A network traffic analysis device applied to high-performance computing and an analysis method thereof

Abstract

The application discloses a network flow analysis device and analysis method applied to high-performance computing, relates to the technical field of high-performance computing network flow analysis, and comprises a monitoring module: the interaction time between each adjacent two flow files is calculated according to a two-dimensional data table arrangement order, wherein the sending time of the first flow file in the adjacent two flow files is regarded as the start time, the receiving time of the second flow file is regarded as the end time, the number of flow files is n, the number of interaction times is n-1, and the average value of the total interaction time is taken; meanwhile, the transmission byte number of each flow file is monitored, and the monitored average value of the interaction time and the transmission byte number of the flow file are sent to an analysis module. The application improves the accuracy of the detection result of the data packet, speeds up the analysis time, integrates the flow data, and avoids the occurrence of the missed detection.

Description

Technical Field

[0001] The present invention relates to a network traffic analysis device and an analysis method thereof applied to high-performance computing, belonging to the technical field of high-performance network traffic analysis. Background Art

[0002] The analysis of network traffic is one of the important areas of current network research. It can not only obtain the basic communication information of the target network and find out its communication rules, but also process and analyze the basic information obtained to carry out work and research in network management, network measurement and network security related fields. In today's developed network and complex and difficult network management, network traffic analysis has very important display significance. The definition of network traffic analysis is the process of discovering useful information from the network traffic data center by using statistical information or other complex methods. This process generally includes capturing, collecting and storing network traffic data, aggregating data for query and analysis, and analyzing data to mine useful information. With the continuous development of network traffic data mining technology, the process of data mining technology in abnormal network traffic monitoring is as follows: the system first collects the intrusion data set, captures the traffic, and then preprocesses it into a form suitable for data mining technology. Finally, the data is pattern extracted. If a normal pattern can be established, the system determines it as normal traffic. If it does not conform to the normal pattern, the system determines it as location traffic data and generates an alarm.

[0003] Currently, Trojans spread through interactive information embedded in data during network traffic interactions. Through years of development, remote-controlled stealing Trojans have evolved to include a controlled end (similar to a normal application client) and a control end (similar to a normal application server). These are a type of stealing malware that primarily seeks to steal sensitive user information by gaining control of the attacked host. Experiments have found that autonomous stealing Trojans periodically send data packets to the receiving end, which then does not respond to these data. In contrast, normal software is operated by ordinary users, and the autonomy of user operations leads to a high degree of randomness in the network data flow between the client and server. In addition, since normal software does not need to hide its own behavior during the communication process, it will perform a large amount of data exchange after establishing a connection in order to achieve rapid resource interaction. Therefore, when the client requests resources from the server, the server will send a large amount of resource information in response. The size of these response data packets is not fixed and their load is usually large. Therefore, most of the current network traffic analysis equipment and analysis methods for Trojan programs have a certain missed detection rate in the analysis and identification of Trojan programs due to the strong concealment of autonomous stealing Trojans, which makes the user's information security not protected during network interaction. At the same time, ordinary equipment systems take a long time in the analysis and detection process, which is inconvenient for large-scale network traffic monitoring.

[0004] Existing network traffic analysis equipment and analysis methods have insufficient detection accuracy of data analysis results, and there is a certain missed detection rate. In addition, the equipment takes a long time to run during the detection process. Therefore, the present invention proposes a network traffic analysis equipment and analysis method for high-performance computing. Summary of the Invention

[0005] The technical problem to be solved by the present invention is: to provide a network traffic analysis device and an analysis method thereof for high-performance computing, so as to solve the problems that the existing network traffic analysis equipment and analysis methods have insufficient detection accuracy of data analysis results, a certain missed detection rate, and the equipment takes a long time to run during the detection process.

[0006] The technical solution adopted by the present invention is: a network traffic analysis device for high-performance computing, including a data acquisition server and a traffic sorting module, a database, a monitoring module and an analysis module that establish communication connections with the server;

[0007] Data collection server: used to capture the network traffic within a preset time period on the server that provides network traffic, save it as a traffic file, and send it to the traffic sorting module;

[0008] Traffic sorting module: This module pre-processes several received traffic files, including standardization and formatting, to ensure data integrity and availability. Traffic files are also marked according to the time of receipt and the IP addresses of both parties. Traffic files with the same IP addresses of both parties within a preset time period are then categorized and organized into data packets.

