A NETWORK ABNORMAL TRAFFIC ANALYSIS SYSTEM

摘要

PURPOSE: A system for analyzing abnormal network traffic is provided to maximize accuracy and reliability for determining the nature of abnormal traffic in a network. CONSTITUTION: A traffic collecting unit collects traffic data in a network. A traffic analyzing unit produces reference data from normal traffic which can reoccur in the next cycle. An abnormal sign detecting unit(30) detects an abnormal traffic suspicious section in the network. An abnormal traffic determining unit(40) compares the reference data with the collected traffic data. [Reference numerals] (10) Traffic collecting unit; (20) Traffic analyzing unit; (210) Traffic variation type extraction unit; (211) Data conversion unit; (212) Noise removal unit; (220) Reference data calculation unit; (30) Abnormal sign detecting unit; (310) Accumulated value calculation unit; (320) Comparing analysis unit; (40) Abnormal traffic determining unit; (410) Determination factor danger calculation unit; (411) Increase rate calculation unit; (412) Retaining time calculation unit; (413) Risk table calculation unit; (420) Individual risk calculation unit; (430) Total risk calculation unit; (431) Amount calculation unit; (432) Final calculation unit