Method and device for monitoring abnormal connection and scanning behaviors of server

Abstract

The embodiment of the invention provides a method and a device for monitoring abnormal connection and scanning behaviors of a server. The method comprises: capturing network session data of a centralswitch; storing the network session data in a distributed database in the form of data records, wherein one data record corresponding to one request or confirmation; extracting behavior data of each IP from data records in the distributed database, wherein the behavior data comprises each connection behavior frequency, IP scanning frequency and port scanning frequency; judging abnormal behaviors of each IP based on the behavior data, wherein the abnormal behaviors comprise abnormal semi-connection, abnormal active connection, abnormal passive connection, abnormal IP scanning and abnormal portscanning; and displaying the abnormal behavior of each IP. According to the method and the device provided by the embodiment of the invention, a large amount of network session data can be processed,the network abnormal behavior is updated in real time, and the network abnormal behavior monitoring efficiency is improved.

Description

technical field [0001] The invention relates to the technical field of network monitoring, in particular to a monitoring method and device for server abnormal connection and scanning behavior. Background technique [0002] Network failures occur all the time, and the port throughput of the switching machine fluctuates. Operation and maintenance personnel may often encounter such problems: users often complain about slow access to the intranet business system or slow file copying, or guess that the intranet may There are port data attacks, but it is impossible to find out which machines initiated them in time. [0003] Malicious port traffic attacks cause a large amount of server resources to be occupied. As a result, normal processes are not effectively processed and bandwidth is occupied. In order to find the source of abnormal attacks, it is time-consuming and labor-intensive to filter through layers of tools. Abnormal port connection behavior monitoring is not only for t...

AI Technical Summary

Problems solved by technology

[0005] Embodiments of the present invention provide a monitoring method and device for server abnormal connection and scanning behavior, which are used to solve the problem that the prior art cannot handle a large amount of network traffic, cannot update the analysis results of a large amount of network session data in real time, and has low efficiency in network abnormal behavior monitoring. The problem

Images