| With the rapid development of computer network, network managers need to not only protect intranet against outer intrusion, but also avoid network performance to be badly affected by local users. Owing to the lack of scientific and efficient local-traffic-based audit system, network managers can only use the software like SolarWinds to export and check the traffics line-by-line, to find the suspicious hosts, when the network performance is not normal. It makes network management really inconvenient. In order to solve the above problem, this thesis discusses the kinds of anomaly traffics and the related audit methods, then designs and finishes a distributed audit system of network security based on traffic flows.The thesis confirms the range of anomaly traffics and summarizes the audit methods. Based on these, it puts forward two detection methods: index statistic detection and character match detection. According to the theories and summaries of the anomaly traffics, and integrating the Central Limit Theorem and other statistics knowledge, the sampling and statistical algorithm is deduced. At last, this thesis presents the main frame of a distributed audit system of network security based on traffic flows. The frame guarantees the processing ability of servers and the expansibility of the audit system. All the models of the system are fulfilled also.The system includes traffic collection model, audit model, warning and search model. C language is used in core programs to ensure efficiency. The system adopts the architecture of distributed audit and central data storage. It enhances expansibility and avoids the operations of switch among some different anomaly traffic webs. Anomaly traffic webs contain some statistical charts. It is convenient that managers can get known the distribution of the anomaly traffics, and can accelerate the solving process.The system has been tested in educational MAN, xicheng district, Beijing. Network managers have recognized the audit results. |
