基于Netflow的异常流量分离以及归类

针对以往的各种异常流量检测算法只能在宏观上进行流量异常监测,不能进一步实时地将异常流量分离处理,提出了在Netflow流数据环境下对单体IP历史数据的研究的方法,通过对单体IP统计、预测,能快速的检测出导致网络异常流量的主机,并根据其流的类型判断,分类以发现其发生异常的原因并提供ACL策略,从而将网络流量控制在稳定的空间和时间之内,实验结果表明了此方法的可行性和有效性.

Anomaly traffic extraction and classification based on Netflow

The previous network traffic anomaly analysis can detect the abnormal traffic in Macro. But they can not extract the abnormal and treat it A method is presented to detect the host who cause the abnormal traffic by statistic the single IP history data and prodict under netflow environment to judge the main reason and supply ACL strategy, and control the network traffic Stability in space and time. The experiment shows that this method is possible and efficiency.