Method for monitoring abnormal flows of deep packet detection equipment based on information entropy measurement

Abstract

The present invention discloses a method for monitoring abnormal flows of deep packet detection equipment based on information entropy measurement. The method comprises the following steps: monitoring a link interface of the deep packet detection equipment by a sampling agent module; obtaining samples of original flow messages, and encapsulating the samples in an sFlow protocol format to form a sampling message; collecting and parsing the sampling message; calculating the information entropy of the original flow messages, and conducting standardization processing; obtaining the fluctuation and change conditions of flow feature distribution according to historical information entropy value curves of the original flow messages; judging whether the current flow is an abnormal flow; and managing and controlling the abnormal flow according to a management and control strategy. According to the present invention, the network measurement technology based on a flow sampling mode is applied to the deep packet detection equipment, and the measurement of flow feature distribution characteristics and the detection of abnormal flows are achieved by constructing a flow feature detection engine based on the flow sampling technology and information entropy measurement tool, so as to help to improve the inspection range and detection capability of the deep packet detection equipment for the abnormal flows.

Description

technical field [0001] The invention relates to the technical field of data communication, in particular to a method for monitoring abnormal traffic of deep packet detection equipment based on information entropy measurement. Background technique [0002] With the continuous development of the mobile Internet, smart terminals, and the Internet of Things, as well as the continuous advancement of network technology, modern networks tend to become more complex and diverse in terms of networking methods, network equipment types, network composition structures, and network applications. These complex and diverse network factors have led to a surge in network communication traffic and increased load on network equipment. At the same time, the amount of information and data transmitted in the network is huge and complex, including all kinds of normal transmission data and malicious attack data. These factors always threaten the security of network elements and the availability of ...

AI Technical Summary

Problems solved by technology

[0007] The technical problem to be solved by the present invention is that since the update speed of abnormal traffic in the network is very fast, once the protocol feature library does not contain the application layer characteristics of abnormal traffic, the detection of abnormal traffic cannot be completed

Images