Abstract:

As networks become increasingly complex, the services carried by the network are becoming more and more important. Traditional device-level network management and monitoring are facing increasing challenges. It was difficult to locate problem boundaries and control the business losses caused by faults. More comprehensive monitoring and analytical means control are needed to improve efficiency and capabilities. The traditional network anomaly detection method through static planning and matching is difficult to detect unknown anomalies and attack types in dynamic and complex network environments, and cannot meet the requirements of network security detection. In addition, services in the network, relying on active detection methods, will bring new load pressure to the service server. Especially when the application layer traffic is generated by encryption or private protocols, the inability to decode further increases the difficulty of detection and analysis. Based on the railway ticketing system, this paper proposed a network traffic detection technology for railway ticketing system. It could calculate the information entropy corresponding to the characteristic that affects the traffic, and judge it based on the information entropy value set of historical traffic at multiple checkpoints. Whether it was legal or not, this method comprehensively considers the internal characteristics of traffic and the relationship between traffic, and achieved better business traffic detection results.

Key words: railway ticketing system, information entropy, principal component analysis, checkpoint