Network traffic analysis method and device based on multi-source network traffic data

Abstract

The invention relates to a network flow analysis method and device based on multi-source network flow data. The method comprises the following steps: deploying a pre-training classifier pool at network flow data sources, for each data source, receiving multi-source network flow data at the current moment, carrying out flow classification on the multi-source network flow data through an online classifier, carrying out feature processing and transformation on the data collected by each network flow data source every preset time interval, and carrying out feature extraction on the data collected by each network flow data source; transmitting the processed flow data features and the feature transformation matrix to a flow drift detection module; and the flow drift detection module comprises historical concept data so as to detect concept drift according to the flow data features, the feature transformation matrix and the historical concept data, and if the concept drift is detected, a multi-source deployed online classifier is reset. By adopting the method, the multi-source network flow data can be continuously and accurately analyzed in real time.

Description

technical field [0001] The present application relates to the technical field of network traffic analysis, in particular to a network traffic analysis method and device based on multi-source network traffic data. Background technique [0002] In order to analyze and mine cyberspace traffic, fully understand business flow and information transmission in cyberspace, and identify target traffic in cyberspace based on the basic means of cyberspace data transmission. [0003] Actual network traffic data is often collected by network probes deployed on different types of terminal devices. Each network probe serves as a source of information collection, and the collected network traffic data is stored and utilized in the form of network data streams. . Facing the ever-changing complex situation of the network, the traditional processing methods of data collection, collection processing, labeling training, and publishing models need to spend a lot of time for data and model transmi...

AI Technical Summary

Problems solved by technology

Facing the ever-changing complex situation of the network, the traditional processing methods of data collection, collection processing, labeling training, and publishing models need to spend a lot of time for data and model transmission and deployment, which has a strong lag, and it is difficult to achieve real-time monitoring of network traffic. Analysis and processing

In addition, due to the dynamic changes in the network environment and network behavior, the concept drift phenomenon that causes changes in data characteristics and data label mapping functions affects the accuracy of traffic analysis.

Images