The invention discloses a network abnormal flow
monitoring system based on a density
peak value cluster, comprising a characteristic selection module, a subspace mapping module, an abnormal weight assignment module, an abnormal
weight value integration module, an abnormal
weight value threshold determination module, and an abnormal flow detection module. The characteristic selection module chooses a new
characteristic space module through a key character source
IP address collected in a unit time of one minute; the subspace mapping module maps a high dimension
characteristic space to a plurality of low dimension spaces to form a plurality of new
characteristic space data; the abnormal weight assignment module calculates the abnormal weight of each
data point in each subspace on the basis of distance weight assignment method of the density and the distance; the abnormal
weight value integration module calculates the abnormal weight values in the subspace to perform integration to obtain the ultimate abnormal weight of the original space
data point; the abnormal weight threshold determination module takes the gradient abrupt change position as a
detection threshold after sorting the ultimate abnormal weights according to the
reverse order; and the network flow, the abnormal weight of which is greater than the threshold, is abnormal flow, and otherwise, the network flow is the normal flow. The network abnormity flow
monitoring system based on the density
peak value cluster is applicable to various network environments and can improve the accuracy of the detection precision.