Network intrusion identification method based on anomaly flow and black-white list library of IP terminal

Abstract

The invention discloses a network intrusion identification method based on anomaly flow and a black-white list library of an IP terminal. The network intrusion identification method includes the steps that a flow preset threshold is set for early warning with a base line analysis method, anomaly flow features are extracted for early warning, the black-white list library is built, early warning is carried out when a server is accessed by a non-white-list IP, and in the monitoring process, a flow analysis library, an anomaly flow feature library and the black-white list library are continuously updated and perfected. When network intrusion to the electric system server is processed with the network intrusion identification method, an alarm can be given in time, a network operation and maintenance person can be reminded to carry out attention and processing in time, and big losses, caused by system crash and network complete paralysis which are caused by network intrusion, of a power grid can be avoided.

Description

technical field [0001] The invention relates to a network intrusion identification method based on IP terminal abnormal traffic and a black-and-white list database, and belongs to the technical field of power system information security. Background technique [0002] In the process of information globalization, electronic information technology is in a period of rapid development. While the scope of information technology continues to expand, the network connection between power data and systems is getting closer. The power system relies more and more on the power information network to ensure the efficient, reliable and safe operation of each system. Nowadays, the power system has been popularized in all aspects of production, operation and management of power enterprises, so the security of power system information is the guarantee for the safe operation of the power system and the reliable power supply to the society. [0003] There are several existing solutions: How to...

AI Technical Summary

Problems solved by technology

There are obvious defects in this method: first, for large-scale distributed attacks, the load of the central console will exceed the processing limit, resulting in an increase in the rate of false positives; second, the data collected by multiple detectors in the network The transmission on the Internet increases the network burden to a certain extent, resulting in a decrease in the performance of the network system; third, due to the delay of network transmission, the data packets processed by the central console cannot reflect the current network status in real time

3. The increasing complexity of the data mining technology operating system and the sharp increase in network traffic have led to an alarmingly rapid increase in audit data

Images