Network flow monitoring method and system

Abstract

The invention relates to a network traffic monitoring method and system, and the method comprises the steps: S1, monitoring a network device, and capturing a data packet from network data generated bya first service module; s2, storing the data packet; s3, analyzing the data packet, and generating a dynamic rule according to an analysis result; s4, importing a static rule, and monitoring and filtering the network data generated by the first service module according to the dynamic rule and the static rule; and S5, transmitting the monitored and filtered network data to a second service module,one of the first service module and the second service module being a network application service module, and the other being a network interface. According to the network flow monitoring method andsystem provided by the invention, the monitoring mode is flexible, the monitoring content is reliable, and the normal transmission of network data is not influenced.

Description

technical field [0001] The invention relates to the technical field of Internet data security, in particular to a method and system for monitoring network traffic. Background technique [0002] With the rapid development of network technology, Internet and communication technology, information network technology has become the basis of politics, military affairs, economy, medical treatment and even various fields of society. Information network occupies an increasingly important position in our life. While network resources are widely used, the problem of information security is becoming more and more serious. Security issues such as network attacks and data destruction also emerged, such as illegal network account sharing, illegal VOIP phone abuse, DDos attacks, worm flooding, etc., which caused a large number of security issues in network traffic, which not only brought economic losses, but also May endanger social security. In response to the above problems, network sup...

AI Technical Summary

Problems solved by technology

[0017] However, the existing flow monitoring methods and flow monitoring devices have the following disadvantages: the monitoring granularity can only be refined to the IP address port, and cannot monitor the flow of a certain process within a certain unit of time

Although some existing monitoring methods can associate the monitored port with the default port used by commonly used software to monitor the flow of processes, this method has certain limitations: if the commonly used software modifies the default running port, errors may occur The collection results of

Images