Local area network data processing analysis method and system based on NetFlow passive network measurement
Through NetFlow passive network measurement and information entropy subspace network traffic diagnosis algorithm, the problem of failure to effectively detect abnormal traffic in network security is solved, efficient network security management and traffic monitoring are achieved, and detection accuracy and efficiency are improved.
Patent Information
- Application Number
- CN202510670208.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-23
- Publication Date
- 2025-08-08
AI Technical Summary
The existing technology fails to effectively perceive the network security situation in network security, fails to effectively deal with large-scale data, and fails to effectively detect abnormal behaviors and unknown threats, resulting in inaccuracy and inefficiency of network attack detection.
The LAN data processing and analysis method based on NetFlow passive network measurement is adopted to extract LAN traffic data through reception, cleaning, conversion and feature, and use the information entropy subspace network traffic diagnosis algorithm to identify abnormal traffic data, and combine machine learning technology to perform feature extraction and abnormal traffic recognition.
It significantly improves the accuracy and efficiency of network anomaly detection, provides efficient network security management and traffic monitoring solutions, and reduces resource waste and interference to normal services.
Smart Images
Figure CN120455111A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network measurement and security technology, and in particular to a method and system for processing and analyzing local area network data based on NetFlow passive network measurement. Background Art
[0002] In the development of passive network measurement, along with the continuous evolution of Internet technology, cyberattack techniques have become more diverse and large-scale, bringing new challenges to network security. These challenges mainly manifest in the inability to effectively perceive network security situations, effectively process large amounts of data, and effectively detect abnormal behavior and unknown threats. Summary of the Invention
[0003] To address the deficiencies mentioned in the above background technology, the present invention aims to provide a LAN data processing and analysis method and system based on NetFlow passive network measurement, which has high accuracy and low false negative rate in abnormal traffic detection.
[0004] In a first aspect, the purpose of the present invention can be achieved by the following technical solution: a method for processing and analyzing local area network data based on NetFlow passive network measurement, the method comprising the following steps:
[0005] Receiving local area network traffic data, cleaning, converting, and extracting features from the local area network traffic data to obtain processed local area network traffic data, wherein the local area network traffic data is collected based on the NetFlow protocol;
[0006] The processed LAN traffic data is processed and analyzed based on the information entropy subspace network traffic diagnosis algorithm to identify abnormal traffic data in the processed LAN traffic data.
[0007] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: the router of the NetFlow outer layer connected to the Internet stores the passing activities in the form of session streams in a cache, and when the export requirements are met, transmits them to the corresponding collector via UDP, integrates multiple data through multiple collectors, and transmits the multiple data to the server for traffic analysis.
[0008] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: collecting the LAN traffic data based on the NetFlow protocol, including:
[0009] Through the NetFlow data exchange protocol, the router exports flow data and transmits it to the corresponding data collector. The data collector parses the flow data packets and saves the relevant flow records to obtain the LAN flow data;
[0010] NetFlow is deployed on multiple servers, including application servers, DNS servers, WEB servers, EMAIL servers, and FTP servers.
[0011] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the structure of the NetFlow includes a data acquisition layer, a preprocessing and feature extraction layer, and an anomaly detection and analysis layer,
[0012] The flow input of the data collection layer is a time series F = {f1, f2, ..., f T}, where: f t is the NetFlow flow record set collected in the tth time window; T is the total number of time windows; each flow record f t (i) Contains seven-tuple information: f t (i) =(source IP, destination IP, source port, destination port, protocol type, number of packets, number of bytes);
[0013] The preprocessing operation of the preprocessing and feature extraction layer can be expressed as a mapping function P: Where: x j is the feature vector of the jth flow record; d is the feature dimension; N is the number of valid flow records in the current time window;
[0014] The anomaly detection process of the anomaly detection and analysis layer can be modeled as a classification function D: Where ΔH(x j ) is the eigenvector x j The rate of change of entropy value; τ(x j ) is a dynamic threshold, which is calculated by the mean and standard deviation of historical entropy values in the sliding window.
