CN1764126A - Method for detecting and monitoring gusty abnormal network flow - Google Patents

Abstract

The detection and monitor method for burst abnormal network flow comprises: simulating and realizing the worm attack on NS-2 network simulator platform and DDoS distributed denial service attack, gathering the network flow information by Net Flow protocol, determining the behavior character of abnormal source, and taking control measures to interrupt attack. This invention originates to integrates character comparison and flow self-learning, overcomes the problem that SNMP protocol is lack for analysis and hard to determine flow abnormal threshold, and improves efficiency and practicality of monitor flow greatly. The experiment shows: this method is very well in real-time, and lays the foundation of inverse track well.

Description

The detection of gusty abnormal network flow and method for supervising

Technical field

What the present invention relates to is a kind of method of networking technology area, specifically is a kind of detection and method for supervising of gusty abnormal network flow.

Background technology

Based on network attack has become the serious obstruction of current network information system, particularly worm-type virus is attacked and distributed denial of service attack, utilize the leak of network service, system service or utilize the finiteness of Internet resources, system resource, having is exactly the imperfection that utilizes procotol and authentication mechanism self again, attack by starting large scale network at short notice, consume specific resources, realize the target of attack of Denial of Service attack.Existing network security mechanism as intruding detection system (IDS), fire compartment wall and VPN (virtual private network) (VPN) and tolerate that attack technology all also do not consider the detection and the tracking problem in network attack source, though detect attack also lack network range from dynamic response.At these traffic attacks, countermeasure mostly is the protection algorithm setting such as Random Drop, SYN Cookie, the bandwidth constraints greatly, realize IDS and ways such as firewall linkage and technical specialist's analytical attack, but produce little effect mostly, can only alleviate ddos attack and can not really solve ddos attack.Wherein the problem of most critical just is to distinguish how efficiently normal discharge and unusual attack traffic.Current relatively effective method is " black hole " technology of China domestic NSFOCUS company and in the world by the AM IPS technology of TopLayer company exploitation.As seen, the exception of network traffic monitoring technology is the primary technological means that solves the abnormal flow problem.The acquisition mode of current network abnormal flow is divided into three kinds: the monitoring technology of the full mirror image of flow Network Based, based on the monitoring technology of SNMP with based on three kinds of common technologies of monitoring technology of NetFlow.Also have based on bag analysis (BPF) model of intercepting network packet in addition.Usually the network manager of local area network (LAN) likes using MRTG, but its function is more single, and analytic function is not strong, and its flow information of collecting is the statistical information of port, can not be used for complicated analysis.So no matter NetFlow can both satisfy the needs that exception of network traffic is analyzed on resource consumption still is network collection information the level of detail.

Find through literature search prior art, Chinese patent application numbers 200310101710.5, patent name " a kind of device and method of realizing abnormal flow control ", adopt the real-time sampling analysis mode in this patent, short bag in certain period is analyzed rather than lasting dynamic the analysis, though reduced the work of treatment amount, it is complete inadequately that the effect of analytic statistics just seems, and cannot effectively solve for the unexpected abnormality stream detection in crack in short-term.

Summary of the invention

The object of the invention is at the deficiencies in the prior art, a kind of detection and method for supervising of gusty abnormal network flow are provided, make it pass through model analysis to flow, improve the efficient that paroxysmal abnormality detects, for intrusion detection provides reliable foundation to the real-time backward tracing and the protection of attack source.

The present invention is achieved by the following technical solutions, the present invention is by the worm attack under the NS-2 network simulation applicator platform and the The Realization of Simulation of DDoS distributed denial of service attack, adopt network traffics to analyze agreement NetFlow network traffic information is carried out collection analysis, judge the behavioural characteristic of anomaly source, take corresponding control measures to interrupt this type of attack at last.

