering algorithm and the feature vectors of the plurality of network data streams to obtain one or more clusters; and determining the type of each cluster by comparing the feature information of the cluster with a first preset condition.

Description

technical field [0001] The present application relates to the field of computers, in particular to a method and device for detecting network data flow. Background technique [0002] At present, there are more and more application scenarios of Internet encrypted traffic. As mainstream browser providers such as Google begin to define hypertext transfer protocol (HTTP) as "unsafe", more and more websites begin to upgrade Deploy the HTTPS encryption protocol. Therefore, the penetration test traffic facing the website system objectively realizes data encryption, which poses a challenge to the network detection of attack behavior. At the same time, the communication methods of various malicious software, such as Trojan horse virus, etc. are gradually adopting encryption methods (mainly referring to the communication between the controlled node and the CC control server), which also poses a challenge for the network detection of malicious traffic. [0003] A method for network de...

AI Technical Summary

Problems solved by technology

[0004] However, this method has high requirements for the black-and-white traffic training set, and the labeling of black-and-white traffic still requires a high level of manual experience. There will be great differences in the traffic models in different network scenarios, and traffic detection with a high degree of dependence on network scenarios ( Such as penetration test traffic), model training is required in different network scenarios to achieve better detection results, and it does not have network adaptability

Images