Network port traffic abnormality detection method and system

Abstract

The invention discloses a network port traffic abnormality detection method and system. The method comprises the following steps: 1) reading communication session log traffics in a target data platform, summarizing the traffics according to source port numbers and target port number by group, and carrying out statistics on traffic indicator data of each port to generate a traffic sequence of the corresponding port; 2) generating an input vector of each port according to the corresponding traffic sequence, inputting the corresponding input vector into an LSTM network to obtain a predicted traffic value of the current port at a time t, comparing the predicted traffic value of the current port at the time t with an observed traffic value of the current port at the time t, and determining a traffic abnormality of the current port if the difference between the predicted traffic value and the observed traffic value is larger than a set condition; and 3) determining the nature of the trafficabnormality of the current port according to all recent traffic logs of the current port and preset rules, and determining a traffic abnormality event of the current port; and if the traffic abnormality event of the current port cannot be determined, inputting the extracted traffic logs into a pre-trained machine learning model for classification of traffic abnormalities of the current port, and identifying the traffic abnormality event of the current port.

Description

technical field [0001] The invention relates to the fields of big data, network security, deep learning, etc., and relates to a method and system for detecting network port traffic anomalies, which uses passive analysis methods of wide area network traffic to discover and profile network abnormal events such as DDoS, botnets, and virus propagation. Background technique [0002] Today's Internet faces many security threats. For example, Distributed Denial of Service (DDoS, Distributed Denial of Service) attacks have caused serious losses to the websites and devices of many organizations. DDoS refers to the use of client / server technology to combine multiple computers as an attack platform to launch DDoS attacks on one or more targets, thereby multiplying the power of denial of service attacks. [0003] DDoS attacks are often initiated by a botnet. A botnet is a controlled network of hosts infected with bots. The attacker sends instructions to the zombie host through the co...

AI Technical Summary

Problems solved by technology

For example, distributed denial of service (DDoS, DistributedDenial of Service) attacks have caused serious damage to the websites and equipment of many organizations

Images