The invention discloses a real-time network flow
anomaly detection method based on
big data, which comprises the following steps: S1, obtaining collected and analyzed historical flow data with attacktags stored in a
database to obtain
attack types; S2, performing data feature preprocessing on the historical traffic data in the S1, and constructing a
first class of feature vectors; S3, constructing a clustering model based on the
first class of feature vectors in the S2, and obtaining a target model meeting a preset condition by utilizing model evaluation and optimization; S4, storing the target model obtained in S3 and deploying the target model online; S5, capturing and collecting real-time
network data flow packet information transmitted in a
local area network; S6, performing data feature preprocessing on the real-time
network data traffic packet in S5, and constructing a second type of feature vectors; and S7, according to the target model in the S3 and the second type of featurevectors in the S6, performing real-time
online analysis and detection, and judging whether the current real-time
network data traffic is abnormal traffic or normal traffic.