[0015] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: the NetFlow data provides specific data of the end-to-end connection, and the NetFlow data is set to two different connection modes: valid and invalid;
[0016] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: the invalid connection is a connection that does not end with a FIN packet or the number of downstream data packets is less than or equal to a preset threshold, and the scanning item and the DoS attack process are also invalid connections in the flow data; the valid connection is a connection that ends normally with a FIN packet and the number of downstream data packets is greater than a preset threshold.
[0017] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: processing and analyzing the processed LAN traffic data based on the information entropy subspace network traffic diagnosis algorithm to identify abnormal traffic data in the processed LAN traffic data, including:
[0018] Calculate the information entropy value of traffic characteristics; divide the dynamic subspace based on the sliding window; set the dynamic threshold according to the subspace entropy value distribution; determine abnormal traffic and generate an alarm signal.
[0019] In a second aspect, in order to achieve the above-mentioned object, the present invention discloses a local area network data processing and analysis system based on NetFlow passive network measurement, comprising:
[0020] a data processing module, configured to receive LAN traffic data, clean, convert, and extract features from the LAN traffic data to obtain processed LAN traffic data, wherein the LAN traffic data is collected based on the NetFlow protocol;
[0021] The identification and analysis module is used to process and analyze the processed LAN traffic data based on the information entropy subspace network traffic diagnosis algorithm, and identify abnormal traffic data in the processed LAN traffic data.
[0022] In another aspect of the present invention, in order to achieve the above-mentioned purpose, a terminal device is disclosed, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. The memory stores the computer program capable of running on the processor, and when the processor loads and executes the computer program, it adopts the local area network data processing and analysis method based on NetFlow passive network measurement as described above.
[0023] In another aspect of the present invention, in order to achieve the above-mentioned purpose, a computer-readable storage medium is disclosed, in which a computer program is stored. The computer-readable storage medium is characterized in that when the computer program is loaded and executed by a processor, the local area network data processing and analysis method based on NetFlow passive network measurement as described above is adopted.
[0024] Beneficial effects of the present invention:
[0025] This paper uses NetFlow-based passive network measurement technology to efficiently preprocess and deeply analyze local area network data, providing an innovative solution for network security management and traffic monitoring. This method significantly improves the accuracy and efficiency of network anomaly detection by combining automated data collection with advanced machine learning techniques for feature extraction and abnormal traffic identification. BRIEF DESCRIPTION OF THE DRAWINGS
[0026] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, those skilled in the art can derive other drawings based on these drawings without inventive effort.
[0027] Figure 1 It is a schematic flow chart of the method of the present invention;
[0028] Figure 2 This is a schematic diagram of the NetFlow traffic collection method of the present invention;
[0029] Figure 3 This is a schematic diagram of the NetFlow traffic collection module of the present invention;
[0030] Figure 4 This is a flow chart of information entropy subspace network traffic diagnosis of the present invention;
[0031] Figure 5 Schematic diagram of the entropy change curve of source IP, destination IP, source port, and destination port in the present invention;
[0032] Figure 6 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION
[0033] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.
[0034] Example 1:
[0035] like Figure 1 As shown, a local area network data processing and analysis method based on NetFlow passive network measurement includes the following steps:
[0036] S101: receiving local area network traffic data, cleaning, converting, and extracting features from the local area network traffic data to obtain processed local area network traffic data, wherein the local area network traffic data is collected based on the NetFlow protocol;
[0037] The router connected to the Internet on the outer layer of NetFlow stores the activities passing through in the form of session streams in the cache, and transmits them to the corresponding collector via UDP when the export requirements are met. Multiple data are integrated through multiple collectors and then transmitted to the server for traffic analysis.
[0038] Administrators only need to start the NetFlow related protocols and export the output data to a professional collector to conduct effective traffic analysis. This method will not interfere with normal business, and there is no direct connection between the physical link, so there is no need to use probes for processing, effectively avoiding the problem of resource waste. This process is not only efficient, but also does not cause any interference to normal business. The working principle of NetFlow is through Figure 2 It provides administrators with an intuitive and efficient means of traffic analysis.
