System and method for monitoring abnormal network traffic of class imbalance

Abstract

The invention discloses a system and a method for monitoring abnormal network traffic of class imbalance, and belongs to the technical field of network space security. The system comprises a flow preprocessing module, a data enhancement module and a monitoring module. The method comprises the following steps: for known class imbalance network traffic data containing normal traffic and partial abnormal traffic, firstly ensuring data quality through a traffic preprocessing module, and extracting features related to anomaly detection; then the data enhancement module carries out undersampling and oversampling on the preprocessed traffic data, and balances the proportion of normal traffic and abnormal traffic in the data set; and finally, the monitoring module clusters the flow data after enhancement processing, evaluates a clustering result, calculates the distance between an unknown flow data sample and the centroid of the cluster to which the unknown flow data sample belongs, and judges whether the flow is abnormal or not. According to the method, the identification capability of the model on the abnormal traffic is enhanced, so that the model can more effectively distinguish the normal traffic from the abnormal traffic.

Description

Technical Field

[0001] The present invention belongs to the technical field of cyberspace security, relates to machine learning and anomaly detection, and specifically to a system and method for monitoring anomaly of class-unbalanced network traffic. Background Art

[0002] The rapid development of network technology and communication equipment has made the network environment almost cover people's lives. In order to cope with the endless network attacks, identify terminal anomalies, and ensure the normal operation of organizations and teams, internal network management in various specific fields is particularly important. With the rapid development of the Internet, the network environment has become more and more complex, and the methods of network attacks have become increasingly diverse. Traditional anomaly detection methods mainly rely on rules and signature libraries to detect anomalies by matching known attack patterns. However, these methods are often ineffective when facing new attacks and variant attacks.

[0003] Anomaly detection is the most widely used and effective active defense method for network security. As an important dynamic security technology, it can be well coupled with static defenses such as logs and firewalls, and is of great significance to the protection of system network space security. However, actual network traffic data often has a class imbalance problem, that is, normal traffic data accounts for the majority, and abnormal traffic data accounts for a minority. This class imbalance problem poses a challenge to traditional anomaly detection methods, which can easily lead to deviations in detection models and reduce the accuracy of anomaly detection. Therefore, it is particularly important to propose an anomaly detection method for class-unbalanced network traffic data.

[0004] To solve this problem, anomaly detection methods based on machine learning and deep learning have received widespread attention in recent years. These methods can more effectively identify unknown attacks and anomalies by learning the normal and abnormal behavior patterns of network traffic from historical data. However, in practical applications, network traffic data usually has class imbalance, that is, normal traffic data is far more than abnormal traffic data. This class imbalance problem will cause the detection model to overemphasize the learning of normal traffic and lack the ability to detect abnormal traffic, which in turn affects the accuracy and effectiveness of anomaly detection.

[0005] Therefore, it is particularly necessary and urgent to propose an effective anomaly detection method for class-unbalanced network traffic data. By improving data processing and model training methods, the performance of anomaly detection models in unbalanced data environments can be improved, ensuring the real-time and accuracy of network security monitoring systems.

[0006] The current technology closest to the present invention is traffic data anomaly detection based on unsupervised clustering. Clustering the network traffic data of a specific production environment enables the model to learn more about abnormal traffic from the perspective of data balance, thereby improving the accuracy of anomaly detection.

[0007] The DBSCAN clustering algorithm is a classic density-based clustering algorithm that can effectively identify the differences between different types of terminal traffic and classify and learn data sets. By extracting the behavioral characteristics of terminal traffic, DBSCAN builds a traffic classification model, extracts features and makes behavioral judgments on real-time terminal data traffic, thereby realizing real-time anomaly monitoring of the network environment. Different system monitoring modules can set density thresholds based on the network environment, traffic characteristics, and status as the basis for terminal behavior judgment, thereby completing anomaly monitoring. The DBSCAN algorithm is more adaptable to the density distribution of data, improving the accuracy and reliability of abnormal traffic detection.

[0008] There are three main problems that need to be solved in the existing traffic data anomaly detection based on unsupervised clustering, which are particularly prominent when dealing with class imbalanced data.

[0009] First, in view of the imbalanced data distribution in anomaly detection, that is, the normal traffic data accounts for the majority and the abnormal traffic data accounts for the minority, we need to find an effective method to deal with this imbalanced data distribution. We can consider using undersampling and oversampling techniques, or using ensemble learning methods such as Tomek Links and Adaptive Synthetic Sampling (ADASYN) to balance the proportion of data of different categories, thereby improving the performance of the model on the minority category.

