A network traffic anomaly detection system and method based on big data flow

Abstract

The invention discloses a large-data-flow-based network traffic abnormality detection system and method. The large-data-flow-based network traffic abnormality detection method is characterized by comprising the following steps: acquiring network packet information in network equipment in real time in a distributed manner; transmitting the network packet information to a distributed flow processing platform in real time for network data analysis, feature matching and access counting; storing the analyzed and detected network data into a large data platform according to an abnormal status so as to facilitate clustering analysis and classified training of the network data and dynamically update a network data protocol characteristic library. Through the system and the method, real-time detection is achieved through a distributed flow-type processing mechanism; through distributed storage of the large data platform and through the data calculating and analyzing capability, the distributed storage of the network data is achieved and the network data protocol characteristic library can be trained more accurately.

Description

technical field [0001] The present invention relates to network data transmission, distributed real-time data collection, distributed stream processing, and distributed data storage, and more specifically, relates to a network traffic anomaly detection system and method based on large data streams. Background technique [0002] With the rapid development of computer network technology, the means of network attack have also increased rapidly, and the security threats faced by network information systems have become increasingly prominent. extensive attention and attention. For the problem of network traffic anomaly detection, traditional solutions include methods based on rules, statistical analysis, and finite state machines. These methods can detect traffic anomalies to a certain extent, but there are some shortcomings in terms of processing data volume and real-time performance. Therefore, it is necessary to improve network traffic anomaly detection methods. This system ...

AI Technical Summary

Problems solved by technology

[0004] In order to solve the problems in the prior art, the present invention provides a network traffic anomaly detection system and method based on large data flow, which solves the problem of real-time and low efficiency of large data flow anomaly detection, and can dynamically update the network data protocol Feature Library

Images