Patent ID: 11916939
Assignee: ACER CYBER SECURITY INCORPORATED
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 14:
15. An abnormal traffic detection method, comprising:
obtaining network traffic data of a target device;
sampling the network traffic data by a first sampling window to obtain first sampling data, wherein the first sampling window has a first time length;
sampling the network traffic data by a second sampling window to obtain second sampling data, wherein the second sampling window has a second time length, and the first time length is different from the second time length;
generating a first image according to the first sampling data, wherein the first image reflects a data transmission amount corresponding to a plurality of first sampling points;
generating a second image according to the second sampling data, wherein the second image reflects a data transmission amount corresponding to a plurality of second sampling points; and
generating evaluation information corresponding to an abnormal traffic according to the first image and the second images wherein the step of generating the first image according to the first sampling data comprises:
performing a normalization operation on the first sampling data to adjust a total number of a plurality of sampling values corresponding to the first sampling points, such that the adjusted total number of the sampling values meets a total number of a plurality of pixel positions along a first dimension in the first image, wherein each of the sampling values reflects a data transmission amount corresponding to one of the first sampling points; and
converting the sampling values to a plurality of pixel values corresponding to the pixel positions in the first image.