Traffic anomaly detection method in networks based on improved clustering algorithm

Hong-cheng LI; Xiao-ping WU; Hong-hai JIANG

doi:10.11959/j.issn.2096-109x.2015.00009

您当前的位置：

首页 >

文章列表页 >

Traffic anomaly detection method in networks based on improved clustering algorithm

Papers | 更新时间：2024-06-03

- Traffic anomaly detection method in networks based on improved clustering algorithm
- Chinese Journal of Network and Information Security Vol. 1, Issue 1, Pages: 66-71(2015)
- 作者机构：
  
  1. 海军工程大学信息安全系，湖北武汉 430033
  2. 海军北海舰队司令部，山东青岛 266071
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2015.00009
  CLC： TP309.7
- Online First：2015-12，
  
  Published：15 December 2015
- 稿件说明：
移动端阅览
Hong-cheng LI, Xiao-ping WU, Hong-hai JIANG. Traffic anomaly detection method in networks based on improved clustering algorithm[J]. Chinese Journal of Network and Information Security, 2015, 1(1): 66-71.
DOI：

Hong-cheng LI, Xiao-ping WU, Hong-hai JIANG. Traffic anomaly detection method in networks based on improved clustering algorithm[J]. Chinese Journal of Network and Information Security, 2015, 1(1): 66-71. DOI： 10.11959/j.issn.2096-109x.2015.00009.

摘要

针对传统基于聚类分析的网络流量异常检测方法准确性较低的问题，提出了一种基于改进 k-means聚类的流量异常检测方法。通过对各类流量特征数据的预处理，使k-means算法能适用于枚举型数据检测，进而给出一种基于数值分布分析法的高维数据特征筛选方法，有效解决了维数过高导致的距离失效问题，并运用二分法优化K个聚簇的划分，减少了初始聚类中心选择对k-means算法结果的影响，进一步提高了算法的检测率。最后通过仿真实验验证了所提出算法的有效性。

Abstract

To solve the problem that traditional traffic abnormal detection methods were not accurate enough

a traf-fic anomaly detection method based on improved k-means was proposed.All kinds of network traffic data were pre-processed to make k-means algorithm can apply to enumeration data detection.Then a features selection method was pro-posed with the analysis of the distribution of network traffic data to avoid the distance useless caused by too much fea-tures.Furthermore

the clustering process of K clusters was optimized based on dichotomy

aiming to reduce the effects of initial clusters centers selection.Simulation results demonstrate the effectiveness of the algorithm.

关键词

Keywords

references

唐成华 , 刘鹏程 , 汤申生 , 等 . 基于特征选择的模糊聚类异常入侵行为检测 [J ] . 计算机研究与发展 , 2015 , 52 ( 3 ): 718 - 728 .

TANG C H , LIU P C , TANG S S , et al . Fuzzy clustering abnormal behavior detection based on feature selection [J ] . Computer Re-search and Development , 2015 , 52 ( 3 ): 718 - 728 .

XU J H , LIU H . Web user clustering analysis based on k-means algorithm [C ] // Proceeding of the 2010 International Conference on Information,Networking and Automation (ICINA),New York . 2010 : 6 - 9 .

LI P , LIU L , GAO D , et al . On challenges in evaluating malware clustering [C ] . Recent Advances in Intrusion Detection,Ottawa . 2010 : 238 - 255 .

武小年 , 彭小金 , 杨宇洋 , 等 . 入侵检测中基于 SVM 的两级特征选择方法 [J ] . 通信学报 , 2015 , 36 ( 4 ): 19 - 26 .

WU X N , PENG X J , YANG Y Y , et al . Two levels of feature selec-tion methods based on SVM in intrusion detection [J ] . Journal on Communication , 2015 , 36 ( 4 ): 19 - 26 .

郑黎明 , 邹鹏 , 韩伟红 , 等 . 基于多维熵值分类的骨干网流量异常检测研究 [J ] . 计算机研究与发展 , 2012 , 49 ( 9 ): 1972 - 1981 .

ZHENG L M , ZOU P , HAN W H , et al . Backone network traffic anomaly detection study based on multidimensional entropy classi-fication [J ] . Computer Research and Development , 2012 , 49 ( 9 ): 1972 - 1981 .

SHINGO M , CHEN C , LU N N . Intrusion-detection model based on fuzzy class-association-rule mining using genetic programming network [J ] . IEEE Transaction on Systems,Man,and Cybernetics , 2011 , 41 ( 1 ): 130 - 139 .

DASH S K , REDDY K S . Adaptive naive Bayes method for mas-querade detection [J ] . Security and Communications Networks , 2011 , 4 ( 4 ): 410 - 417 .

张玲 , 白中英 , 罗守山 , 等 . 基于粗糙集和人工免疫的集成入侵检测模型 [J ] . 通信学报 , 2013 , 34 ( 9 ): 166 - 176 .

ZHANG L , BAI Z Y , LUO S S , et al . Ensemble intrusion detection model based on rough set and artificial immunity [J ] . Journal on Communication , 2013 , 34 ( 9 ): 166 - 176 .

陆悠 , 李伟 , 罗军舟 , 等 . 一种基于选择性协同学习的网络用户异常行为检测方法 [J ] . 计算机学报 , 2014 , 37 ( 1 ): 28 - 40 .

LU Y , LI W , LUO J Z , et al . A method of network users abnormal behavior based on selective collaborative learning [J ] . Chinese Journal of Computer , 2014 , 37 ( 1 ): 28 - 40 .

FLAVIO C , NILESH D , RAVI K . Correlation clustering in MapRe-duce [C ] // Proceeding of the 20th ACM SIGKDD International Con-ference on Knowledge Discovery and Data Mining (KDD 2014),New York . 2014 : 641 - 650 .

钱叶魁 , 陈鸣 , 叶立新 , 等 . 基于多尺度主成分分析的全网络异常检测方法 [J ] . 软件学报 , 2012 , 23 ( 2 ): 361 - 377 .

QIAN Y K , CHEN M , YE L X , et al . Methods of full network anomaly detection based on multi-scale principle component analy-sis [J ] . Journal of Software , 2012 , 23 ( 2 ): 361 - 377 .

RUBINSTEIN B , NELSON B , HUANG L , et al . Stealthy poison-ing attacks on PCA-based anomaly detectors [C ] // Proceeding of the ACM SIGMETRICS,New York . 2009 .

Views

3667

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Security scheme for time-critical TRDP message

Secure multidimensional interconnection network for the software defined system on wafer

Overview on industrial Internet honeynet technology

Efficient and safe software defined network topology discovery protocol

Selfish mining detection scheme based on the characters of transactions

Related Author

LU Xiang

CHENG Youlin

WU Xuechao

CUI Yulong

MEI Bo

CAO Zhipeng

GUO Wei

SHEN Jianliang

Related Institution

School of Cyber Security, University of CAS

Institute of Information Engineering, CAS

CRRC Qingdao Sifang Co., Ltd.

Information Engineering University

Engineering Research Center of Smart Energy, Civil Aviation Administration of China

⁰