Method and system for analyzing whether abnormal access exists in IP based on flow data

Abstract

The invention relates to the technical field of network security detection, and provides a method and a system for analyzing whether abnormal access exists in an IP (Internet Protocol) based on traffic data, and the method comprises the following steps: S1, capturing and analyzing HTTP (Hyper Text Transport Protocol) traffic, and obtaining all IP addresses; s2, determining a target IP address and a statistical time period according to a service requirement, and obtaining the target IP address from the HTTP flow; s3, identifying and eliminating outliers in the IP access frequency array through a Grubbs algorithm to obtain a reference access array; s4, counting the total number of times of current IP access according to the target IP address in each counting time period; and S5, constructing the total number of current IP accesses and the reference access array into a judgment array, performing Grubbs outlier judgment on the judgment array, and if the total number of current IP accesses is an outlier, considering that the current time period is an access abnormal time period. According to the method and the device, whether the abnormal access behavior exists in the IP or not can be accurately identified, so that false alarms are reduced.

Description

Technical Field

[0001] The present application relates to the field of network security detection technology, and specifically to a method and system for analyzing whether an IP has abnormal access based on traffic data. Background Art

[0002] Because IP access times lack a fixed pattern and there's no benchmark for daily visits, existing techniques simply calculate averages based on the total number of daily visits or peak-hour visits, making it difficult to draw accurate conclusions. Furthermore, since each IP's access time varies, it's necessary to observe the peak daily visits and calculate them. Even then, the resulting conclusions may not truly reflect the IP's daily access patterns, leading to significant errors. Summary of the Invention

[0003] To help solve the above technical problems, this application provides a method and system for analyzing whether an IP address has abnormal access based on traffic data, using the following technical solutions: A method for analyzing whether an IP has abnormal access behavior based on traffic data, wherein the method for analyzing whether an IP has abnormal access behavior based on traffic data includes: Step S1: Capture and parse HTTP traffic to obtain all IP addresses; Step S2: Determine the target IP address and statistical period based on business needs, and obtain the target IP address from HTTP traffic; Step S3: within a preset period, summarizing the total number of visits of each target IP address in each statistical period, forming an IP visit count array in each statistical period, and identifying and eliminating outliers in the IP visit count array using the Grubbs algorithm to obtain a benchmark visit count array; Step S4: In each statistical period, the total number of visits by the current IP address is counted according to the target IP address; Step S5: The total number of current IP accesses and the reference access array are combined into a judgment array, and a Grubbs outlier judgment is performed on the judgment array. If the total number of current IP accesses is an outlier, the current time period is considered to be an abnormal access time period, and the current IP address corresponding to the outlier is an abnormal access IP address.

[0004] Preferably, step S2 includes: placing the target IP address into a directory, traversing the captured HTTP traffic data, extracting the IP addresses and timestamps in the directory, and classifying the IP addresses in the directory into a time period array corresponding to the timestamp according to the timestamp.

[0005] Preferably, the step S4 includes: counting the total number of visits from the current IP address by: Traverse the captured HTTP traffic data, extract the current IP address based on the target IP address and statistical period, and count the total number of visits by the current IP.

[0006] A system for analyzing whether an IP has abnormal access behavior based on traffic data, using the method for analyzing whether an IP has abnormal access behavior based on traffic data as described in any one of the first aspects above, wherein the system for analyzing whether an IP has abnormal access behavior based on traffic data comprises: HTTP data traffic module, used to execute step S1; A parameter automatic parsing module, used to execute step S2; An IP time period number summary module is used to execute step S3; HTTP daily data traffic module and IP current period access total number module are used to execute step S4; The judgment module is used to execute step S5.