[0009] Database: used to store the data packets processed by the traffic sorting module into the database for reading and use by the monitoring module. The database pre-establishes a two-dimensional data table to record the number of traffic files in the data packet and the number of bytes transmitted by each traffic file. All traffic files in the data packet are sorted according to the interactive sending time of each traffic file.

[0010] Monitoring module: Calculate the interaction time between each two adjacent traffic files according to the order of the two-dimensional data table, where the sending time of the first traffic file is regarded as the start time, and the receiving time of the second traffic file is regarded as the end time. That is, if the number of traffic files is n, then the number of interaction times is n-1, and the average value of the total interaction time is taken; at the same time, the number of bytes transmitted for each traffic file is monitored, and the monitored average interaction time and the number of bytes transmitted for the traffic files are sent to the analysis module;

[0011] Analysis module: used to analyze whether the traffic files within the data packet have Trojan communication characteristic threats, preset interaction time average value threshold and traffic file transfer byte number threshold. If the monitored interaction time average value is less than the preset interaction time average value threshold, and the number of traffic files in the data packet with all traffic file transfer bytes less than the preset traffic file transfer byte number threshold exceeds 60% of the total, it is determined that the traffic packet has certain Trojan communication characteristic threats.

[0012] Furthermore, the above-mentioned network traffic analysis device applied to high-performance computing also includes a processing module, which is used to send the danger level data of whether all traffic files in the data packets monitored during the time period analyzed by the analysis device contain Trojan communication feature threats to the interacting parties, and determine the Trojan sender in the interacting parties, and at the same time upload the IP address of the Trojan sender to the cloud sharing space for subsequent traffic file analysis.

[0013] Furthermore, the above-mentioned data collection server captures traffic files within a preset time period, which means all traffic files formed by all traffic interaction data within 1 hour from the time the first traffic file is sent by a data sending end. The traffic files are scanned at rated time intervals, and whether the interaction continues is determined based on whether the file size changes. If the interaction is stopped before 1 hour, the traffic file is sent to the traffic sorting module in advance.

[0014] Furthermore, the above-mentioned data acquisition server verifies several traffic files before sending them to obtain a verification value. After the traffic sorting module receives the traffic file, it verifies the traffic file again to obtain another verification value, and compares whether the two verification values ​​are consistent. If so, the data is considered complete and there is no error in the data transmission process. Otherwise, the data is considered incomplete, that is, there is an error in the data transmission process.

[0015] Furthermore, the above-mentioned network traffic analysis device applied to high-performance computing also includes a learning module, which is used to generate a judgment model for the data information of each data packet monitored by the monitoring module, and judge whether the traffic file in the data packet is Trojan data. The learning module adopts a logistic regression algorithm. The logistic algorithm predicts the probability of an upcoming result by the performance of historical traffic data to obtain a predicted value P(z). The predicted value P(z) can be compared with 0.5 to determine whether a Trojan threat exists:

[0016]

[0017] Where z is the historical traffic data. If the output P(z) is less than 0.5, it means there is a Trojan threat. If the output P(z) is greater than 0.5, it means there is no Trojan threat.

[0018] Furthermore, in the above monitoring module, the interaction time is used to represent the attribute of the data packet corresponding to the time, and the information entropy is used to represent the degree of concentration and dispersion of the attribute distribution in the data packet. Let J(X) represent the information entropy corresponding to the attribute X in a certain interaction time period. Its calculation formula is:

[0019]

[0020] Where N represents the number of values ​​in attribute X, A i It represents the probability that a certain value exists in the attribute X, and determines the time point when the abnormal traffic of the data packet occurs based on the information entropy J(X).

