Network security situation awareness method based on artificial intelligence

Abstract

The invention relates to the technical field of artificial intelligence, in particular to a network security situation awareness method based on artificial intelligence. The method comprises the following steps: acquiring the connection number, the access duration, the access times, the uplink flow sequence and the total uplink flow of each target IP; calculating an access behavior evaluation index of the target IP based on the access times, the access duration and the uplink flow sequence; analyzing the uplink traffic to obtain a traffic distribution score of each target IP; obtaining a behavior white coefficient according to the connection number and the traffic distribution score; and obtaining the maximum connection number and the maximum uplink flow of the target IP according to the access behavior evaluation index, the behavior battle coefficient and the uplink flow. According to the embodiment of the invention, the maximum connection number and the maximum uplink flow corresponding to each target IP are obtained by analyzing the connection number, the uplink flow and the access duration of the target IP, and the DDoS attack is avoided by limiting the connection number and the uplink flow of the target IP, so that the purpose of network security situation awareness is achieved.

Description

technical field [0001] The invention relates to the technical field of artificial intelligence, in particular to a network security situational awareness method based on artificial intelligence. Background technique [0002] Network security situational awareness is to acquire, understand, display and predict the future development trend of network security based on the security elements that can cause changes in network situation in a large-scale network environment. With the rapid development of computer technology, the business processed on the computer has also developed from the mathematical operation and file processing based on a single computer, the internal business processing and office automation based on the simple connection of the internal network to the complex internal network and enterprise extranet based on the , the enterprise-level computer processing system of the global Internet and the worldwide information sharing and business processing. While the p...

AI Technical Summary

Problems solved by technology

Therefore, there is a resource that cannot be effectively allocated and is more vulnerable to DDoS attacks

Since the resource occupation of the public cloud egress by different users is unknown after connection, the experience of end users will be affected by each other

One of the users may use multi-threaded download tools and DDoS tools to make the network suffer from DDoS attacks, causing the party to actually occupy more bandwidth resources, and the infringement of bandwidth resources is mainly reflected in the user's target IP. Too many connections and the upstream traffic of the target IP is too large

[0004] At present, the commonly used method is to simply limit the flow of the connection, and to limit the bandwidth of the target IP based on automatic configuration.

However, it is ineffective to limit the bandwidth of all IPs in advance, because in the case of multiple connection clients such as DDoS and multi-threaded downloads, only the bandwidth limitation of the target IP cannot effectively limit its resources.

Images