Network abnormal traffic detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a network abnormal traffic detection method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring network traffic feature information from network traffic information; identifying the network traffic feature information according to a feature space division curve to obtain a network abnormal traffic monitoring result; wherein the feature space division curved surface is obtained by applying an unsupervised clustering algorithm to perform modeling on a network traffic reference sample set in a target subspace. A target subspace with the strongest clustering performance is selected for a flow reference sample set, then an unsupervised clustering algorithm is applied in the target subspace to carry out modeling on reference flow, a feature space division curved surface is determined, and therefore network abnormal flow detection is carried out. And manual annotation of flow characteristics is not needed. Meanwhile, according to the method, a subspace clustering technology is applied, and automatic discovery of network feature dimensions is achieved.

Description

technical field [0001] The invention relates to the technical field of information processing, in particular to a method, device, electronic equipment and storage medium for detecting abnormal network traffic. Background technique [0002] With the rapid development of machine learning technology and the continuous growth of computer system performance / computing power in recent years, machine learning methods are gradually applied to network abnormal traffic detection tasks and become mainstream technologies. [0003] The machine learning method of abnormal network traffic detection first uses statistical units such as application layer sessions, fixed time intervals, and network burst intervals to perform various characteristics of network traffic, such as the numerical statistics of network packet size and packet time interval. These statistical features constitute the network traffic feature space, in which each feature is a feature dimension in the space, and a statistic...

AI Technical Summary

Problems solved by technology

[0004] However, in the existing technology, the network traffic anomaly detection method based on machine learning technology still requires experienced technicians to manually set labels, which is time-consuming and costly. When it is necessary to deal with new network application protocols or predetermined network application protocol traffic characteristics After evolution, the abnormal traffic detection system may fail

Images