Network abnormal traffic detection method based on PAM (Partitioning Around Medoids) clustering algorithm

Abstract

The invention discloses a network abnormal traffic detection method based on a PAM (Partitioning Around Medoids) clustering algorithm. The method comprises a traffic collection stage of monitoring a network to obtain network data packets through a network analysis tool; a feature extraction stage of extracting attributes of the network data packets, and carrying out information entropy calculation on the attributes of the network data packets in a time period, thereby obtaining multiple multi-dimensional data records; a center selection stage of clustering data points of the network data packets by employing the PAM clustering algorithm according to the multi-dimensional data records, and selecting precise clustering centers through approximate clustering after approximate clustering centers are obtained; and an outlier judgment state of setting a threshold value, and screening data points of which precise clustering center distance and partial outlier factors are greater than the threshold value, thereby obtaining outlier abnormal data. According to the method, the improved PAM clustering algorithm is applied to abnormal traffic detection, the advantage that clustering is unnecessarily marked is inherited, moreover, the operation time required by the algorithm is reduced, and the capability of processing more data can be realized.

Description

technical field [0001] The invention relates to a network anomaly detection technology, in particular to a network anomaly flow detection method based on a PAM clustering algorithm. Background technique [0002] When malicious behaviors such as snooping and intrusion occur, certain characteristics of the traffic transmitted on the network, such as traffic size, data packet length, and the content of a specific area of ​​the data packet, will show dissimilarity from normal traffic. If it can be detected as early as possible With these abnormal traffic, actions can be taken in advance to protect network security. It is of great significance to study the detection of these abnormal traffic, locate the abnormal host, and then deal with the abnormal host to avoid network congestion, ensure network performance, avoid abuse of network resources and protect network information security. [0003] Clustering is a general unsupervised learning method that aims to classify objects into...

AI Technical Summary

Problems solved by technology

Of course, this algorithm also has many shortcomings, especially the selected cluster centers are easily affected by outliers. When calculating the mean, if there are some outliers, it is easy to deviate the cluster centers far away.

If the K-Means algorithm is applied to outlier detection, the distance between the selected cluster center and the outlier is not obvious, which makes outlier detection more difficult

Images