[0039] By executing NetFlow, routers connected to the Internet can store the activities that pass through in the form of session flows in the cache and transmit them to the corresponding collectors via UDP when the export requirements are met. Multiple collectors can integrate multiple data and transmit them to the server for subsequent traffic analysis. In this invention, a LAN flow collection system is created using the LAN environment. The overall environment of the flow collection module is shown in the attached figure. Figure 3 shown.
[0040] The LAN traffic data is collected based on the NetFlow protocol and includes:
[0041] Through the NetFlow data exchange protocol, the router exports flow data and transmits it to the corresponding data collector. The data collector parses the flow data packets and saves the relevant flow records to obtain the LAN flow data;
[0042] NetFlow is deployed on multiple servers, including application servers, DNS servers, WEB servers, EMAIL servers, and FTP servers.
[0043] Specifically, internet access routers are connected to a central switch. Using the NetFlow data exchange protocol, the routers export traffic data and transmit it to the corresponding data collectors, which parse the flow packets and save the relevant flow records. Considering the functional requirements of a LAN, multiple servers are typically deployed, such as application servers, DNS servers, web servers, email servers, and FTP servers. The central switch acts as a communication relay between the routers and these servers, helping to ensure the authenticity and validity of the data. Before collecting data information, the routers must be configured with appropriate protocol settings.
[0044] The structure of NetFlow is as follows:
[0045] Network structure composition and mathematical modeling:
[0046] The LAN data processing and analysis system is based on a layered architecture design. Its core network structure consists of three parts: data acquisition layer, preprocessing and feature extraction layer, and anomaly detection and analysis layer. The functions and interactions of each layer are as follows:
[0047] Data collection layer: It consists of routers and distributed collectors that support the NetFlow protocol and is responsible for capturing LAN traffic data in real time. Mathematical expression: Let the traffic input of the data collection layer be the time series F = {f1,f2,...,f T}, where: f t is the NetFlow flow record set collected in the tth time window; T is the total number of time windows. Each flow record f t (i) Contains seven-tuple information: f t (i) =(source IP, destination IP, source port, destination port, protocol type, number of packets, number of bytes).
[0048] Preprocessing and feature extraction layer: cleans and transforms the raw traffic and extracts multi-dimensional feature vectors. Mathematical expression: The preprocessing operation can be expressed as a mapping function P: Where: x j is the feature vector of the jth flow record; d is the feature dimension (such as five-tuple statistical features, session duration, packet rate, etc.); N is the number of valid flow records in the current time window.
[0049] Anomaly detection and analysis layer: Dynamically analyzes feature vectors based on the information entropy subspace algorithm to identify abnormal traffic. Mathematical expression: The anomaly detection process can be modeled as a classification function D: Where ΔH(x j ) is the eigenvector x j The rate of change of entropy value; τ(x j ) is a dynamic threshold, which is calculated by the mean and standard deviation of historical entropy values in the sliding window.
[0050] The goal of the data preprocessing module is to ensure that the collected data is accurate, complete, and in a format suitable for subsequent analysis. Such preprocessing can improve the efficiency and reliability of network traffic analysis. The present invention uses machine learning and other technologies to perform feature extraction on NetFlow data to extract a variety of representative indicators. This method is mainly responsible for the data-driven work of the system and can provide specific data information for the traffic. In the current method, the traffic classification unit needs to collect the characteristic values of the corresponding items, filter the existing data information, and then calculate other diagnostic information through the preliminary processing unit; the subsequent traffic analysis step needs to refer to the data information of the preprocessing unit and other aspects to complete the calculation and processing process.
[0051] NetFlow data provides specific data on end-to-end connections. In different security scenarios and problem situations, the detected data will produce different access activities. In order to further improve the comprehensive performance of this detection method, the present invention sets NetFlow data into two different connection modes: valid and invalid. The present invention sets invalid connections as those that do not end with a FIN packet or the number of downstream data packets is ≤3, and the scanning items and DoS attack processes are also invalid connections in the flow data, and the data collection and other processes correspond to valid forms. When the relevant device processes the first data packet, a corresponding NetFlow cache containing statistical data of the flow will be created.
