The Research Of Abnormal Flow Detection In IPv6 Based On IPFix

With the development of network, Internet enters into millions of households and improves the quality of people's life greatly. While enjoying the convenienice of network, people have to face kinds of security events. As a result of network's openness, it may cause various kinds of security events. And these security events finally did great damage to the society.Now, the IPv6 network have moved from the experimental stage to the practical stage, so the IPv6 environment security events attract more attentions of the academic community. Although IPv6 provides new ways for protecting the ipv6 network, there will always be unethical hackers who find new ways to break into our networks. So the entire computer security community will have to stay alert and keep finding mechanisms to keep pace with the hackers and find ways to protect networks.Faced with kinds of new challenges in the network security, traditional Internet security control mechanism can not meet the needs of the network security management, so we need to study new ways do network security management. Along with new network application's appearance, the network traffic increase sharply. The traditional network security devices get data packets directly from the network equipment. It usually generates a big burden to the network equipment, and it requires the security devices having the ability to handle the tremendous amounts of data packets. To lighten the burden of network security devices, we now analyse the flow rather than pure network packets. The IPFIX protocol provides network administrators with access to IP flow information. This dissertation do security research with the IPFix packets.This dissertation outlined the current IPv6 network security attacks at the beginning. Then, it discussed the security of the IPv6 network. Based on these discussions, we designed a IPv6 anomaly traffic analysis system which works with flow packets. The analysis system first gets pure network packets, and converts the pure network packets to IPFix flow packets. Then the IPFix flow packets are analyzed, if the flow packets are found abnormal, a security event is created.