A high-speed detection system and method for abnormal network traffic based on GPU video coding interface

Abstract

The invention discloses an abnormal network flow detection system and method based on video coding. The system comprises a flow acquisition module, a flow statistics module, a video frame generation module, a video coding module and a video bit rate analysis module. Statistical data of original flow is directly encoded to form original video frames, whether abnormal network flow occurs or not canbe judged according to code rate changes of variable bit rate videos after GPU video encoding, a complex model and hyper-parameters do not need to be selected, training in advance is not needed, and the system and method have good performance and good environmental adaptability and do not depend on an abnormal flow sample which is difficult to obtain. Compared with a DPI method based on an abnormal flow feature library, a feature library prepared in advance is not needed, so that a good detection effect on unknown abnormal flow is achieved, in addition, video coding is conducted based on GPU acceleration, and the performance of the DPI method is superior to that of a DPI method with the same hardware cost.

Description

technical field [0001] The invention relates to the field of electrical digital data processing, in particular to a high-speed detection system and method for abnormal network traffic based on a GPU video encoding interface. Background technique [0002] The detection of abnormal network traffic in the field of network security is one of the key technologies. When there is easy normal traffic in the network, it often reveals that there are security threats in the network, including network resource failure to provide effective services caused by abnormal network operation, which affects the security of network services, such as network equipment failure or network protocol operation abnormality The traffic impact caused by it also includes the abnormal traffic artificially generated by malicious attackers to achieve their attack purposes, such as DDOS attacks. The abnormality of network traffic is also reflected in different layers, such as network layer, transport layer, a...

AI Technical Summary

Problems solved by technology

In addition, under different scenarios and different threat situations, it is quite difficult to choose different machine learning or neural network models and corresponding hyperparameters, both in theory and in practice, so the method is not universal

In addition, the above method requires a considerable number of abnormal traffic samples to have a good training effect. In practice, it is often difficult to obtain properly labeled abnormal traffic samples, so the training effect is difficult to achieve the goal of accurately detecting abnormal traffic.

Images