Network flow multi-module clustering anomaly detection method based on grouping conditional entropy

Abstract

The invention discloses a grouping conditional entropy-based network flow multi-module clustering anomaly detection method, which comprises the following steps of: preprocessing original network flow data, segmenting the data into feature groups, performing preliminary clustering on the feature groups, solving the confidence coefficient of a clustering result, and solving conditional entropy; and then each group of conditional entropies are further clustered to determine whether the network packet has the characteristic of abnormal traffic. According to the network flow data processing method, the network flow data is abstracted to the maximum extent, a grouping multi-module clustering algorithm is designed to carry out network flow anomaly detection, and originally dispersed features with small influence factors are combined together and converted into groups which are converged and have greater influence on classification results. And the abstraction degree of the data can be more effectively improved, so that various types of abnormal traffic can show a closer convergence effect in a clustering result.

Description

technical field [0001] The invention belongs to the technical field of network traffic anomaly detection, in particular to a network traffic multi-module clustering anomaly detection method based on grouping condition entropy. Background technique [0002] Traffic identification technology has important applications in network monitoring and management, traffic accounting, and user behavior analysis. For example, intrusion prevention systems and firewalls use this technology to identify malicious traffic and block malicious connections in time; network service providers use it to analyze network traffic distribution to assist QoS (Quality of Service) management; enterprises use traffic identification technology to control application access; related Organizations infer user information and behavior by identifying user mobile device traffic. In view of the above requirements, it is extremely important to realize accurate and efficient traffic identification. In view of the ...

AI Technical Summary

Problems solved by technology

In view of the defects of the previous abnormal traffic detection method, this project will use the statistical characteristics of the traffic during the transmission process to detect. The normal network traffic generated based on different protocols will show different characteristics, but when the network When there is malicious traffic in the traffic, the network traffic will show a similar situation of large batches of data traffic on the time series scale

Images