A load-independent method for detecting network abuse

Abstract

The invention discloses a load-independent method for detecting network abuse, which belongs to the technical field of computer network and data communication. The method of the present invention is as follows: first collect the normal traffic log and the traffic log with network abuse behavior to form the traffic log information training set; extract the feature vector of the network abuse behavior from the traffic log information training set to form the feature vector set; then use the machine learning algorithm The feature vector set is learned to obtain the abuse detection classifier; finally, the network abuse detection classifier is arranged to detect the traffic log online and detect the network abuse. Compared with the prior art, the present invention has the advantages of small calculation amount, less calculation resource occupation, no influence of data encryption and legal problems of privacy infringement, and can timely and accurately discover network abuse.

Description

technical field [0001] The invention relates to a method for detecting network abuse, in particular to a load-independent method for detecting network abuse, which belongs to the technical field of computer network and data communication. Background technique [0002] As P2P is widely used and widely used, it consumes a lot of network resources, and its harm to the network is increasing, so that the detection of network abuse is getting more and more attention. [0003] There are two main harms manifested by network abuse: first, it will occupy a large amount of traffic and consume a large amount of network bandwidth; second, it will establish a large number of TCP / UDP connections with high divergence, and many of them are only transmitted A short connection with several datagrams. Since gateways, firewalls and other devices are configured at the network border, these network border devices must maintain or monitor all connections between local network machines and external...

AI Technical Summary

Problems solved by technology

[0004] The traditional signature matching method to detect network abuse has a good detection rate and real-time performance. However, this method needs to analyze the payload (application layer content) of each data packet in the TCP stream, and extract the signature of each application protocol for further analysis. Matching, the amount of calculation is large, and it takes up more system resources when deploying and running

In addition, since many current application protocols adopt encryption measures in data transmission, it becomes more and more difficult to extract and verify protocol signatures.

Finally, the load information of the extracted data also involves legal issues of violating user privacy to a certain extent

Images