The invention discloses a network abnormal flow 
monitoring system based on a density 
peak value cluster, comprising a characteristic selection module, a subspace mapping module, an abnormal weight assignment module, an abnormal 
weight value integration module, an abnormal 
weight value threshold determination module, and an abnormal flow detection module. The characteristic selection module chooses a new 
characteristic space module through a key character source 
IP address collected in a unit time of one minute; the subspace mapping module maps a high dimension 
characteristic space to a plurality of low dimension spaces to form a plurality of new 
characteristic space data; the abnormal weight assignment module calculates the abnormal weight of each 
data point in each subspace on the basis of distance weight assignment method of the density and the distance; the abnormal 
weight value integration module calculates the abnormal weight values in the subspace to perform integration to obtain the ultimate abnormal weight of the original space 
data point; the abnormal weight threshold determination module takes the gradient abrupt change position as a 
detection threshold after sorting the ultimate abnormal weights according to the 
reverse order; and the network flow, the abnormal weight of which is greater than the threshold, is abnormal flow, and otherwise, the network flow is the normal flow. The network abnormity flow 
monitoring system based on the density 
peak value cluster is applicable to various network environments and can improve the accuracy of the detection precision.