Anomaly detection and attack initiator analysis system based on network flow message

Abstract

The invention discloses an anomaly detection and attack initiator analysis system based on a network flow message, which comprises a data attribute extraction module used for intercepting original message data of network flow from a firewall gateway, extracting a network flow rate according to the intercepted original message data, analyzing message information to generate basic attribute characteristics, and storing the attribute characteristics in a database; an attacker group feature generation module used for sequentially standardizing original data, calculating complex attributes of the data, distributing weights of the attributes, adopting cross validation of a clustering algorithm, introducing an unsupervised machine learning clustering index and adopting a clustering model with thehighest clustering index score to obtain attacker group characteristic clusters; and an attack detection module used for carrying out matching analysis of attack group characteristics and incrementalcorrection of attacker group features on all network attack messages triggering the custom rules. The system can mine characteristics of an initiator in a single attack and locate an initiator suspect of the attack.

Description

technical field [0001] The invention belongs to the field of abnormal detection and analysis of network traffic, and in particular relates to an abnormal detection and attack initiator analysis system based on network traffic messages. Background technique [0002] With the popularity of mobile devices and the massive growth of IOT devices, the rate of network traffic is increasing exponentially, and it is also accompanied by the flood of network attacks. In today's network environment, the abnormal traffic of network attacks is mixed with massive regular traffic, which poses a severe test to the protection of network assets of enterprises. As a key facility for protecting corporate network property, the enterprise firewall, all messages transmitted from the external network to the internal server will first be sent to the firewall gateway, and then forwarded to different internal business servers through the firewall gateway, so the firewall gateway will often receive Unco...

AI Technical Summary

Problems solved by technology

Due to the extremely high network flow rate, both storage of data and real-time analysis will cause unacceptable space / time consumption, resulting in a higher cost of attack protection than the enterprise accepts

[0003] At the same time, due to the special nature of online assets, they often attract attacks from competitors or hackers. However, due to the free nature of the Internet, all messages in legal formats can be forwarded and circulated on the Internet, so conventional protection work Unidentifiable initiators and real sources, not to mention traceability of cyber attacks

It makes it impossible for enterprises to obtain enough information to find out the suspects of the attackers, so as to further improve the defense or obtain evidence of their attacks

Images