Data stream processing method and device

Abstract

Embodiments of the present invention provide a data flow processing method and device, the processing method includes: sampling the data flow in the network at the sampling moment to obtain the first data; according to the first data, determining the first characteristic of the first data vector; if according to the cluster set and the first eigenvector, it is determined that the data flow is not an abnormal flow, then perform cluster analysis on the first eigenvector according to the cluster set, obtain a new cluster set, and return to the executed The data flow in the network is sampled at the sampling moment; wherein, the number of clusters in the cluster cluster set is different from the number of clusters in the new cluster cluster set; the processing method of the data stream provided by the embodiment of the present invention And the device, since the clustering cluster set used to determine whether the data stream is an abnormal stream is updated in real time, and the number of clusters in the clustering cluster set is also changed in real time, the accuracy of judging the data stream can be improved.

Description

technical field [0001] The embodiments of the present invention relate to the field of network technologies, and in particular, to a data flow processing method and device. Background technique [0002] When the network fails or the network is maliciously attacked, there will be abnormal flows in the network. These abnormal flows will consume network bandwidth and consume the processing time of network devices, resulting in users being unable to use the services and applications provided by the network normally, and reducing the service quality of the network. , so it is necessary to detect the data flow in the network in real time, and to send an alarm when an abnormal flow is found in time. [0003] Generally speaking, the data flow in the network is sampled in real time, and by comparing the data obtained by real-time sampling with the established data model, it is judged whether the data flow in the network is an abnormal flow; the data model is based on the data in the ...

AI Technical Summary

Problems solved by technology

[0004] However, when those skilled in the art use the above method to detect abnormal flows in the network, they find that the content of network services is constantly changing, and the characteristics of the data in the normal data flow in the network are also constantly changing, but the above-mentioned established The data model cannot adapt to the changes of data flow in the network in real time, which leads to misjudgment and missed judgment when detecting abnormal flow in the network.

Images