Abnormal flow decision-making system and method

Abstract

The invention provides an abnormal flow alarm decision-making system. The system comprises: a traffic classification component, which performs classification statistics on received data messages in astatistical period according to each of multiple dimensions at least including the traffic of the data messages, the protocol proportion and the number of source IPs, and respectively stores classification statistics results in a memory; a scoring component which is used for attributing the classified and counted result of each dimension to different threshold ranges of the corresponding dimension, and endowing the received data message with scores under the corresponding dimension based on the attributed different threshold ranges; and an exception judgment component which accumulates the scores corresponding to all dimensions, and judges the traffic state of the data message received in the statistical period corresponding to the accumulated score exceeding the normal threshold score asan exceptional traffic state of different levels.

Description

technical field [0001] The present disclosure relates to a system and method for making abnormal traffic alarm decision-making, and in particular to a system and method for making multi-dimensional abnormal traffic alarm decision. Background technique [0002] With the advancement and development of network communication technology, the number of network users and access devices is increasing rapidly, and various network attacks such as DDOS, data theft, data tampering, brute force cracking and other network attacks occur frequently, resulting in more and more threats to network security. more threats. [0003] Abnormal traffic is abnormal traffic for the Internet, including network attack traffic, network virus traffic, abnormal service traffic, etc. Abnormal network traffic usually affects the entire Internet system, and even leads to service interruption, resulting in irreparable losses. Deploying a suitable abnormal traffic detection system not only ensures the normal ...

AI Technical Summary

Problems solved by technology

[0005] However, it is too simple to judge the attack by the threshold, which leads to false positives and false positives in many scenarios. For example, the SYN packet threshold set by the user is 100pps, and the normal traffic is 50pps. At this time, the flow of SYN packets exceeds 100pps, but it does not mean an attack, it is just a simple normal flow increase, and the threshold method will be mistaken for a SYN attack

Images