[0052] The NetFlow data provides specific data of the end-to-end connection, and the NetFlow data is set to two different connection modes: valid and invalid.
[0053] The invalid connection is one that does not end with a FIN packet or the number of downstream data packets is less than or equal to a preset threshold, and the scanning item and DoS attack process are also invalid connections in the flow data; the valid connection is a connection that ends normally with a FIN packet and the number of downstream data packets is greater than a preset threshold.
[0054] When obtaining the first new IP data packet, NetFlow will compare the other seven-tuple content with the relevant data information in the buffer range. If the corresponding entry that matches the high-order data packet is not obtained, the corresponding data flow entry needs to be created. Otherwise, some of the data in the cache cannot match the corresponding control scheme and continue to be transmitted in the same data stream through the UDP message mode. To ensure the accuracy of the classification, this paper uses the information entropy subspace network traffic diagnosis algorithm for diagnosis. The information entropy subspace network traffic diagnosis algorithm is a simple and efficient prior detection method. The workflow of the information entropy subspace network traffic diagnosis algorithm is shown in the attached figure. Figure 4 shown.
[0055] S102: Processing and analyzing the processed LAN traffic data based on the information entropy subspace network traffic diagnosis algorithm to identify abnormal traffic data in the processed LAN traffic data.
[0056] Through automated data collection, combined with advanced machine learning technology for feature extraction and abnormal traffic identification, the accuracy and efficiency of network anomaly detection are significantly improved. The present invention analyzes the source IP, destination IP, source port, and destination port of abnormal data, and obtains the curve of entropy value changes in these four aspects as shown in the attached figure. Figure 5 The four pictures in the middle ( Figure 5 a / 5b source IP / destination IP diagram, Figure 5 c / 5d is the source port / destination port diagram). Figure 5It is clear that the entropy values of various attributes fluctuate dramatically within the range of 0-150, with large amplitudes. Therefore, it can be inferred that significant network anomalies occurred during this period. In the specific testing process, this paper selected four sets of experimental data for the corresponding test process, as shown in Table 1. This process utilized traffic collected by NetFlow and the KDD 99 dataset, and simultaneously conducted validation tests on various components of the NetFlow-based LAN passive detection system. Combined with the experimental analysis results, this experimental method demonstrates good operability and provides valuable insights for passive detection and analysis of network traffic.
[0057] Table 1 Experimental data corresponding test process
[0058]
[0059] The information entropy subspace-based network traffic diagnosis algorithm processes and analyzes the processed local area network traffic data to identify abnormal traffic data in the processed local area network traffic data, including:
[0060] Information entropy calculation: For pre-processed traffic data, extract traffic features (such as source IP, destination IP, source port, destination port) according to the time window and calculate the information entropy value of each feature. The information entropy formula is: Where: H(X) is the entropy value of feature X; P(x i ) is the value x in feature X i The probability of occurrence of ; n is the number of unique values of feature X.
[0061] Dynamic subspace partitioning divides the high-dimensional traffic feature space into multiple subspaces, for example: Subspace 1: source IP + destination port; Subspace 2: protocol type + packet size. Each subspace independently calculates the entropy change rate, the formula is: ΔH = |H t -H t-1 ∣, where H t is the entropy value of the current time window; H t-1 is the entropy value of the previous time window.
[0062] Dynamic threshold setting: Based on historical entropy data, a sliding window mechanism is used to dynamically adjust the anomaly threshold: threshold = μ + k·σ, where μ is the mean entropy value in the sliding window; σ is the standard deviation of the entropy value in the sliding window; and k is the adjustment coefficient (default k = 3).
[0063] Abnormal judgment: If the entropy change rate ΔH of a subspace exceeds the dynamic threshold, it is marked as abnormal traffic.
