A Classification Method of Abnormal Data Flow in the Whole Network

Abstract

The invention discloses an all-network abnormal data stream classification method. The method comprises: step one, abnormal data stream extraction is carried out on an all-network data stream and an abnormal data stream set in the abnormal data stream is outputted; step two, an average value S-P of an abnormal data stream size during per-package counting of the abnormal data stream is calculated, wherein the P is larger than or equal to 1 and is less than or equal to i, an average value B-P of a package size during per-byte counting of the abnormal data stream is calculated, wherein the P is larger than or equal to 1 and is less than or equal to I, at least one feature of the abnormal data stream is extracted, statistics of a distribution entropy H of the extracted feature is carried out, and feature vectorization of the abnormal data stream is carried out by using the S-P, the B-P, and the distribution entropy H of the extracted features as coordinate values to form a point set of a multi-dimensional space; step three, coarse clustering is carried out on the point set by using a Canopy method to obtain a cluster center and a number K value of central points; and step four, according to the cluster center, and the K value, fine clustering is carried out on the abnormal data stream after feature vectorization by using a K-means calculation method and thus a precise classification result of the abnormal data stream is obtained.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method for classifying abnormal data streams across the entire network. Background technique [0002] With the development of the network, abnormal network behaviors include network failures, user misoperations, network attacks, and network virus propagation. These abnormal behaviors often cause network traffic on single or multiple links in the network to deviate from the normal phenomenon. When any one of them causes abnormal network traffic, it has its fixed behavior pattern. For example, DOS / DDOS and other denial-of-service attacks are characterized by the convergence of traffic from a large number of controlled hosts to the target host, and all the controlled hosts have the same destination address; worms It is a common computer virus related to network security. It uses the network to replicate and spread. When spreading, it usually uses the host machine as t...

AI Technical Summary

Problems solved by technology

[0003] In the prior art, the sampling method based on IP flow is generally used to extract abnormal data flow, and then the abnormal data flow is classified using supervised pattern recognition, that is, a group of samples of known categories are used as a training set to establish a mathematical model, and then use The established model discriminates the unknown samples to determine the category to which the unknown samples belong. The training set of this model generally first defines the category characteristics that cause the abnormal data flow. However, due to the complexity and variability of network abnormalities, this The accuracy of this method is difficult to guarantee

Images