Abnormal network flow detection method and device

Abstract

The invention discloses an abnormal network traffic detection method and device, and the method comprises the steps of obtaining a plurality of traffic data packets, and extracting the data packet header information of the plurality of traffic data packets; according to the data packet header information, counting the traffic size and the data packet count corresponding to each transmission protocol in the plurality of traffic data packets; matching the data packet header information, the traffic size corresponding to each transmission protocol and / or the data packet count with a preset condition to obtain a first matching result; and generating a first abnormal network flow detection result according to the first matching result. According to the invention, by analyzing the data packet header information, the traffic size corresponding to each transmission protocol and the traffic parameters of the data packet count, the accuracy of abnormal network traffic detection is improved, and the generation of false alarms is effectively avoided; and meanwhile, abnormal network traffic detection can be automatically performed on a plurality of traffic data packets based on the data packet header information, so that the detection efficiency is greatly improved, and a high-speed and large-traffic application scene can be dealt with.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method and device for detecting abnormal network traffic. Background technique [0002] With the rapid development of the Internet of Things, more and more IoT devices have become the targets of hacker attacks. Due to the large number of IoT devices and weak security protection, once a large number of IoT devices are controlled and traffic attacks are launched, the consequences will be is very serious. An existing network attack trend is to use network traffic to launch attacks instead of directly intruding hosts. For example, distributed denial of service (DDOS) attack, this type of attack will cause more damage to the attack target, and it is difficult to trace the intruder, and the bandwidth consumption caused by the attack will seriously affect the network performance . [0003] At present, the commonly used way to detect abnormal network traffic is based on the n...

AI Technical Summary

Problems solved by technology

[0004] In summary, these detection methods in the prior art have the following disadvantages: First, they need to build a huge attack signature detection library (ie, the above-mentioned database), which will bring a lot of performance overhead to traffic detection, so they cannot target high-speed Second, it cannot detect different traffic-based variant attacks; third, the detection accuracy is low, the detection results are inaccurate, and errors and false alarms may occur

Images