[0010] Secondly, for different network environments and traffic characteristics, anomaly detection rules need to be customized. This includes designing customized anomaly detection algorithms and rules based on specific network environments and traffic characteristics to meet the needs of abnormal traffic detection in different scenarios. For example, for specific network applications or business scenarios, specific anomaly detection rules can be built based on domain knowledge and experience, or adaptive learning technology can be used to dynamically adjust anomaly detection rules.

[0011] Finally, in the task of anomaly detection with class imbalanced data, it is crucial to choose the right machine learning algorithm and optimization strategy. You can try different machine learning algorithms, such as distance-based methods (such as K-means), or clustering-based methods, to find the most suitable anomaly detection model for class imbalanced data. At the same time, you can tune the model parameters through methods such as cross-validation and grid search to improve the performance and generalization ability of the model. Summary of the invention

[0012] In order to solve the problem of insufficient network traffic anomaly detection capability for class-unbalanced data in the prior art, the present invention proposes a class-unbalanced network traffic anomaly monitoring system and method.

[0013] A class-unbalanced network traffic anomaly monitoring system includes a traffic preprocessing module, a data enhancement module and a monitoring module. For known class-unbalanced network traffic data containing normal traffic and some abnormal traffic, the traffic preprocessing module is first used to ensure data quality and extract features related to anomaly detection; then the data enhancement module performs undersampling and oversampling on the preprocessed traffic data to balance the proportion of normal traffic and abnormal traffic in the data set; finally, the monitoring module clusters the enhanced traffic data, evaluates the clustering results, calculates the distance between the unknown traffic data sample and the centroid of the cluster to which it belongs, and determines whether it is abnormal traffic.

[0014] A method for monitoring abnormal network traffic of a class imbalance, the specific steps are as follows:

[0015] Step 1: Collect the class-unbalanced network traffic data in the network environment as training data, input it into the network traffic anomaly monitoring system, and perform preprocessing;

[0016] Preprocessing includes data standardization, data integrity, data quality, filling missing values ​​and extracting feature values.

[0017] Step 2: For the pre-processed unbalanced network traffic data, balance the ratio of normal traffic and abnormal traffic through traffic data enhancement;

[0018] Traffic data enhancement includes undersampling normal traffic data and oversampling abnormal traffic data, specifically:

[0019] ① The undersampling method is Tomek Links ensemble undersampling, which removes the closest paired samples between the majority class and the minority class to reduce the overlap between classes. Specifically:

[0020] Suppose there are two sample points x i and x j , where x i Belongs to the majority class, x j Belongs to the minority class. Sample point x i and x j The distance between them is expressed as Euclidean distance:

[0021] d ij =||x i -x j ||

[0022] Where |||| represents the Euclidean norm of the vector.

[0023] If x i and x j are in each other's k nearest neighbors, then the TomekLink between these two sample points is determined by the following conditions: iis x j The nearest neighbor of x j Also x i , but they belong to different categories, then x i and x j Tomek Link is formed.

[0024] ② The oversampling method is ADASYN adaptive synthetic oversampling, and the specific steps are:

[0025] Step 1: Calculate the density of each minority class sample: Use the number of nearest neighbors to estimate the density of each minority class sample.

[0026] Step 2: Calculate the density ratio of each minority class sample: Compare the density of each minority class sample with the density of its neighboring samples to obtain a density ratio that indicates the difficulty of the sample.

[0027] Step 3: Generate new synthetic samples based on density ratio: For each minority class sample, the number of synthetic samples generated is determined based on its density ratio.

[0028] Suppose there is a minority class sample x i , whose density ratio is r i , need to generate n i synthetic samples. Then the number of synthetic samples generated is n i Calculated by the following formula: i = int(r i ×N maj ).

[0029] Among them, N maj Represents the number of majority class samples, and int() represents the rounding function. This formula indicates that the number of synthetic samples generated depends on the density ratio r of minority class samples. i and the number of majority class samples. The density ratio r i The higher the value, the number of synthetic samples n generated i The more.

[0030] Step 4: Add the generated synthetic samples to the original dataset.

[0031] Step three: cluster the enhanced network traffic data to obtain sample clusters with similar characteristics.

