Real-time flux abnormity detection method on basis of host activity and communication pattern analysis

Abstract

The invention relates to a detection method of analyzing the real-time anomaly traffic based on the host activeness and the communication mode; the invention can determine the occurring time of the anomaly traffic, identify the event type of the anomaly traffic and process physical positioning towards the anomaly traffic event under the high-speed network environment. The invention includes the WAN provides various network services, a region network and a LAN connected with the WAN and a concentration detection device on which a sampling unit, an extracting and computing unit, a comparing unit and a knowledge base unit are arranged; the detection method establishes the communication modes of various types of anomaly traffic based on the prior knowledge; the communication mode of an activehost in the network is extracted to be compared with the communication modes of various types of anomaly traffic event so that the anomaly traffic event occurred on the active host can be identified; the supported anomaly traffic detection events include the Alfa traffic, various Flood events, the Flash-Crowd, the port scanning, the network scanning, the equipment failure and the worm scanning event.

Description

technical field [0001] The present invention relates to a real-time abnormal traffic detection method based on host activity and communication mode analysis, which is applied to the processing and transmission of digital data in network systems, and belongs to a core key technology applied to related network security products in the field of network traffic monitoring— - Abnormal traffic monitoring, type identification and physical location methods. Background technique [0002] Network traffic anomaly detection refers to collecting network traffic data (including network packets and data flows) in the monitored network, and discovering various abnormal traffic events hidden in normal network traffic through data statistics or mining technology, and generating abnormal traffic Alarm events are convenient for network administrators to respond in a timely manner. [0003] Traditional abnormal traffic detection methods often detect sudden changes in real traffic (including the...

AI Technical Summary

Problems solved by technology

However, the traditional abnormal traffic monitoring method has the following two disadvantages: 1) it is impossible to detect those abnormal traffic events that do not cause obvious mutations in the network traffic curve, such as network scanning events, because it is often overwhelmed by normal network traffic; 2 ) detected abnormal network traffic event information is not sufficient, for example, most of the traditional abnormal traffic detection tools cannot identify the specific type of abnormal traffic (is it a denial of service attack or a normal sudden access?), and the specific circumstances of the abnormal traffic event Location (Which IP host did the abnormal traffic event occur on?), therefore, cannot meet the real-time response needs of network administrators

Images