The invention relates to the technical field of
network security, in particular to a distributed
network attack tracing method and
system, and the method comprises the following steps: carrying out the statistics of flow
transmission time delay, bandwidth
occupancy rate and data packet quantity among distributed network nodes, carrying out the clustering division of each node flow feature value, and generating a node flow feature clustering value; and on the basis of the node traffic feature clustering value, constructing an inter-node traffic transmission
relation graph, and calculating an inter-node
link weight and an association degree. According to the method, clustering division is carried out on the flow characteristic values among the distributed network nodes, the flow transmission
relation graph among the nodes is constructed, the
link weight and the correlation degree are calculated, a
complex network structure is converted into a topological correlation matrix capable of being quantitatively analyzed, and basic data support is provided for follow-up
attack traceability. Data packet identifiers and
timestamp information are extracted based on a
time series data analysis method, and abnormal traffic transmission characteristics are identified and statistically analyzed, so that the
attack behavior detection accuracy is improved.