[0032] First, the data is divided into multiple clusters by using the DBSCAN clustering algorithm.

[0033] Then, the centroid of each cluster is calculated as the representative feature of the cluster.

[0034] Finally, the clustering effect is evaluated. If the clustering effect is good, the clustering is used for subsequent unknown sample identification. If the clustering effect is poor, the clustering parameters are readjusted and the data processing flow is improved, or clusters with poor effects are directly excluded and not used as judgment criteria. The clustering effect meets the identification requirements.

[0035] The method to evaluate the clustering effect is:

[0036] For unknown true labels, the clustering effect is evaluated by the silhouette coefficient and Davies-Bouldin index. The silhouette coefficient measures the compactness and separation of clusters, and its value range is between [-1,1]. The closer the value is to 1, the closer the distance within the cluster is, the farther the distance between clusters is, and the better the clustering effect is. The Davies-Bouldin index is an indicator to measure the compactness and separation of clusters. The smaller the value, the tighter the clusters are and the more separated the clusters are.

[0037] For known labels, we use mutual information, V-measure, and adjusted Rand coefficient to evaluate the effect. Mutual information measures the consistency between the cluster and the true label, V-measure takes into account the uniformity and integrity of the cluster, and the adjusted Rand coefficient measures the consistency and randomness of the cluster.

[0038] Step 4: Preprocess each unknown sample to be detected, extract its features, and calculate the distance between it and the centroid of each known sample cluster to determine whether the unknown sample is abnormal traffic. If so, trigger the alarm mechanism; otherwise, the unknown sample is normal traffic.

[0039] Traffic classification and anomaly detection are performed by comparing the features of unknown samples with known clusters. The specific process is as follows:

[0040] The unknown sample is assigned to the cluster with the nearest distance. If the distance between the unknown sample and the centroid of the cluster to which it is assigned is less than the set threshold, the sample is considered to belong to the normal traffic of the cluster; otherwise, the unknown sample is judged to be abnormal traffic.

[0041] The advantages of the present invention are:

[0042] (1) By balancing the training data set through undersampling and oversampling, the model's ability to identify abnormal traffic is enhanced, preventing the model from being more inclined to identify common normal traffic and ignoring abnormal traffic.

[0043] (2) The silhouette coefficient is used to evaluate the compactness and separation of clusters, judge the quality of clustering results, and effectively identify sample clusters with similar characteristics, so that the model can more effectively distinguish normal traffic from abnormal traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1The overall framework diagram of the unbalanced network traffic anomaly monitoring solution of the present invention;

[0045] Figure 2 It is a working flow chart of the data preprocessing module in the network traffic anomaly monitoring system of the present invention;

[0046] Figure 3 The following is a flowchart of the data enhancement module in the network traffic anomaly monitoring system of the present invention;

[0047] Figure 4 The flowchart is a flow monitoring module in the network flow anomaly monitoring system of the present invention. DETAILED DESCRIPTION

[0048] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0049] The present invention provides a class-unbalanced network traffic anomaly monitoring system and method, and constructs a network traffic anomaly monitoring module; adopts undersampling and oversampling technology, and improves the common class imbalance problem in network traffic by balancing the training data set, thereby achieving the effect of improving the model's recognition ability for abnormal traffic, having the advantages of high robustness and high accuracy, and the significance of improving the reliability of network traffic anomaly monitoring; adopts a threshold trigger alarm mechanism, and notifies the administrator when the traffic exceeds the threshold, so that the risks faced by the network can be discovered in time, achieving the effect of ensuring network security and normal operation, having the advantages of flexibility and reliability, and the significance of ensuring the normal operation of the network.

[0050] In this example, the training data comes from the CICIOT2023 dataset, and 33 attacks are performed in an IoT topology consisting of 105 devices. These attacks are divided into seven categories, namely DDoS, DoS, Recon, Web-based, brute force, Spoofing, and Mirai. Finally, all attacks are performed by malicious IoT devices targeting other IoT devices. The test data comes from real network traffic data provided by the State Grid Corporation of China.

