摘要
随着网络技术的发展,网络攻击方式复杂多变,传统检测技术无法应对未知的攻击模式,因此异常检测技术被提出。文章介绍了目前常见的异常检测技术,并分析了这些技术的优缺点,在此基础上提出了基于大数据的网络异常行为建模方法并分析了可行性。通过聚类算法识别偏离正常的流量,并对偏离流量的异常程度排序,采用基于阈值的方法将异常度高的流量标记为网络异常行为,目前已有的研究成果,为本文的可行性提供了可靠支持。
With the development of network technology, the pattern of network attack becomes complex and changeable, and the traditional detection technology can not cope with the unknown attack mode, thus the anomaly detection technology has been proposed. Accordingly, this paper introduces current common anomaly detection technologies, and analyzes the advantages and disadvantages of these technologies. Based on that, a network abnormal behavior modeling scheme based on big data is put forward and its feasibility is analyzed. By clustering algorithm to identify deviations from normal traffic, and sorting out the abnormal degree of deviating traffic, we use threshold based method to label abnormal traffic as network abnormal behavior. At present, the results of the research have provided reliable support for the feasibility of this paper.
出处
《电力信息与通信技术》
2018年第1期6-10,共5页
Electric Power Information and Communication Technology
关键词
大数据
网络异常行为
建模
big data
network abnormal behavior
modeling
