An Information Acquisition Method Based on NetFlow for Network Situation Awareness

Network situation information acquisition plays an important role in the entire process of network situation awareness. In this paper, we presented a multi-level, multi-perspective and multi-granularity traffic information acquisition method to get traffic information. In addition, we presented a multi-layer detection model that combines baseline based detection layer and signature based detection layer to acquire security incident information. Accordingly, we profiled portpsilas normal behavior for baseline based detection by statistical method and established an incident signature base for signature based detection.