[0051] like Figure 1As shown in the figure, the functional block diagram of the network traffic anomaly monitoring system is specifically divided into five parts, which are described in a bottom-up manner. At the bottom is the traffic collection of the network environment, and the known traffic data, including normal traffic and some abnormal traffic data, are obtained to train the subsequent clustering model and provide a basis for anomaly detection. The second layer performs data preprocessing on the traffic data, cleans the data and extracts features for the next step of clustering processing. The third layer mainly enhances the traffic data through undersampling and oversampling to balance the proportion of normal traffic and abnormal traffic in the training data set. The fourth layer is the traffic monitoring module, which mainly includes clustering and detection analysis. First, the processed network traffic data is clustered based on the DBSCAN algorithm to identify sample clusters with similar characteristics. The compactness and separation of the clusters are evaluated by calculating the silhouette coefficient to further confirm the quality of the clustering results. Next, by calculating the distance between each unknown sample and the centroid of the cluster to which it belongs, it is determined whether the sample is abnormal traffic. In order to effectively distinguish normal traffic from abnormal traffic, a distance threshold is set. When the distance between the sample and its centroid exceeds the threshold, it is judged as abnormal traffic, otherwise it is normal traffic. This method can not only accurately detect abnormal traffic, but also effectively determine normal traffic. The last layer is to test in a real environment based on the previous detection module. If it is determined to be abnormal, an alarm will be issued. The following is a detailed description of each module and method.

[0052] Module 1: Figure 2As shown in the figure, the data preprocessing module first analyzes and processes the acquired traffic, removes redundant and invalid data through data collection and cleaning, ensures data quality, and extracts important features to improve the efficiency of model training. CICIOT2023 is used as a training data set, and the CICFlowMeter feature extraction tool is used to propose a total of 83 dimensional features such as Fwd Pkts / s, FlowDuration, Flow IAT Max, Fwd IAT Tot, etc. The labels are manually annotated according to the data source. Data preprocessing mainly includes data standardization, data integrity, data quality, and filling missing values. Data standardization is completed using the Z-Score method to ensure that the data has a consistent scale within a certain range. Data integrity is to remove rows with too many null values ​​to ensure the integrity and availability of the data set. Data quality includes checking outliers, duplicate values, etc. Through data quality, potential problems in the data set can be discovered and appropriate measures can be taken to solve them, such as outlier processing (deletion, replacement), duplicate value processing (deletion, aggregation), missing value processing (deletion, filling), etc., to ensure the reliability of the model. Common filling methods for missing values ​​include using mean, median, most frequent value or model-based filling methods, etc. Preprocessing uses NumPy and Pandas to implement related algorithms, which can better output the processing flow and related visual intermediate results.

[0053] Module 2: Figure 3 As shown in the figure, the data enhancement module performs Tomek Links integrated under-sampling and ADASYN adaptive synthetic sampling on the preprocessed data. By selecting more representative samples and adaptively generating new minority class samples, the ratio of normal traffic and abnormal traffic is balanced, achieving the technical effect of improving generalization ability and improving evaluation indicators. It has the advantages of high diversity and adaptability, and improves the class imbalance problem. The balanced data set is then output.

[0054] (1) Tomek Links is an undersampling method used to solve the class imbalance problem. Its main principle is to remove the closest pair of samples between the majority class and the minority class to clarify the classification boundaries and reduce the overlap between classes.

[0055] The core idea of ​​Tomek Links is that if there are two sample points, one belongs to the majority class and the other belongs to the minority class, and they are the nearest neighbors to each other, then a Tomek Link is formed between the two sample points. By removing these Tomek Links, the connection between the majority class and the minority class can be weakened, making the classification boundary clearer.

[0056] Suppose there are two sample points x i and x j , where xi Belongs to the majority class, x j Belongs to the minority class. Sample point x i and x j The distance between them can be expressed using the Euclidean distance:

[0057] d ij =||x i -x j ||

[0058] where |||| represents the Euclidean norm of the vector (usually the L2 norm). If x i and x j They are in each other's k nearest neighbors, then the Tomek Link between these two sample points can be determined by the following conditions:

[0059] If x i is x j The nearest neighbor of x j Also x i , but they belong to different categories, then x i and x j Tomek Link is formed.

[0060] (2) Adaptive synthetic oversampling (ADASYN) is an improved method of SMOTE. By adaptively generating new minority class samples, the minority class samples that are difficult to classify receive more attention during the sampling process. The main steps of ADASYN are as follows:

[0061] Step 1: Calculate the density of each minority class sample: Use the number of nearest neighbors to estimate the density of each minority class sample, usually using the K nearest neighbor method.

[0062] Step 2: Calculate the density ratio of each minority class sample: Compare the density of each minority class sample with the density of its neighboring samples to obtain a density ratio that indicates the difficulty of the sample.

