The invention relates to a traffic
anomaly detection and
network security reinforcement method for a
full data center, and the method comprises the steps: achieving the precise recognition and active blocking of an
attack chain through the real-time collection of full network traffic, the construction of a multi-dimensional
time sequence model based on historical
attack chain features, and the combination of a dynamic judgment threshold value and spatial and temporal distribution feature analysis. The method specifically comprises the steps of analyzing traffic in real time to generate an
attack chain feature sequence; performing clustering and
correlation analysis based on the multi-dimensional
time sequence model; dynamically adjusting the monitoring density to focus the high-
risk area; and generating a
threat blocking instruction and executing
network isolation. Aiming at the problems of high attack chain omission ratio,
resource contention conflict and insufficient dynamic defense capability caused by dependence on a static rule and a fixed threshold value in the traditional scheme, the method solves the problem of weak
perception capability of the traditional technology on a complex attack chain, remarkably reduces the omission rate and the error blocking rate, guarantees the service continuity through
dynamic resource scheduling, and improves the service performance of the
system. The method is suitable for real-time security protection of a large-scale
data center.