Network flow abnormity analysis method based on visualization clustering

Abstract

The invention discloses a network flow abnormality analysis method based on visualization clustering. The method comprises the steps: 1) pre-treating monitoring data record of network flow; 2) performing RadViz visualization clustering to the flow data to obtain similar flow time-slot clustering of the network flow features; 3) concluding network flow features of the flow time-slot clustering obtained in the step 2) to obtain abnormal clustering of the network flow features; 4) filtering and choosing the flow time-slot clustering obtained in the step 2) to obtain time-slot points which are discrete in the clustering; and 5) analyzing the time-slot points and the discrete time-slot points in the abnormal flow clustering obtained in the steps 3) and 4) in combination of IPPort matrix. According to the network flow abnormality analysis method based on visualization clustering, the collaborative filtering of the network flow can be performed rapidly in multiple perspectives and the abnormity of the network flow can be analyzed efficiently.

Description

technical field [0001] The invention relates to a network traffic anomaly analysis method based on visual clustering. Background technique [0002] Traffic is the amount of data transmitted in the network. Data transmission is the basis of network activities. Network traffic is one of the most important symbols of network activities. Almost all network applications and network attacks can be traced in traffic changes. Now that the information society has entered the era of big data, the scale of the network is growing day by day, the degree of equipment integration is getting higher and higher, the data capacity is getting bigger and bigger, emerging network services are being gradually developed, and network traffic is growing explosively. Network status. [0003] Due to the massive and high-dimensionality of network traffic data, traditional data mining techniques and algorithms are difficult for users to understand and use, often consuming a lot of time, and fail to anal...

AI Technical Summary

Problems solved by technology

[0003] Due to the massive and high-dimensionality of network traffic data, traditional data mining techniques and algorithms are difficult for users to understand and use, often consuming a lot of time, and fail to analyze the relationship between data clearly to reflect the complete network status. The user interacts with the driver

Images