[0063] Step 3: Generate new synthetic samples based on density ratio: For each minority class sample, determine how many synthetic samples to generate based on its density ratio. The higher the density ratio, the more synthetic samples are generated.

[0064] Step 4: Add the generated synthetic samples to the original dataset.

[0065] Suppose there is a minority class sample x i , whose density ratio is r i , need to generate n i synthetic samples. Then the number of synthetic samples generated is n i It can be calculated by the following formula:i = int(r i ×N maj ).

[0066] Among them, N maj Represents the number of majority class samples, and int() represents the rounding function. This formula indicates that the number of synthetic samples generated depends on the density ratio r of minority class samples. i and the number of majority class samples. The density ratio r i The higher the value, the number of synthetic samples n generated i The more.

[0067] Module 3: The monitoring module clusters the enhanced network traffic data to obtain sample clusters with similar characteristics. Then, the unknown samples are processed and compared with the sample clusters to identify the unknown samples as normal traffic or abnormal traffic.

[0068] The clustering process is as follows: First, the data is divided into multiple clusters by using clustering algorithms such as DBSCAN. Then, the centroid of each cluster is calculated as the representative feature of the cluster. Finally, the clustering effect is evaluated.

[0069] The purpose of evaluating clustering effects is to ensure that clustering results can be used for accurate traffic identification and anomaly detection. If the clustering effect is good, it is retained and used for subsequent judgment. If the effect is poor, it is necessary to readjust the clustering parameters, improve the data processing process, or directly exclude those clusters with poor effects and not use them as judgment criteria. This evaluation and screening step is to improve the accuracy of subsequent classification and anomaly detection.

[0070] Clustering effect evaluation is mainly divided into two cases: the true label is unknown and the true label is known.

[0071] For the case of unknown true labels, commonly used clustering effect evaluation indicators include silhouette coefficient and Davies-Bouldin index. Silhouette coefficient measures the compactness and separation of clusters, and its value range is between [-1,1]. The closer the value is to 1, the closer the distance within the cluster is, the farther the distance between clusters is, and the better the clustering effect is. Davies-Bouldin index is an indicator to measure the compactness and separation of clusters. The smaller the value, the tighter the clusters are and the more separated the clusters are.

[0072] For known labels, we can use mutual information, V-measure, and adjusted Rand coefficient to evaluate the effect. Mutual information measures the consistency between the cluster and the true label, V-measure comprehensively considers the uniformity and integrity of the cluster, and the adjusted Rand coefficient measures the consistency and randomness of the cluster.

[0073] The process of the monitoring module identifying the location samples to be monitored is as follows: Figure 4As shown in the figure, the traffic to be monitored is first preprocessed and its features are extracted. Subsequently, the unknown samples are assigned to the nearest cluster, and the Euclidean distance between each unknown sample and the centroid of the cluster to which it belongs is calculated. The sample is judged whether it is abnormal traffic based on the distance, and the normal traffic and abnormal traffic are distinguished by setting the distance threshold. If the distance exceeds the threshold, the sample is classified as abnormal traffic, and the alarm mechanism is triggered immediately, so that the administrator can take timely measures, achieving the technical effect of improving the flexibility and immediacy of the system, with the advantages of high accuracy and high reliability, and ensuring the safety and stability of the power terminal network, and ensuring the normal operation of the power terminal network. Otherwise, it is divided into corresponding categories and the category results are output.

Claims

1. A class-unbalanced network traffic anomaly monitoring system, characterized in that: It includes a traffic preprocessing module, a data enhancement module and a monitoring module. For known unbalanced network traffic data containing normal traffic and some abnormal traffic, the traffic preprocessing module is first used to ensure data quality and extract features related to anomaly detection. Then the data enhancement module undersamples and oversamples the preprocessed traffic data to balance the ratio of normal traffic and abnormal traffic in the data set; finally, the monitoring module clusters the enhanced traffic data, evaluates the clustering results, calculates the distance between the unknown traffic data sample and the centroid of the cluster to which it belongs, and determines whether it is abnormal traffic.