[0021] Furthermore, the access capability of the above Trojan sending IP in the network is measured by the service rate D e (t):

[0022] Where n s (t), n r (t) represents the number of traffic files sent and received by the IP to be detected at time point t, and the D e The lower (t) is, the greater the probability that abnormal traffic will attack it.

[0023] Furthermore, the above-mentioned analysis module internally presets a Trojan communication feature threat level. If the monitored average interaction time value is less than the preset interaction time average value threshold, and at the same time, the number of traffic files in the data packet whose traffic file transfer bytes are less than the preset traffic file transfer byte number threshold exceeds 60% of the total, then the Trojan communication feature threat of the traffic packet is judged to be high. If either the interaction time average value and the traffic file transfer bytes exceed the preset threshold (the preset threshold is the interaction time average value threshold and the traffic file transfer byte number threshold, the same below), and one of the two conditions is met, then the Trojan communication feature threat of the traffic packet is judged to be medium. If both the interaction time average value and the traffic file transfer bytes do not exceed the preset threshold, then the Trojan communication feature threat of the traffic packet is judged to be low.

[0024] An analysis method for a network traffic analysis device applied to high-performance computing comprises the following steps:

[0025] S1. Capture network traffic from the server providing network traffic within 1 hour through a data acquisition server, scan the traffic file at regular intervals, determine whether the interaction is ongoing based on the file size, verify the traffic after capture, obtain the verification value, and send the traffic file to the traffic sorting module;

[0026] S2. The traffic sorting module verifies the received traffic file and obtains another verification value. The two verification values ​​are compared to determine whether the data is complete. If not, the traffic is captured again. If so, the file is standardized and formatted. At the same time, the traffic file is marked according to the reception time and the IP addresses of the two parties to form a data packet;

[0027] S3. The data packets are stored in a two-dimensional data table within the database. The two-dimensional data table sorts the interaction transmission time of each flow file. The monitoring module calculates the interaction time between each two adjacent flow files to obtain the average of the total interaction time. The number of bytes transmitted for each flow file is also monitored and the data of both are sent to the analysis module.

[0028] S4. Analyze the traffic files within the data packet through the analysis module to see if there is a threat of Trojan communication characteristics. If the monitored average interaction time is less than the preset interaction time average threshold, and the number of traffic files in the data packet whose number of transferred bytes is less than the preset traffic file transfer byte threshold exceeds 60% of the total, the traffic packet is judged to have a high threat of Trojan communication characteristics. If both data do not exceed the preset threshold (the preset threshold is the interaction time average threshold and the traffic file transfer byte threshold, the same below), the threat coefficient is low. If either data exceeds the preset threshold, the threat coefficient is medium.

[0029] Beneficial effects of the present invention: Compared with the prior art, the effects of the present invention are as follows:

[0030] 1) By providing a complete set of network traffic collection, organization, and storage modules, the present invention can standardize the network traffic to be analyzed, converting the network traffic into easy-to-process traffic data files, ensuring the integrity and availability of the network traffic data files, and accelerating the subsequent network traffic file analysis process. At the same time, the traffic files of the same interacting IP addresses within a certain period of time are centrally organized to form exclusive data packets to be analyzed, facilitating subsequent analysis operations;

[0031] 2) The present invention establishes a two-dimensional data table in the database and sorts all the flow files in a data packet according to the interaction sending time. The sorted flow files can clearly and concisely see the first interaction information to the last interaction information. The high-performance monitoring module calculates the interaction time between each two adjacent flow files according to the arrangement order of the two-dimensional data table, and obtains the interaction time between all adjacent flow files. According to the length of the interaction time, the approximate number of bytes transmitted by the flow file can be determined. Since the flow file with a larger number of bytes occupies a larger load during the transmission process, the transmission speed is slower. On the contrary, the flow file with a smaller number of bytes occupies a larger load during the transmission process, and the transmission speed is slower. The traffic files have a small load during transmission, so the transmission speed is fast, and the command packets sent by the Trojan program control end have a small data load, so it can be judged whether the traffic data is mixed with the danger of Trojan programs. At the same time, the threshold comparison is performed based on the number of transmitted bytes of each traffic file. After counting the number of traffic files that do not exceed the threshold, if the proportion exceeds 60%, it means that the traffic files are basically small data packets. Based on the comprehensive statistics of the two, it can be determined to be a Trojan program. This monitoring method not only improves the accuracy of the detection results of the data packet, but also speeds up the analysis time, integrates the traffic data, and avoids missed detections. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A system block diagram of a network traffic analysis device for high-performance computing;

