Statistical alarm method and device

Abstract

The invention relates to a statistical alarm method and device. The method comprises the following steps: acquiring network environment and flow data information of a user; determining target IP information and target port information of the corresponding user according to the network environment of the user; correspondingly adding the target IP information and the target port information to a white list library; analyzing the traffic data information to obtain corresponding first IP information and first port information; screening the first IP information and the first port information according to a white list library to obtain corresponding second IP information and second port information; matching the second IP information with the second port information by using a preset alarm matching algorithm to obtain a matching result; if the matching result is successful matching, generating the alarm information and sending it to the user, wherein the alarm information is used for indicating that the flow data information of the user is abnormal. According to the scheme, the false alarm rate of statistical alarms in a point-to-point environment can be reduced.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a statistical alarm method and device. Background technique [0002] With the rapid development of Internet technology, daily life is increasingly inseparable from the Internet, but at the same time cyber attacks have become more frequent. Most of the existing network security devices issue alarms based on statistical security detection and alarm algorithms. For example, common network attacks include: maliciously sending a large number of SYN packets to a server port, which will cause the server to open a large number of half-open connections, thereby consuming A large number of server resources also make it impossible to respond to normal connection requests. In this way, based on the existing security detection alarm algorithm, an alarm can be issued when the SYN packet exceeds the preset threshold, so as to make timely defense. [0003] However, in a point-to-point...

AI Technical Summary

Problems solved by technology

[0003] However, in a peer-to-peer transmission network (P2P for short), a large number of invalid connections of SYN packets will be generated in the process of data transmission. Using the existing security detection and alarm algorithm based on statistics will make the transmission environment SYN packets generated under the invalid connection are counted, resulting in false positives

Images