[0064] Specifically, the information entropy subspace network traffic diagnosis algorithm of the present invention dynamically calculates the information entropy value of traffic characteristics, combines subspace partitioning with adaptive threshold setting to achieve anomaly detection. The specific process includes: 1) extracting seven-tuple features (source IP, destination IP, source port, destination port, protocol type, number of packets, number of bytes) from NetFlow traffic, normalizing them to generate a multidimensional feature vector; 2) partitioning the dynamic subspace by time window (such as source IP + destination port), and calculating the entropy change rate of each subspace ΔH = |H t -H t-1 ∣; 3) Based on the mean μ and standard deviation σ of the entropy value in the sliding window, dynamically set the threshold τ = μ + 3σ; 4) If the rate of change of the subspace entropy value exceeds the threshold, it is determined to be abnormal. Example analysis: In a certain time window, the source IP entropy value suddenly increased from 3.8 to 5.2 (normal range 3.2 to 4.8), while the destination port entropy value decreased from 4.5 to 2.1 (scanning behavior characteristics). The dynamic threshold τ = 4.5, because Δ 源IP =1.4>τ, triggering an abnormal alarm. Combined with the multi-subspace judgment rules, it is confirmed that there is a DDoS attack. The system generates an alarm signal in real time and isolates the abnormal traffic.
[0065] like Figure 2-Figure 5 As shown,
[0066] Figure 2 Label "Internet access router (supports NetFlow v9 protocol) → Traffic cache (temporary storage of session flows) → UDP transmission channel (port number 9995, packet size ≤ 512 bytes) → Distributed collector (load balancing strategy: polling distribution) → Central server (MySQL cluster, storing original flow records)"; Figure 3 Label "Router NetFlow configuration (enable sampling rate 1:100, export interval 60 seconds) → Traffic collection pipeline (IPFIX protocol encapsulation) → Data parsing engine (parsed fields: source / destination IP, port, protocol, ToS tag) → Data storage layer (HDFS distributed storage, partitioning strategy by timestamp)"; Figure 4 Label "Input feature vector (dimension d = 12, normalized range [0, 1]) → Subspace partitioning (partitioning strategy: feature correlation ≥ 0.7) → Entropy calculation (formula: H(X) = -∑P(x)logP(x)) → Dynamic threshold update (window size W = 10, k = 3) → Anomaly marking (alarm level: high / medium / low)"; Figure 5 Mark "Source IP entropy curve (normal range: 3.2≤H≤4.8, abnormal point H>5.0), destination IP entropy curve (dynamic threshold τ=μ+3σ), source port entropy curve (entropy value drops sharply during DDoS attack period), destination port entropy curve (sudden increase in entropy value of scanning behavior characteristics)";
[0067] Example 2: The second aspect, as Figure 6 As shown, in order to achieve the above-mentioned purpose, the present invention discloses a local area network data processing and analysis system based on NetFlow passive network measurement, comprising:
[0068] The data processing module 11 is used to receive LAN traffic data, clean, convert and extract features from the LAN traffic data to obtain processed LAN traffic data, wherein the LAN traffic data is collected based on the NetFlow protocol;
[0069] The identification and analysis module 12 is used to process and analyze the processed LAN traffic data based on the information entropy subspace network traffic diagnosis algorithm, and identify abnormal traffic data in the processed LAN traffic data.
[0070] Based on the same inventive concept, the present invention also provides a computer device, which includes: one or more processors and a memory for storing one or more computer programs; the program includes program instructions, and the processor is used to execute the program instructions stored in the memory. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is used to implement one or more instructions, specifically for loading and executing one or more instructions in a computer storage medium to implement the above method.
[0071] It should be further explained that, based on the same inventive concept, the present invention also provides a computer storage medium having a computer program stored thereon, which executes the above method when executed by a processor. The storage medium can be any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electrical, magnetic, infrared, or semiconductor system, device or component, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or component.
[0072] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present disclosure. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
[0073] The above shows and describes the basic principles, main features and advantages of the present disclosure. Those skilled in the art should understand that the present disclosure is not limited to the above embodiments. The above embodiments and descriptions are merely illustrative of the principles of the present disclosure. Various changes and improvements may be made to the present disclosure without departing from the spirit and scope of the present disclosure, and such changes and improvements shall fall within the scope of the present disclosure.