[0033] Figure 2 The present invention is a flowchart of an analysis method for a network traffic analysis device applied to high-performance computing. DETAILED DESCRIPTION

[0034] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0035] Example 1: Figure 1-2As shown, the present invention is a network traffic analysis device for high-performance computing, including a data acquisition server and a traffic sorting module, a database, a monitoring module, an analysis module, a processing module and a learning module that establish communication connections with the server;

[0036] Data collection server: used to capture the network traffic within a preset time period on the server that provides network traffic, save it as a traffic file, and send it to the traffic sorting module;

[0037] Among them, the data acquisition server captures the flow files within the preset time period, which refers to all flow files formed by all flow interaction data within 1 hour from the time when the first flow file of a certain data sending end is sent. The flow files are scanned at rated intervals, and whether the interaction continues is determined based on whether the file size changes. If the interaction stops before 1 hour, the flow files are sent to the flow sorting module in advance. The data acquisition server verifies several flow files before sending the flow files and obtains a verification value. After the flow sorting module receives the flow files, it verifies the flow files again and obtains another verification value. The two verification values ​​are compared to see if they are consistent. If so, the data is considered complete and there is no error in the data transmission process. Otherwise, the data is considered incomplete, that is, there is an error in the data transmission process. The verification judgment of the flow files ensures the accuracy of the sent flow files during the transmission process.

[0038] Traffic sorting module: This module pre-processes several received traffic files, including standardization and formatting, to ensure data integrity and availability. Traffic files are also marked according to the time of receipt and the IP addresses of both parties. Traffic files with the same IP addresses of both parties within a preset time period are then categorized and organized into data packets.

[0039] Database: used to store the data packets processed by the traffic sorting module into the database for reading and use by the monitoring module. The database pre-establishes a two-dimensional data table to record the number of traffic files in the data packet and the number of bytes transmitted by each traffic file. All traffic files in the data packet are sorted according to the interactive sending time of each traffic file.

[0040] Monitoring module: Calculate the interaction time between each two adjacent traffic files according to the order of the two-dimensional data table, where the sending time of the first traffic file is regarded as the start time, and the receiving time of the second traffic file is regarded as the end time. That is, if the number of traffic files is n, then the number of interaction times is n-1, and the average value of the total interaction time is taken; at the same time, the number of bytes transmitted for each traffic file is monitored, and the monitored average interaction time and the number of bytes transmitted for the traffic files are sent to the analysis module;

[0041] In the monitoring module, the interaction time is used to represent the attribute of the data packet corresponding to the time, and the information entropy is used to represent the degree of concentration and dispersion of the attribute distribution in the data packet. Let J(X) represent the information entropy corresponding to the attribute X in a certain interaction time period. Its calculation formula is:

[0042]

[0043] Where N represents the number of values ​​in attribute X, A i It represents the probability that a certain value exists in the attribute X, and the time point when the abnormal traffic of the data packet occurs is determined according to the information entropy J(X);

[0044] Analysis module: used to analyze the traffic files within the data packet for Trojan communication characteristic threats. A preset interaction time average threshold and a traffic file transfer byte count threshold are set. If the monitored interaction time average is less than the preset interaction time average threshold, and the number of traffic files in the data packet with a transfer byte count less than the preset traffic file transfer byte count threshold exceeds 60% of the total, the traffic packet is determined to have certain Trojan communication characteristic threats.

