Network traffic monitoring device and abnormal traffic detection method

Abstract

The invention provides network traffic monitoring equipment and an abnormal traffic detection method, and belongs to the technical field of network security. The network flow monitoring device comprises a network interface, a memory and a processor. The network interface is configured to obtain network flow data; the memory is configured to store programs or data used by the network flow monitoring equipment; the processor is configured to input abnormal data into the attack detection network set if the network traffic data contains the abnormal data, and determine the attack type of the abnormal data according to a detection result output by the attack detection network set. According to the network flow monitoring equipment provided by the embodiment of the invention, after the abnormal data is determined to be contained in the network flow data, the abnormal data is input into the attack detection network set, and the attack type of the abnormal data is determined according to the detection result output by the attack detection network set, so that the abnormal data can be identified; and the attack type of the abnormal data can be determined, so that the network attack behavior can be identified and resolved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a network flow monitoring device and an abnormal flow detection method. Background technique [0002] Network traffic refers to the data transmitted on the network. Usually, in a network environment, most of the network traffic data is normal data. Abnormal data refers to network traffic data that differs greatly from normal data patterns, and abnormal data is likely to be traffic data generated by aggressive behavior. Identifying abnormal data from network traffic data is an important basis for network security management. In recent years, there have been various types of network attacks, sharply enhanced attack capabilities, unpredictable attack methods and attack methods, and frequent data leakage, malware, and security incidents, especially in the form of new technologies such as cloud computing and big data. Security detection and defense pose huge chall...

AI Technical Summary

Problems solved by technology

Due to the limited features saved in the rule base, it is impossible to identify abnormal data that has never appeared before that is not saved in the rule base, so this method has a high rate of false positives

Moreover, the existing methods can only determine whether the network traffic data is normal data or abnormal data, and cannot identify the attack type of abnormal data, so it is not conducive to effectively identify and resolve network attack behaviors

[0004] In summary, there is still a lack of an effective abnormal traffic detection scheme in the prior art

Images