The invention discloses a network abnormal traffic detection method based on a PAM (Partitioning Around Medoids) clustering
algorithm. The method comprises a traffic collection stage of monitoring a network to obtain
network data packets through a
network analysis tool; a
feature extraction stage of extracting attributes of the
network data packets, and carrying out information entropy calculation on the attributes of the
network data packets in a time period, thereby obtaining multiple multi-dimensional
data records; a center selection stage of clustering data points of the network data packets by employing the PAM clustering
algorithm according to the multi-dimensional
data records, and selecting precise clustering centers through approximate clustering after approximate clustering centers are obtained; and an
outlier judgment state of setting a threshold value, and screening data points of which precise clustering center distance and partial
outlier factors are greater than the threshold value, thereby obtaining
outlier abnormal data. According to the method, the improved PAM clustering
algorithm is applied to abnormal traffic detection, the
advantage that clustering is unnecessarily marked is inherited, moreover, the
operation time required by the algorithm is reduced, and the capability of
processing more data can be realized.