[0045] Among them, the Trojan communication feature threat level is preset in the analysis module. If the monitored average interaction time is less than the preset interaction time average threshold, and the number of traffic files in the data packet whose traffic file transfer bytes are less than the preset traffic file transfer byte threshold exceeds 60% of the total, then the Trojan communication feature threat of the traffic packet is determined to be high. If either the interaction time average and the traffic file transfer bytes exceed the preset threshold (the preset thresholds are the interaction time average threshold and the traffic file transfer byte threshold, the same below), then the Trojan communication feature threat of the traffic packet is determined to be medium. If both the interaction time average and the traffic file transfer bytes do not exceed the preset threshold, then the Trojan communication feature threat of the traffic packet is determined to be low. This monitoring method not only improves the detection result accuracy of the data packet, but also speeds up the analysis time, integrates the traffic data, and avoids missed detections.

[0046] Processing module: This module is used to send the danger level data of all traffic files within the data packets monitored during the time period, which is analyzed by the analysis device, to both parties, and to determine the Trojan sender in both parties. At the same time, it is used to upload the IP address of the Trojan sender to the cloud sharing space for subsequent traffic file analysis;

[0047] The access response capability of the Trojan sending IP in the network is measured by the service rate D e (t):

[0048]

[0049] Where n s (t), n r (t) represents the number of traffic files sent and received by the IP to be detected at time point t, and the D e The lower (t) is, the greater the probability that abnormal traffic will attack it.

[0050] Learning module: used to generate a judgment model for each data packet monitored by the monitoring module, and determine whether the traffic file in the data packet is Trojan data. The learning module uses a logistic regression algorithm. The logic algorithm predicts the probability of an upcoming result by analyzing the performance of historical traffic data, and obtains a predicted value P(z). The predicted value P(z) can be compared with 0.5 to determine whether a Trojan threat exists:

[0051]

[0052] Example 2: An analysis method for a network traffic analysis device applied to high-performance computing, comprising the following steps:

[0053] S1. Capture network traffic from the server providing network traffic within 1 hour through a data acquisition server, scan the traffic file at regular intervals, determine whether the interaction is ongoing based on the file size, verify the traffic after capture, obtain the verification value, and send the traffic file to the traffic sorting module;

[0054] S2. The traffic sorting module verifies the received traffic file and obtains another verification value. The two verification values ​​are compared to determine whether the data is complete. If not, the traffic is captured again. If so, the file is standardized and formatted. At the same time, the traffic file is marked according to the reception time and the IP addresses of the two parties to form a data packet;

[0055] S3. The data packets are stored in a two-dimensional data table within the database. The two-dimensional data table sorts the interaction transmission time of each flow file. The monitoring module calculates the interaction time between each two adjacent flow files to obtain the average of the total interaction time. The number of bytes transmitted for each flow file is also monitored and the data of both are sent to the analysis module.

[0056] S4. Analyze the traffic files within the data packet through the analysis module to see if there is a threat of Trojan communication characteristics. If the monitored average interaction time is less than the preset interaction time average threshold, and the number of traffic files in the data packet whose number of transferred bytes is less than the preset traffic file transfer byte threshold exceeds 60% of the total, the traffic packet is judged to have a high threat of Trojan communication characteristics. If both data do not exceed the preset threshold (the preset threshold is the interaction time average threshold and the traffic file transfer byte threshold, the same below), the threat coefficient is low. If either data exceeds the preset threshold, the threat coefficient is medium.

[0057] In this embodiment, in order to improve the accuracy of abnormal traffic feature extraction, the information entropy technology is applied to extract large-scale network traffic abnormal features. The information entropy of the abnormal feature sequence is used to determine whether there is abnormal data in the network traffic. The information entropy calculation formula of the network traffic feature sequence is:

[0058]

[0059] Where x i is the i-th network traffic feature sequence, m is the number of network traffic feature sequences, j(x i ) represents the probability of occurrence of abnormal network traffic feature sequence. If the network traffic is abnormal, it will affect the normal communication of the network. The formula for extracting abnormal network traffic features is as follows:

[0060]

[0061] Where u is the number of network traffic data, Q and z are the established network traffic signal monitoring model and monitoring signal matrix respectively, n h The number of points collected for network traffic data is used to calculate the correlation between abnormal traffic features. The specific formula is:

[0062]

[0063] Where x' i and y' i They are the average values ​​of the abnormal traffic features x and y respectively. If r is 0, it is judged that there is a correlation between the traffic features. It is considered that the network traffic has redundant characteristics and needs to be removed. The correlation between normal network traffic and abnormal traffic characteristics is monitored in real time, and abnormal traffic data features are selected. Representative abnormal traffic data needs to be selected from each group of network traffic data and then sent to the traffic sorting module for sorting.

