The invention relates to the field of
network security, and discloses a problem line determination method based on
IP address classification and identification, which comprises the following steps of: collecting
public network IP behavior data in a network flow log, extracting multi-dimensional characteristics such as a time regularity entropy value, a protocol diversity proportion, target port
dispersity and a request
rate change rate, and determining a problem line according to the extracted multi-dimensional characteristics; constructing an IP association graph fusing feature similarity, time
synchronism and physical position constraints; an abnormal IP group is identified by adopting a
community division algorithm, and the detection sensitivity is adaptively optimized according to a real-time network load and a historical
false alarm rate in combination with a dynamic threshold adjustment
mechanism based on a PID
feedback control model; the
attack type is judged through protocol-port mapping and
Mahalanobis distance statistics, alarm information containing an abnormal IP
list, a time window and a
classification result is generated, and the alarm information is linked with
safety equipment to execute a defense strategy. According to the method, the defects of a traditional method in the aspects of multi-dimensional
attack recognition, dynamic environment
adaptation and cooperative
attack detection are overcome.