Network abnormal detecting method for weighting statistic model based on time section

Abstract

This invention relates to a network abnormal test method based on weight statistic model of the time segment including observing the actions of a master unit by an abnormal observer to generate an attribute for describing these actions, each one stores the registration of a behavior of the master unit and timely merges the attributes of the current and the stored then to judge the abnormal behaviors by comparing them and the time segment weight.

Description

Technical field: [0001] The invention relates to the technical field of network abnormal traffic detection and intrusion detection, in particular to a network abnormality detection method based on a time-segment weighted statistical model. Background technique: [0002] Along with the normal application traffic on the network, various abnormal traffic on the network also follows, affecting the normal operation of the network and threatening the security and use of user hosts. Network abnormalities are often caused by network attacks, worms, and network abuse. For example, various network scans, DDoS attacks, network worms, malicious downloads, and improper use of network resources will cause network performance to decline. Affect normal network use, cause network congestion, and even cause network interruption and network equipment failure. Therefore, real-time monitoring and management of network traffic and discovery of known and unknown network anomalies in the network h...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide a network anomaly detection method based on a time period weighted statistical model to overcome the defects of the prior art that the algorithm operation is complex, does not have time characteristics, lacks flexibility and has a high false alarm rate

Images