[0007] In summary, this application can more accurately identify whether an application IP has abnormal access behavior. By extracting HTTP requests of the same application from the traffic, the total number of visits of the IP is obtained by time period. By analyzing all access traffic of this IP, excluding specific outliers, forming a baseline array of total visits, and performing an outlier test on the total number of visits in the current time period and the current array to determine whether it is an outlier, it can more accurately identify whether the IP has abnormal access behavior, thereby reducing false positives. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 This is a flow chart of an embodiment of a method for analyzing whether an IP has abnormal access behavior based on traffic data of the present application. DETAILED DESCRIPTION

[0009] The present invention will be further described below with reference to the accompanying drawings. The structure and principle of the present invention will be very clear to those skilled in the art. It should be understood that the specific embodiments described herein are only intended to explain the present invention and are not intended to limit the present invention.

[0010] The IP access behavior of the application system should be traceable. The behavior within a period of time should be consistent with the daily access pattern. Once abnormal access occurs within a period of time, it will inevitably violate the objective law, causing the access behavior to deviate from the normal access range, and abnormal access behavior can be discovered.

[0011] When summarizing IP access data by time period, it is necessary to exclude traffic surges in specific scenarios, such as flash sales and rush purchases. These surges should not be included in daily access behavior statistics. For a period of time, such as a month, the daily IP access records are summarized and an algorithm is used to calculate the total number of visits in the time scale dimension. Abnormal outliers are discarded through the algorithm to form an IP access time period statistical array.

[0012] After the IP access time period statistical array is established, it is compared with the number of visits to the IP in a certain period. If the total number of visits in the current period is determined to be an outlier after matching and calculating the statistical array, then an access anomaly has occurred for this IP at that time scale and an alarm is issued.

[0013] Figure 1 This is a flow chart of an embodiment of a method for analyzing whether an IP address has abnormal access behavior based on traffic data according to the present application. The method includes: Step S1: Capture and parse HTTP traffic to obtain all IP addresses. In step S1, you can use network traffic monitoring tools (such as Wireshark, tcpdump, etc.) or application server logs to capture HTTP traffic. This is to ensure that the captured traffic data is complete and accurate for subsequent analysis. Parse the captured HTTP traffic to extract information such as the request header, request body, response header, and response body, and then extract the IP address of the request source from the parsed HTTP traffic. Clean the extracted IP addresses to remove invalid or duplicate IP addresses, and then store the cleaned and pre-processed IP address data in a database or file for subsequent analysis and processing.

[0014] Step S2: Determine the target IP address and statistical time period according to business needs, and obtain the target IP address from the HTTP traffic. In step S2, after obtaining the IP address of the request source, it is necessary to establish an array record of the IP corresponding time period for subsequent time period statistics and anomaly detection. According to business needs and security policies, determine the target IP address list and put these IP addresses into a directory so that relevant information can be extracted from the traffic data later. According to business needs, determine the statistical time period (for example, every hour, every day, etc.), initialize an array for each time period, and record the total number of visits for each IP address in the time period. Step S2 includes: putting the target IP address into the directory, traversing the captured HTTP traffic data, extracting the IP address and timestamp in the directory, and classifying the IP addresses in the directory into the time period array corresponding to the timestamp according to the timestamp.

[0015] Step S3: Within a preset period, the total number of visits for each target IP address within each statistical period is summarized. An IP visit count array is generated for each statistical period. Outliers in this IP visit count array are identified and eliminated using the Grubbs algorithm to obtain a baseline visit count array. In step S3, after establishing the IP-to-period array record, the next step is to generate an IP visit count array and use the algorithm to remove outliers to obtain a baseline visit count array. After collecting data for a period of time (e.g., one month), the total number of visits for each IP address within each time period is summarized. This summarized data is organized into an IP visit count array, where each element represents the total number of visits by a specific IP address within a specific time period. The IP visit count array is analyzed using a selected algorithm to identify and mark outliers. Based on the algorithm's results, the identified outliers are removed from the IP visit count array. The IP visit count array after removing the outliers serves as the baseline visit count array. This baseline array is subsequently compared with the visit counts for the current time period to detect abnormal access behavior.