Claims
1. A method for processing and analyzing local area network data based on NetFlow passive network measurement, characterized in that: The method comprises the following steps: Receiving local area network traffic data, cleaning, converting, and extracting features from the local area network traffic data to obtain processed local area network traffic data, wherein the local area network traffic data is collected based on the NetFlow protocol; The processed LAN traffic data is processed and analyzed based on the information entropy subspace network traffic diagnosis algorithm to identify abnormal traffic data in the processed LAN traffic data.
2. The method for processing and analyzing local area network data based on NetFlow passive network measurement according to claim 1, characterized in that: The router connected to the Internet on the outer layer of NetFlow stores the activities passing through in the form of session streams in the cache, and transmits them to the corresponding collector via UDP when the export requirements are met. Multiple data are integrated through multiple collectors and then transmitted to the server for traffic analysis.
3. The method for processing and analyzing local area network data based on NetFlow passive network measurement according to claim 1, characterized in that: The LAN traffic data is collected based on the NetFlow protocol and includes: Through the NetFlow data exchange protocol, the router exports flow data and transmits it to the corresponding data collector. The data collector parses the flow data packets and saves the relevant flow records to obtain the LAN flow data; NetFlow is deployed on multiple servers, including application servers, DNS servers, WEB servers, EMAIL servers, and FTP servers.
4. The method for processing and analyzing local area network data based on NetFlow passive network measurement according to claim 3, characterized in that: The structure of NetFlow includes data collection layer, preprocessing and feature extraction layer, and anomaly detection and analysis layer. The flow input of the data collection layer is a time series F = {f1, f2, ..., f T }, where: f t is the NetFlow flow record set collected in the tth time window; T is the total number of time windows; each flow record Contains seven-tuple information: The preprocessing operation of the preprocessing and feature extraction layer can be expressed as a mapping function P: Where: x j is the feature vector of the jth flow record; d is the feature dimension; N is the number of valid flow records in the current time window; The anomaly detection process of the anomaly detection and analysis layer can be modeled as a classification function D: Where ΔH(x j ) is the eigenvector x j The rate of change of entropy value; τ(x j ) is a dynamic threshold, which is calculated by the mean and standard deviation of historical entropy values in the sliding window.
5. The method for processing and analyzing local area network data based on NetFlow passive network measurement according to claim 4, characterized in that: The NetFlow data provides specific data of the end-to-end connection, and the NetFlow data is set to two different connection modes: valid and invalid.
6. The method for processing and analyzing local area network data based on NetFlow passive network measurement according to claim 5, characterized in that: The invalid connection is one that does not end with a FIN packet or the number of downstream data packets is less than or equal to a preset threshold, and the scanning item and DoS attack process are also invalid connections in the flow data; the valid connection is a connection that ends normally with a FIN packet and the number of downstream data packets is greater than a preset threshold.
7. The method for processing and analyzing local area network data based on NetFlow passive network measurement according to claim 1, characterized in that: The information entropy subspace-based network traffic diagnosis algorithm processes and analyzes processed local area network traffic data to identify abnormal traffic data within the processed local area network traffic data, including: calculating the information entropy value of traffic characteristics; dividing the dynamic subspace based on a sliding window; setting a dynamic threshold according to the subspace entropy value distribution; and determining abnormal traffic and generating an alarm signal.
8. A LAN data processing and analysis system based on NetFlow passive network measurement, which adopts the LAN data processing and analysis method based on NetFlow passive network measurement according to any one of claims 1 to 7, characterized in that: include: a data processing module, configured to receive LAN traffic data, clean, convert, and extract features from the LAN traffic data to obtain processed LAN traffic data, wherein the LAN traffic data is collected based on the NetFlow protocol; The identification and analysis module is used to process and analyze the processed LAN traffic data based on the information entropy subspace network traffic diagnosis algorithm, and identify abnormal traffic data in the processed LAN traffic data.
9. A terminal device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that: The memory stores a computer program that can be run on the processor. When the processor loads and executes the computer program, the local area network data processing and analysis method based on NetFlow passive network measurement according to any one of claims 1 to 7 is adopted.
10. A computer-readable storage medium storing a computer program, wherein: When the computer program is loaded and executed by the processor, the local area network data processing and analysis method based on NetFlow passive network measurement according to any one of claims 1 to 7 is adopted.