Below the present invention is further illustrated, comprise the steps:

(1) flow mapping is gathered, and gathers flow information under the whole network environment by NetFlow under the NS-2 analogue simulation environment;

(2) statistics, sortingand merging are classified to flow according to the website that the user visited, and sorted flow are added up, and deposit pairing RRD circular database then in, set up network zones of different, the discharge record information of different periods;

(3) simulation worm attack and ddos attack are attacked the abnormal flow feature that causes by the monitoring method collection analysis based on statistics, as searching in information bank less than just adding this characteristic information, handle unusual simultaneously;

(4) by statistical analysis, carry out volume forecasting to network traffics;

(5) according to the flow information of preserving in the RRD database, the rendered visualization chart;

(6) reverse information trace is carried out in the source of attack traffic, and relevant flow information is carried out association analysis, to judge the position of attack source.

The present invention is directed to traditional flow collection method, adopt, finely solved the burst flow blockage problem that DDoS and worm attack cause, further improved the stability of network service in conjunction with NetFlow and abnormality detection discrimination technology based on MRTG.Make respective handling for the abnormal flow that determines by the IDS interlock, realize the Intelligent Flow control and management.When anomaly analysis, it is fixed not need the user to get in advance, by the means that feature detection and abnormality detection combine, dynamically unknown ddos attack feature is added in the information bank, therefore the intelligent level of present technique is further improved.

The present invention has characteristics such as low consumption of resources and information gathering is detailed, adopt popular self-similarity network forecast model, can alleviate the intensity of information gathering preferably, extract the burst feature reliablely, can accelerate the data processing speed of the network equipment greatly.Especially in the complicated network structure, device resource is various, under the huge environment of network information flow, the present invention can fine solution based on the overload problem of SNMP flow collection method, thereby the tolerance of network is improved greatly.Go back in addition cost low, dispose easily, excellent in efficiency, to characteristics such as web influence are little.

Description of drawings

Fig. 1 is a flow chart of the present invention

Fig. 2 hides Markov model for 2-state of the present invention

Embodiment

Below in conjunction with accompanying drawing realization of the present invention is further specified.System based on the inventive method is made up of acquisition module, alanysis module, detection processing module, volume forecasting module, graphics module and six of backward tracing modules, and specifically practicing of each module is as follows:

(1) acquisition module---flow mapping is gathered, and gathers flow information under the whole network environment by NetFlow under the NS-2 analogue simulation environment;

(2) alanysis module---statistics, sortingand merging, difference according to user institute access site is classified to flow, and sorted flow added up, deposit pairing RRD circular database then in, set up network zones of different, the discharge record information of different periods;

(3) detect processing module---simulation worm attack and ddos attack, attack the abnormal flow feature that causes by monitoring method collection analysis based on statistics, as in information bank, searching, use modes such as cutting off connection, filtration, flow restriction to handle unusually simultaneously less than just adding this characteristic information;

(4) volume forecasting module---by statistical analysis, carry out volume forecasting, reduce resource consumption, improve the real-time that network traffics are handled simultaneously network traffics.

(5) graphics module---according to the flow information of preserving in the RRD database, the rendered visualization chart;

(6) backward tracing module---reverse information trace is carried out in the source to attack traffic, and relevant flow information is carried out association analysis, to judge the position of attack source.The foundation that provides law to solve.

The statistical information that NetFlow collects from network traffics comprises statistics based on each user, based on the statistics of the statistics of every kind of agreement, per-port basis with based on the statistics of every kind of equipment, can provide than the more detailed traffic flow information of the snmp protocol that is operated in link layer, when flow takes place to change suddenly, which agreement the energy express analysis goes out, serve port goes wrong, and further determines to cause the main frame of network traffics sudden change.Protocal analysis adopts high-performance RRD circular database, and being fit to very much also provides powerful data compression, drawing function simultaneously based on the seasonal effect in time series storage, can greatly improve efficiency for data access.

In this case study on implementation, the unexpected abnormality flow of the NS-2 environment being simulated the initiation of ddos attack and worm attack down adopts the hiding Markov model (2 state Hidden Markov Model) of 2-state to carry out the off-note statistics.The threshold detection method that this is conventional, rate of false alarm is lower, and real-time is stronger.Be implemented as follows:

Hypothesis network flow velocity satisfies Gaussian Profile N (μ h, σ h) in this model, and μ h is that average σ h is a variance.Markovian transition matrix T is followed in conversion between the state, as shown in Figure 2

$T=\left[\begin{array}{cc}1-p& p\\ q& 1-q\end{array}\right]$

According to these six parameter (μ ₁, σ ₁, μ ₂, σ ₂, p, q) flow that NetFlow is collected carries out statistic of classification, and choosing according to maximum similarity criterion (maximum likelihood criteria) of parameter promptly guarantees to satisfy the data flow probability of occurrence maximum of these parameters.Studies show that this-model is inadequate for the feature of describing whole network flow, but enough for the division that is used for flowing.

