Network flow detection method and device

Abstract

The invention relates to the technical field of network flow management, and discloses a network flow detection method and device. The method comprises the following steps that: a gateway acquires network traffic to be detected corresponding to a specified port on a server; the gateway performs classification processing on the to-be-detected traffic data according to a preset rule to obtain traffic data corresponding to each traffic type, and the preset rule is a classification rule set for the traffic type; the gateway performs anomaly detection on the traffic data of each traffic type to obtain to-be-distributed traffic data; the gateway distributes the flow data to be distributed to the service node associated with the corresponding flow type; and the service node performs anomaly detection on the received flow data from the gateway when the micro-service is started. By implementing the method and the device, the gateway and each service node can directly perform independent anomaly detection on the traffic data without other modes, so that the detection time of the malicious traffic is saved, and the detection efficiency of the malicious traffic is improved.

Description

technical field [0001] The invention relates to the technical field of network traffic management, in particular to a method and device for detecting network traffic. Background technique [0002] Malicious crawlers, automatons, simulators and other malicious software are increasingly threatening the healthy development of the Internet. Malware usually attacks websites, APPs or APIs at the application layer by forging requests from real users to obtain Internet data, in order to achieve profit-making purposes. In order to protect private data from prying eyes, encryption methods are usually used to protect private data. However, encryption can hide malware just like other private information, thus bringing a series of malicious traffic such as worms, Trojan horses, and viruses. [0003] In order to deal with this problem, the current common method is to decrypt the traffic and use devices such as next-generation firewalls to view the traffic; it is also possible to set up a...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the embodiments of the present invention provide a network traffic detection method and device to solve the problems of long time-consuming, low efficiency, and large transmission loss of encrypted traffic detection

Images