Bayesian statistical model based network anomaly detection method

Abstract

The related network abnormal detection method based Bayes statistical model comprises: 1. grasping TCP / IP flow data package by bypass interception way; 2. decomposing attributes to form a data matrix; 3. mining data to build normal training matrix, known-abnormal training matrix, and unknown-abnormal training matrix; 4. continual grasping the TCP / IP package to detect them with Bayes evaluator; and 5. alarming the abnormal condition and filling into the known-abnormal training matrix by self-learning way; or else, back to step 4. This invention overcomes defects in prior art.

Description

Technical field: [0001] The invention relates to the technical field of network abnormal flow detection and intrusion detection, in particular to a method for detecting network abnormalities based on a Bayesian statistical model. Background technique: [0002] Along with the normal application traffic on the network, various abnormal traffic on the network also follows, affecting the normal operation of the network and threatening the security and use of user hosts. Network abnormalities are often caused by network attacks, worms, and network abuse. For example, various network scans, DDoS attacks, network worms, malicious downloads, and improper use of network resources will cause network performance to decline. Affect normal network use, cause network congestion, and even cause network interruption and network equipment failure. Therefore, real-time monitoring and management of network traffic and discovery of known and unknown network anomalies in the network have become...

AI Technical Summary

Problems solved by technology

[0004] The main purpose of the present invention is to provide a method for network anomaly detection based on Bayesian statistical model, to overcome the problems of difficult determination of parameter reference range, lack of flexibility and high false alarm rate existing in the prior art

Images