Distributed self-learning abnormal flow cooperative detection method and system

Abstract

The embodiment of the invention discloses a distributed self-learning abnormal traffic cooperative detection method and system, relates to the technical field of the Internet, and aims to filter moreabnormal traffic more comprehensively and reduce the false alarm rate of the system. The method comprises the steps of: classifying input traffic through a traffic classifier, and malicious traffic isscreened out; uploading the malicious traffic to a comprehensive management module; enabling the comprehensive management module to mark the malicious traffic reported by the analysis node to obtaina malicious traffic sample; enabling the comprehensive management module to classify the malicious traffic sample into a system sample library and issue the malicious traffic sample to a specified analysis node; enabling the specified analysis node to update a node sample library corresponding to the specified analysis node according to the malicious flow sample issued by the integrated managementmodule; and enabling the specified analysis node to train a weight model according to the updated node sample library through a weight training module to obtain an updated weight, and importing the updated weight into a traffic classifier. The method and the system are suitable for a large-scale distributed system.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a distributed self-learning abnormal traffic collaborative detection method and system. Background technique [0002] With the large-scale development of network technology, the risks and threats in the network environment have become issues that cannot be ignored. In a distributed large-scale network, the network traffic of each node continues to increase, and the abnormal traffic mixed with it has complex and changeable characteristics, which not only increases the difficulty of supervision by managers, but also brings unpredictable risks to users and enterprises. Therefore, there is an urgent need for a comprehensive and efficient abnormal traffic monitoring system to detect and process more abnormal traffic in time to ensure the security and stability of large-scale network environments to the greatest extent. [0003] In a distributed network, multiple network traffic ...

AI Technical Summary

Problems solved by technology

The overall strategy is easy to configure, but it is difficult to take into account the differences of different nodes

As a result, the larger the scale of the distributed system, the higher the false alarm rate of the system, and it is difficult to guarantee the overall security and reliability of the network.

Images