[0064] According to the multi-dimensional characteristics of network traffic data, the network traffic information entropy value is calculated, and the correlation of entropy mutation is analyzed to describe the number of dimensions of each network traffic data. In order to achieve rapid detection of network anomaly data, it is necessary to obtain the information divergence of each traffic attribute at any time. The specific calculation formula is:

[0065] D(p||q)=E[logp(x)-logq(x)]

[0066] Where p represents the observed probability distribution of network traffic in the feature space, q represents the change in the probability distribution of network traffic attributes, and E is the network traffic attribute distribution vector.

[0067] According to the information divergence calculated by the above formula, the traffic anomaly data is classified into different characteristic attributes and the spatial area of ​​each characteristic attribute is defined. The specific formula is:

[0068]

[0069] Where O is the number of traffic data sample clusters, σ is the sub-cluster center in each feature attribute space, and δ is the sample feature vector;

[0070] The network traffic data anomaly rapid monitoring model expression in this embodiment is:

[0071]

[0072] Where I is the historical network traffic, and V is the traffic attribute sample set. Based on the above formula, the anomaly monitoring of large-scale network traffic data can be achieved.

[0073] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed by the present invention, which should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A network traffic analysis device for high-performance computing, characterized by: It includes a data acquisition server and a traffic sorting module, a database, a monitoring module and an analysis module that establish communication connections with the server; Data collection server: used to capture the network traffic within a preset time period on the server that provides network traffic, save it as a traffic file, and send it to the traffic sorting module; Traffic sorting module: pre-processes several received traffic files, including standardization and formatting, and marks traffic files according to the reception time and the IP addresses of the interacting parties. Traffic files with the same interacting IP addresses within a preset time period are centrally classified and sorted into data packets. Database: used to store the data packets processed by the traffic sorting module into the database for reading and use by the monitoring module. The database pre-establishes a two-dimensional data table to record the number of traffic files in the data packet and the number of bytes transmitted by each traffic file. All traffic files in the data packet are sorted according to the interactive sending time of each traffic file. Monitoring module: Calculate the interaction time between each two adjacent traffic files according to the order of the two-dimensional data table, where the sending time of the first traffic file is regarded as the start time, and the receiving time of the second traffic file is regarded as the end time. That is, if the number of traffic files is n, then the number of interaction times is n-1, and the average value of the total interaction time is taken; at the same time, the number of bytes transmitted for each traffic file is monitored, and the monitored average interaction time and the number of bytes transmitted for the traffic files are sent to the analysis module; Analysis module: used to analyze whether the traffic files within the data packet contain threats characterized by Trojan communication. A preset interaction time average threshold and a traffic file transfer byte count threshold are set. If the monitored interaction time average is less than the preset interaction time average threshold, and the number of traffic files in the data packet with a transfer byte count less than the preset traffic file transfer byte count threshold exceeds 60% of the total, the data packet is determined to contain a Trojan communication threat.

2. The network traffic analysis device for high performance computing according to claim 1, characterized in that: It also includes a processing module, which is used to send the danger level data of whether there are Trojan communication feature threats in all traffic files inside the data packets monitored during the time period analyzed by the analysis device to the interacting parties, and determine the Trojan sender in the interacting parties, and at the same time upload the IP address of the Trojan sender to the cloud sharing space.

3. The network traffic analysis device for high performance computing according to claim 2, characterized in that: The data acquisition server captures traffic files within a preset time period, which means all traffic files formed by all traffic interaction data within 1 hour from the time the first traffic file is sent by a data sending end. The traffic files are scanned at rated time intervals, and whether the interaction continues is determined based on whether the file size changes. If the interaction stops before 1 hour, the traffic file is sent to the traffic sorting module in advance.

