The invention relates to the technical field of
network security, in particular to a network traffic
anomaly detection method and
system based on a
knowledge graph, and the method comprises the steps: extracting entities in a traffic
data set, relationships between the entities and entity attributes, and constructing a traffic information
knowledge graph based on the extracted entities, relationships between the entities and entity attributes; storing the flow information
knowledge graph into a
graph database; and obtaining a feature similarity
score between the to-be-detected unknown traffic and the traffic in the stored traffic information knowledge graph by adopting a
collaborative filtering algorithm, and determining the type of the to-be-detected unknown traffic according to the feature similarity
score. According to the method, the traffic information is stored in the
graph database Neo4j, so that the relationship of characteristic values among the traffic is clearer and clearer, the operation of security personnel is facilitated, and the
visualization effect is improved; through matching of intervals where flow characteristic values in the knowledge graph are located, the flow range participating in calculation of an
anomaly detection algorithm is narrowed, and the calculation efficiency is improved; and by fusing the weight coefficients and comprehensively considering the two similarity results, the accuracy of the detection result is improved.