Mining method of normal Server IP white list based on K-Means

Abstract

The invention relates to the technical field of computer network traffic analysis, and aims to mine a normal Server IP white list by clustering network traffic through a K-Means clustering algorithm.The method comprises the following steps: firstly, acquiring required communication traffic, restoring bidirectional traffic between two IPs from the required communication traffic, and extracting aninitial white list; then analyzing and storing bidirectional traffic statistical traffic basic information; then performing feature extraction according to the statistical traffic basic information, and clustering features by using a K-Means algorithm to obtain a clustering result; and finally, obtaining the distribution of the initial white list in the clustering result so as to obtain a normal Server IP white list. According to the invention, the normal Server IP white list can be conveniently extracted from the network traffic, the workload of establishing the white list is reduced, and theupdate is convenient.

Description

technical field [0001] The present invention relates to the technical field of computer network traffic analysis, and aims to capture network traffic and recombine it into two-way streams, then take Server IP as the research object to extract the relevant features of the corresponding streams, and use the K-Means clustering algorithm to cluster the feature data , and then analyze the distribution of the pre-built whitelist in the clustering results, so as to dig out the normal Server IP whitelist. After obtaining the whitelist, it can filter out the traffic generated by many normal network behaviors and reduce the detection of intrusion detection systems. pressure. Background technique [0002] With the continuous development and popularization of computer technology and Internet of Things technology, the number of networked devices is increasing rapidly, and the traffic generated by networked devices is also increasing, which poses a huge challenge to intrusion detection sy...

AI Technical Summary

Problems solved by technology

In the above method, the rule writing is cumbersome, and the characteristics of the traffic cannot be fully considered, while the establishment of a complete white list takes a long time, requires more manpower, and is difficult to update

[0004] The mainstream filtering method can indeed reduce the amount of traffic to be detected, but due to its limitations, the filtering effect is not ideal, so this paper proposes a normal Server IP whitelist mining method based on K-Means

Images