4. The network traffic analysis device for high performance computing according to claim 1, characterized in that: The data acquisition server verifies several traffic files before sending them to obtain a verification value. After the traffic sorting module receives the traffic file, it verifies the traffic file again to obtain another verification value. The two verification values ​​are compared to see if they are consistent. If so, the data is considered complete and there is no error in the data transmission process. Otherwise, the data is considered incomplete, that is, there is an error in the data transmission process.

5. The network traffic analysis device for high performance computing according to claim 1 or 2, characterized in that: It also includes a learning module, which is used to generate a judgment model for the data information of each data packet monitored by the monitoring module, and judge whether the traffic file in the data packet is Trojan data. The learning module uses a logistic regression algorithm. The logistic regression algorithm predicts the probability of an upcoming result by the performance of historical traffic data, and obtains a predicted value P(z). The predicted value P(z) is compared with 0.5 to determine whether there is a Trojan threat: Where z is the historical traffic data. If the output P(z) is less than 0.5, it means there is a Trojan threat. If the output P(z) is greater than 0.5, it means there is no Trojan threat.

6. The network traffic analysis device for high performance computing according to claim 1 or 2, characterized in that: In the monitoring module, the interaction time is used to represent the attribute of the data packet corresponding to the time, and the information entropy is used to represent the degree of concentration and dispersion of the attribute distribution in the data packet. Let J(X) represent the information entropy corresponding to the attribute X in a certain interaction time period, and its calculation formula is: Where N represents the number of values ​​in attribute X, A i It represents the probability that a certain value exists in the attribute X, and the time point when the abnormal traffic of the data packet occurs is determined according to the information entropy J(X).

7. The network traffic analysis device for high performance computing according to claim 1 or 2, characterized in that: The access response capability of the Trojan sending IP in the network is measured by the service rate D e (t): Where n s (t), n r (t) represents the number of traffic files sent and received by the IP to be detected at time point t.

8. The network traffic analysis device for high performance computing according to claim 1 or 2, characterized in that: The analysis module internally presets a Trojan communication feature threat level. If the monitored average interaction time is less than a preset interaction time average threshold, and at the same time, the number of traffic files in the data packet whose traffic file transfer bytes are less than the preset traffic file transfer byte threshold exceeds 60% of the total, then the Trojan communication feature threat of the data packet is determined to be high. If either the average interaction time value or the traffic file transfer bytes exceeds the preset threshold, then the Trojan communication feature threat of the data packet is determined to be medium. If neither the average interaction time value nor the traffic file transfer bytes exceeds the preset threshold, then the Trojan communication feature threat of the data packet is determined to be low.

9. An analysis method for a network traffic analysis device used in high-performance computing, characterized by: The following steps are involved: S1. Capture network traffic from the server providing network traffic within 1 hour through a data acquisition server, scan the traffic file at regular intervals, determine whether the interaction is ongoing based on the file size, verify the traffic after capture, obtain the verification value, and send the traffic file to the traffic sorting module; S2. The traffic sorting module verifies the received traffic file and obtains another verification value. The two verification values ​​are compared to determine whether the data is complete. If not, the traffic is captured again. If so, the file is standardized and formatted. At the same time, the traffic file is marked according to the reception time and the IP addresses of the two parties to form a data packet; S3. The data packets are stored in a two-dimensional data table within the database. The two-dimensional data table sorts the interaction transmission time of each flow file. The monitoring module calculates the interaction time between each two adjacent flow files to obtain the average of the total interaction time. The number of bytes transmitted for each flow file is also monitored and the data of both are sent to the analysis module. S4. Analyze the traffic files within the data packet through the analysis module to see if there is a Trojan communication feature threat. If the monitored average interaction time is less than the preset interaction time average threshold, and the number of traffic files in the data packet whose transfer bytes are less than the preset traffic file transfer byte threshold exceeds 60% of the total, the Trojan communication feature threat of the data packet is determined to be high. If both data do not exceed the preset threshold, the threat coefficient is low. If either data exceeds the preset threshold, the threat coefficient is medium.

Images