Patent ID: 8483056

Claim:
A network abnormal traffic analysis method, comprising steps: acquiring IP network data; calculating a set of index values of a monitored server based on the acquired IP network data, wherein each index value of the set of index values reflects data streams related to the monitored server and each index value can be calculated according to the header of IP data packet; performing a primary detection on the calculated set of index values to generate a vector, said vector corresponding to the set of index values, wherein each vector element indicates the degree of abnormality of a corresponding index value; and performing a secondary detection on the vector to determine whether abnormal traffic related to the monitored server exists and the abnormal types; wherein the step of the primary detection comprises: consecutively acquiring N sets of index values, where N is a positive integer, indicative of a length of a time window; regrouping the N sets of index values by the indexes to acquire M groups of index groups, each group comprising N elements, where M is the number of the selected indexes; calculating a confidence ranger for each group in the M groups of index groups; acquiring a new set of index values; for each index in the new set of index values: if the value of the index falls within the confidence range of the corresponding index group in the M groups of index groups, the value of the corresponding vector element in the vector is set to 0, and the value of the index will replace the oldest index value in the corresponding group, and the confidence range of the corresponding group will be recalculated; if the value of the index falls outside of the confidence range of the corresponding group in the M groups of index groups, the value of the corresponding vector element in the vector is set to: x j , new rangeVal + x j , new where x i,new is the value of the index and rangeVal is the upper limit of the confidence range of the corresponding group in the M groups of index groups.