Network abnormal flow detection method and system based on time sequence analysis technology

Abstract

The invention relates to a network abnormal flow detection method and system based on a time sequence analysis technology, belongs to the technical field of network flow data research, and comprises the following steps: collecting computer equipment network flow data stored in a data center by adopting a timing synchronization task mode; preprocessing the collected original network flow data to reduce the complexity of network flow anomaly detection and analysis data processing; storing the preprocessed network flow data into a database; performing abnormal flow detection on the network flow data; and storing the abnormal traffic detected in the step 4 into an abnormal traffic feature library. According to the invention, efficient and accurate anomaly detection and analysis of the network flow can be realized.

Description

technical field [0001] The invention relates to a method and system for detecting abnormal network traffic based on timing analysis technology, and belongs to the technical field of network traffic data research. Background technique [0002] With the rapid development of informatization, network security has always been the top priority in the process of information development. Without network security, there will be no national security. With the development of information technology, the network architecture and deployment environment are becoming more and more complex, and the operation of network services is faced with various threats from all parties, such as distributed denial of service attacks (DDoS), which mainly use A large number of requests consume normal bandwidth and resources, so that the server cannot provide services normally. Generally speaking, when network services are attacked or service interruptions occur, the trend of network traffic data will fluc...

AI Technical Summary

Problems solved by technology

For example, when malicious network traffic occurs, it often causes obvious traffic fluctuations

In addition, the current abnormal network traffic detection often requires manual intervention to extract traffic data features. Because the types and compositions of network traffic are relatively complex, feature extraction is not a simple task, and it is easy to increase manual computing overhead.

Finally, network traffic data is continuously generated, and the data scale is large. It is difficult to guarantee the detection efficiency and is often time-consuming to perform detection and analysis directly on the original data.

Images