Stream based on HMM is divided, and is proved to be effectively for unusual attacks such as detecting DDOS.Used detection window control synchronization to handle the size of stream, window size generally uses 12,18 or 24, and real-time efficient height can satisfy the requirement of on-line monitoring like this.The unknown characteristics that extracts deposits the behavioral characteristics storehouse in by abnormality detection, and which kind of attack pattern occurs just directly determining from feature database when this class is attacked when next time is again.

The inventive method combines feature and compares and the flow self study when unusual judgement, still count initiative in network performance monitoring field based on stream, can solve snmp protocol analytic function deficiency, the Traffic Anomaly threshold value is difficult to problems such as judgement, thereby the efficient of traffic monitoring and practicality are improved greatly.The present invention is used to the appointment watch-dog in the NS-2 analog simulation environment is carried out the flow collection management, experiment shows, this method real-time, through the stream information after the RRD stores processor is fully detailed when characterizing network state, has established good basis for further carrying out backward tracing.

Claims (5)

1, a kind of detection of gusty abnormal network flow and method for supervising, it is characterized in that, The Realization of Simulation by worm attack under the NS-2 network simulation applicator platform and DDoS distributed denial of service attack, adopt network traffics to analyze agreement NetFlow network traffic information is carried out collection analysis, judge the behavioural characteristic of anomaly source, take corresponding control measures to interrupt this type of attack at last.

2, the detection of gusty abnormal network flow according to claim 1 and method for supervising is characterized in that, comprise the steps:

(1) flow mapping is gathered, and gathers flow information under the whole network environment by NetFlow under the NS-2 analogue simulation environment;

(2) statistics, sortingand merging are classified to flow according to the website that the user visited, and sorted flow are added up, and deposit pairing RRD circular database then in, set up network zones of different, the discharge record information of different periods;

(3) simulation worm attack and ddos attack are attacked the abnormal flow feature that causes by the monitoring method collection analysis based on statistics, as searching in information bank less than just adding this characteristic information, handle unusual simultaneously;

(4) by statistical analysis, carry out volume forecasting to network traffics;

(5) according to the flow information of preserving in the RRD database, the rendered visualization chart;

(6) reverse information trace is carried out in the source of attack traffic, and relevant flow information is carried out association analysis, to judge the position of attack source.

3, the detection of gusty abnormal network flow according to claim 2 and method for supervising, it is characterized in that, the statistical information that NetFlow collects from network traffics comprises statistics based on each user, based on the statistics of the statistics of every kind of agreement, per-port basis with based on the statistics of every kind of equipment, provide than the more detailed traffic flow information of the snmp protocol that is operated in link layer, when flow takes place to change suddenly, which agreement the energy express analysis goes out, serve port goes wrong, and further determines to cause the main frame of network traffics sudden change.

4, the detection of gusty abnormal network flow according to claim 2 and method for supervising is characterized in that, handle unusual mode for cutting off connection, filtration or flow restriction.

5, the detection of gusty abnormal network flow according to claim 2 and method for supervising, it is characterized in that, the unexpected abnormality flow of the NS-2 environment being simulated the initiation of ddos attack and worm attack down adopts the hiding Markov model of 2-state to carry out the off-note statistics, is implemented as follows:

Suppose that the network flow velocity satisfies Gaussian Profile N (μ h, σ h), μ h is that average σ h is a variance, and markovian transition matrix T is followed in the conversion between the state,

$T=\left[\begin{array}{cc}1-p& p\\ q& 1-q\end{array}\right]$

According to these six parameter μ ₁, σ ₁, μ ₂, σ ₂, p, q carries out statistic of classification to the flow that NetFlow collects, and choosing according to maximum similarity criterion of parameter promptly guarantees to satisfy the data flow probability of occurrence maximum of these parameters.

Images