Real-time network flow anomaly detection method based on big data

Abstract

The invention discloses a real-time network flow anomaly detection method based on big data, which comprises the following steps: S1, obtaining collected and analyzed historical flow data with attacktags stored in a database to obtain attack types; S2, performing data feature preprocessing on the historical traffic data in the S1, and constructing a first class of feature vectors; S3, constructing a clustering model based on the first class of feature vectors in the S2, and obtaining a target model meeting a preset condition by utilizing model evaluation and optimization; S4, storing the target model obtained in S3 and deploying the target model online; S5, capturing and collecting real-time network data flow packet information transmitted in a local area network; S6, performing data feature preprocessing on the real-time network data traffic packet in S5, and constructing a second type of feature vectors; and S7, according to the target model in the S3 and the second type of featurevectors in the S6, performing real-time online analysis and detection, and judging whether the current real-time network data traffic is abnormal traffic or normal traffic.

Description

technical field [0001] The invention relates to the technical field of computer application to Internet security, and in particular to a method for detecting network traffic anomalies based on a big data environment. Background technique [0002] The current network security situation is extremely severe, and more and more network attacks have been reported, which has brought serious network security threats to key enterprises, individuals and important departments. This advanced persistent threat (APT, advanced persistent threat) can easily evade the identification of traditional detection technologies by taking advantage of its strong pertinence, camouflage and staged characteristics. New attack methods and technologies emerge in an endless stream, making the general intrusion prevention system unable to effectively match and identify them. At the same time, any network attack is transmitted through the network, and there must be related data packet transmission between t...

AI Technical Summary

Problems solved by technology

If you only monitor and analyze part of the network transmission data, the success rate of network attack detection will be greatly reduced. Once the LAN is breached, it will bring various huge and unexpected losses

However, it takes a lot of time and powerful computing power to process all the data globally and in real time.

Images