Method and system for anomaly monitoring of network port data flow based on big data

Abstract

The present invention discloses a method and a system for anomaly monitoring of network port data flow based on big dada, including: collecting incoming and outgoing data packet sequences through network ports, extracting traffic feature vectors from the data packet sequences, and analyzing the traffic feature vectors using an anomaly detection algorithm to obtain an anomaly score; if the anomaly score exceeds a preset threshold, triggering a coordination mechanism to perform identity verification on the source of the data packets, and determining the legitimacy of the source based on the identity verification result; acquiring associated access history records according to the legitimacy of the source, calculating an access restriction level through the access history records, and determining control rules corresponding to the access restriction level using a policy adjustment algorithm; after the control rules are determined, acquiring current data flow context information, extracting abnormal feature patterns from the context information, and determining whether the abnormal feature patterns match a pre-stored threat library; if the abnormal feature patterns match the pre-stored threat library, linking protective measures to generate an isolation instruction, and obtaining an isolated data flow subset through the isolation instruction.