An Information Acquisition Method Based on NetFlow for Network Situation Awareness
Huiqiang Wang, Renjie Zhou, Yingjie He · 2008
Network situation information acquisition plays an important role in the entire process of network situation awareness. In this paper, we presented a multi-level, multi-perspective and multi-granularity traffic information acquisition method to get traffic information. In addition, we presented a multi-layer detection model that combines baseline based detection layer and signature based detection layer to acquire security incident information. Accordingly, we profiled portpsilas normal behavior for baseline based detection by statistical method and established an incident signature base for signature based detection.