2. A method for monitoring abnormal network traffic of class imbalance, characterized in that: The specific steps are as follows: Step 1: Collect the class-unbalanced network traffic data in the network environment as training data, input it into the network traffic anomaly monitoring system, and perform preprocessing; Step 2: For the pre-processed unbalanced network traffic data, balance the ratio of normal traffic and abnormal traffic through traffic data enhancement; Traffic data enhancement includes undersampling normal traffic data and oversampling abnormal traffic data, specifically: ① The undersampling method is Tomek Links ensemble undersampling, which removes the closest paired samples between the majority class and the minority class to reduce the overlap between classes. Specifically: Suppose there are two sample points x i and x j , where x i Belongs to the majority class, x j Belongs to the minority class; sample point x i and x j The distance between them is expressed as Euclidean distance: d ij =||x i -x j || Where || || represents the Euclidean norm of the vector; If x i and x j They are each in each other's k nearest neighbors, then the Tomek Link between these two sample points is determined by the following conditions: If x i is x j The nearest neighbor of x j Also x i , but they belong to different categories, then x i and x j Tomek Link was formed; ② The oversampling method is ADASYN adaptive synthetic oversampling, and the specific steps are: Step 1: Calculate the density of each minority class sample: Use the number of nearest neighbors to estimate the density of each minority class sample; Step 2: Calculate the density ratio of each minority class sample: Compare the density of each minority class sample with the density of its neighboring samples to obtain a density ratio to indicate the difficulty of the sample; Step 3: Generate new synthetic samples according to density ratio: For each minority class sample, determine the number of synthetic samples to be generated according to its density ratio; Suppose there is a minority class sample x i , whose density ratio is r i , need to generate n i synthetic samples; then the number of synthetic samples generated is n i Calculated by the following formula: i = int(r i ×N maj ); Among them, N maj Represents the number of majority class samples, int() represents the rounding function; this formula indicates that the number of synthetic samples generated depends on the density ratio r of minority class samples i and the number of majority class samples; density ratio r i The higher the value, the number of synthetic samples n generated i The more; Step 4: Add the generated synthetic samples to the original dataset; Step 3: cluster the enhanced network traffic data to obtain sample clusters with similar characteristics; Step 4: Preprocess each unknown sample to be detected, extract its features, and calculate the distance between it and the centroid of each known sample cluster to determine whether the unknown sample is abnormal traffic. If so, trigger the alarm mechanism; otherwise, the unknown sample is normal traffic.

3. According to claim 2, a method for monitoring abnormal network traffic of class imbalance, characterized in that: The preprocessing includes data standardization, data integrity, data quality improvement, filling missing values ​​and extracting feature values.

4. According to claim 2, a method for monitoring abnormal network traffic of class imbalance, characterized in that: The clustering process is: First, the data is divided into multiple clusters by using the DBSCAN clustering algorithm. Then, the centroid of each cluster is calculated as the representative feature of the cluster; Finally, the clustering effect is evaluated. If the clustering effect is good, clustering will be used for subsequent unknown sample identification. If the clustering effect is poor, the clustering parameters will be readjusted and the data processing process will be improved, or clusters with poor effects will be directly excluded and not used as judgment criteria. The clustering effect meets the identification requirements.

5. According to claim 4, a method for monitoring abnormal network traffic of class imbalance, characterized in that: The method for evaluating the clustering effect is: For the case of unknown true labels, the clustering effect is evaluated by the silhouette coefficient and Davies-Bouldin index. The silhouette coefficient measures the compactness and separation of clusters, and its value range is between [-1,1]. The closer the value is to 1, the closer the distance within the cluster is, the farther the distance between clusters is, and the better the clustering effect is. The Davies-Bouldin index is an indicator to measure the compactness and separation of clusters. The smaller the value, the tighter the clusters are and the more separated the clusters are. For the case of known labels, the mutual information score, V-measure, and adjusted Rand coefficient evaluation indicators are used to complete the effect evaluation; the mutual information score measures the consistency between the cluster and the true label, the V-measure comprehensively considers the uniformity and completeness of the cluster, and the adjusted Rand coefficient measures the consistency and randomness of the cluster.

6. According to claim 2, a method for monitoring abnormal network traffic of class imbalance, characterized in that: Traffic classification and anomaly detection are performed based on the distance between the features of the unknown sample and the centroid of the known sample cluster. The specific process is as follows: Assign the unknown sample to the nearest cluster. If the distance between the unknown sample and the centroid of the cluster to which it is assigned is less than the set threshold, the sample is considered to belong to the normal traffic of the cluster. Otherwise, the unknown sample is judged as abnormal traffic.

Images