Network traffic anomaly detection method based on improved clustering analysis

Abstract

With the surge in the amount of data transmitted on the network, intelligent learning and other technologies have emerged to solve the problem of anomaly detection of streaming data in large data. For network security issues, based on the extraction of network traffic characteristics, network traffic classification or clustering is an important technical means to discover network faults and network attacks. In this paper, a distributed detection framework for detecting anomalous behaviors of encrypted network traffic is proposed. The intelligent router is adopted to obtain the encrypted network traffic monitoring stub, and then the neural network codec is used to adaptively learn the characteristics of the encrypted traffic and identify the abnormal behavior of the encrypted protocol traffic. A wide coverage traffic pattern extraction algorithm based on the network state sequence is designed to obtain the traffic patterns that represent the network conditions of the data center. Finally, the simulation test verifies that the model has frequent traffic patterns with priority. The performance of the network anomaly detection model is better than other detection methods, which improves the accuracy of detection and has a better recognition effect.