[0016] Step S4: In each statistical period, an array of the current IP access times is constructed based on the target IP address. In step S4, after forming the benchmark access array, the number of accesses in the current period needs to be calculated. The access records of the current period are extracted from the real-time HTTP traffic data to ensure that the extracted data is complete and accurate, and contains the access information of all target IP addresses. The access records of the current period are traversed to count the total number of accesses for each IP address. Step S4 includes: counting the total number of current IP accesses in the following manner: traversing the captured HTTP traffic data, extracting the current IP address based on the target IP address and the statistical period, and counting the total number of current IP accesses.

[0017] Step S5: The total number of IP accesses in the current period is combined with the baseline access array to form a judgment array. A Grubbs outlier test is performed on the judgment array. If the total number of IP accesses in the current period is an outlier, the current time period is considered an abnormal access period, and the current IP address corresponding to the outlier is considered an abnormal access IP address. In step S5, for each IP address, the selected outlier test method is used to analyze the number of accesses in the current period to determine whether the number of accesses in the current period significantly deviates from the value in the baseline access array, thereby identifying potential abnormal access behavior. The results of the outlier test are recorded, including which IP addresses have abnormal access behavior in the current period. These results can be stored in a database or file for subsequent analysis and processing. If abnormal access behavior is detected in the current period, a corresponding alarm mechanism is triggered based on business needs and security policies. After comparing the number of accesses in the current period with the baseline access array and identifying abnormal access behavior, an alarm and processing are required. If the outlier test results indicate abnormal access behavior in the current period, the alarm mechanism is immediately triggered.

[0018] The present application also provides a system for analyzing whether an IP has abnormal access behavior based on traffic data using the above-mentioned method for analyzing whether an IP has abnormal access behavior based on traffic data, wherein the system for analyzing whether an IP has abnormal access behavior based on traffic data includes: HTTP data traffic module, used to execute step S1; A parameter automatic parsing module, used to execute step S2; An IP time period number summary module is used to execute step S3; HTTP daily data traffic module and IP current period access total number module are used to execute step S4; The judgment module is used to execute step S5.

Claims

1. A method for analyzing whether an IP has abnormal access behavior based on traffic data, characterized in that: The method for analyzing whether an IP has abnormal access behavior based on traffic data includes: Step S1: Capture and parse HTTP traffic to obtain all IP addresses; Step S2: Determine the target IP address and statistical period based on business needs, and obtain the target IP address from HTTP traffic; Step S3: within a preset period, summarizing the total number of visits of each target IP address in each statistical period, forming an IP visit count array in each statistical period, and identifying and eliminating outliers in the IP visit count array using the Grubbs algorithm to obtain a benchmark visit count array; Step S4: In each statistical period, the total number of visits by the current IP address is counted according to the target IP address; Step S5: The total number of current IP accesses and the reference access array are combined into a judgment array, and a Grubbs outlier judgment is performed on the judgment array. If the total number of current IP accesses is an outlier, the current time period is considered to be an abnormal access time period, and the current IP address corresponding to the outlier is an abnormal access IP address.

2. The method for analyzing whether an IP has abnormal access behavior based on traffic data according to claim 1 is characterized in that: The step S2 includes: putting the target IP address into a directory, traversing the captured HTTP traffic data, extracting the IP addresses and timestamps in the directory, and classifying the IP addresses in the directory into a time period array corresponding to the timestamp according to the timestamp.

3. The method for analyzing whether an IP has abnormal access behavior based on traffic data according to claim 1 is characterized in that: The step S4 includes: counting the total number of visits from the current IP address by: Traverse the captured HTTP traffic data, extract the current IP address based on the target IP address and statistical period, and count the total number of visits by the current IP.

4. A system for analyzing whether an IP has abnormal access behavior based on traffic data using the method for analyzing whether an IP has abnormal access behavior based on traffic data as described in any one of claims 1 to 3, characterized in that: The system for analyzing whether an IP has abnormal access behavior based on traffic data includes: HTTP data traffic module, used to execute step S1; A parameter automatic parsing module, used to execute step S2; An IP time period number summary module is used to execute step S3; HTTP daily data traffic module and IP current period access total number module are used to execute step S4; The judgment module is used to execute step S5.

Images