Abnormal flow detection method, device, equipment and medium

Abstract

The invention provides a method, device, equipment and medium for detecting abnormal traffic, which are used to improve the detection efficiency of network attack behavior and reduce the false detection rate. The method for detecting abnormal traffic includes: acquiring traffic data to be detected that includes multiple attribute features; matching the multiple attribute features with pre-configured attack features to determine the abnormal features contained in the traffic data to be detected; When the abnormal characteristics of the traffic data to be detected are inconsistent with the abnormal characteristics of the target traffic data in the predetermined abnormal database, determine whether the traffic data to be detected is abnormal traffic according to the abnormal characteristics contained in the traffic data to be detected data, the target traffic data is any abnormal traffic data in the abnormal database.

Description

Technical field [0001] The present invention relates to the field of flow identification technology, in particular to a detection method, apparatus, apparatus and medium of abnormal flow. Background [0002] Driven by the wave of artificial intelligence, intelligent self-learning has penetrated into all aspects of people's daily lives, and at the same time, there are higher requirements for intelligent and convenient lifestyles, and new challenges have been generated for the intelligence of machines. For example, in the field of network security, online analysis and judgment of attacks, network attack behavior analysis, etc. have gradually become the core research points of artificial intelligence. [0003] There is currently a limited number of network behaviors of known attack types, such as DOS attacks, web attacks, Worm attacks, Trojan attacks, etc. However, in the actual network environment, there are still a large number of unknown types of cyber attacks. In the prior art, ...

AI Technical Summary

Problems solved by technology

However, in the actual network environment, there are still a large number of unknown types of network attacks

In the existing technology, in the process of training the model, only a limited number of sample data of known network attack types can be used for labeling. The trained model still has a very limited ability to distinguish network attack behaviors, and the detection efficiency is low. Problems with a high probability of false detection

Images