Network Anomaly Detection Using Minimum Spanning Tree Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network anomaly detection methods using clustering algorithms face inefficiencies and inaccuracies, particularly when dealing with non-spherical clusters, leading to local optimal solutions and reduced classification accuracy of network data traffic.
Innovation Solution
The method constructs a complete graph from network data traffic, optimizes it into a minimum spanning tree using the Kruskal algorithm, and classifies data packets based on cluster centers, updating centers if necessary, to determine anomaly behaviors by calculating intra-cluster and inter-cluster distances and cosine similarities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional clustering algorithms are used to classify network data traffic, then the classification process is simple to implement, but the classification accuracy is reduced due to local optimal solutions and poor handling of non-spherical clusters
Solution Approach 1:
The patent changes the fundamental parameter of cluster center selection from average value-based (conventional) to minimum spanning tree-based. By transforming the complete graph into a minimum spanning tree and selecting cluster centers based on tree structure properties rather than arithmetic means, the algorithm achieves better handling of non-spherical clusters and avoids local optimal solutions, thereby improving classification accuracy.
Solution Approach 2:
The patent introduces minimum spanning tree as an intermediary structure between the complete graph of data points and the final clustering result. This intermediary structure provides a more effective framework for selecting cluster centers, especially for non-spherical data distributions, without requiring complex iterative optimization procedures.
2Reliability
If cluster centers are selected based on average value of distances, then the selection process is computationally simple, but the clustering effect is not obvious and local optimal solutions are obtained
Solution Approach 1:
The patent performs preliminary action by constructing a minimum spanning tree before selecting cluster centers. This pre-processing step creates an optimized structure that guides subsequent cluster center selection, ensuring better clustering effects while avoiding the need for repeated iterative calculations that would increase computation time.
Solution Approach 2:
The patent segments the complete graph into a minimum spanning tree structure, which breaks down the complex problem of cluster center selection into more manageable components. This segmentation allows for more effective identification of representative points in non-spherical clusters without requiring exhaustive computation.
Data Source
AI summary
Provided are a method, apparatus, device for determining a network anomaly behavior. The method includes: acquiring network data traffic in a target network, and determining each data packet contained in the network data traffic as a node of a complete graph, to construct a data complete graph; optimizing the data complete graph into a minimum spanning tree by a Kruskal algorithm, and determining each node of the minimum spanning tree as a cluster center; classifying all data packets contained in the network data traffic based on cluster centers, to acquire data element sets corresponding to the cluster centers respectively; and determining an anomaly behavior in the target network based on a type of each of the data element sets, wherein the type of the data element set is determined by a type of a network attack contained in the network data traffic.