Network abnormity flow monitoring system based on density peak value cluster

Abstract

The invention discloses a network abnormal flow monitoring system based on a density peak value cluster, comprising a characteristic selection module, a subspace mapping module, an abnormal weight assignment module, an abnormal weight value integration module, an abnormal weight value threshold determination module, and an abnormal flow detection module. The characteristic selection module chooses a new characteristic space module through a key character source IP address collected in a unit time of one minute; the subspace mapping module maps a high dimension characteristic space to a plurality of low dimension spaces to form a plurality of new characteristic space data; the abnormal weight assignment module calculates the abnormal weight of each data point in each subspace on the basis of distance weight assignment method of the density and the distance; the abnormal weight value integration module calculates the abnormal weight values in the subspace to perform integration to obtain the ultimate abnormal weight of the original space data point; the abnormal weight threshold determination module takes the gradient abrupt change position as a detection threshold after sorting the ultimate abnormal weights according to the reverse order; and the network flow, the abnormal weight of which is greater than the threshold, is abnormal flow, and otherwise, the network flow is the normal flow. The network abnormity flow monitoring system based on the density peak value cluster is applicable to various network environments and can improve the accuracy of the detection precision.

Description

technical field [0001] The invention relates to the fields of network intrusion detection, machine learning and the like, and in particular to an unsupervised network abnormal traffic detection method based on multi-space abnormal weighting. Background technique [0002] Network intrusion detection technology is mainly divided into two categories: misuse detection (MisuseDetection) and anomaly detection (AnomalyDetection). Misuse detection is a feature matching method that compares computer behavior with known application or attack features. This method has a relatively high detection rate, but it can only detect known attack types and known system weaknesses. An unknown attack was detected. Relatively speaking, anomaly detection is to observe the activities of the subject according to the abnormal monitor, and then generate outlines that describe these activities. Each outline saves and records the current behavior of the subject, and regularly merges the current behavior ...

AI Technical Summary

Problems solved by technology

If the label of the training data is incorrect, the normal or abnormal model obtained through algorithm training will be inaccurate, the detection efficiency of the algorithm will be greatly reduced, and even the algorithm will fail completely

Images