基于层次聚类的网络流量异常分类算法  

Network Traffic Anomaly Classification Algorithm Based on Hierarchical Clustering

作　　者：许倩[1] 程东年[1] 

机构地区：[1]国家数字交换系统工程技术研究中心,郑州450002

出　　处：《计算机工程》2012年第23期131-136,共6页Computer Engineering

基　　金：国家"863"计划基金资助项目(2009AA01A346);国家科技支撑计划基金资助项目(2011BAH19B01)

摘　　要：现有的异常流量根源分析技术大多需要人工干预,对异常事件的分类效果不佳。为此,提出基于层次聚类的流量异常分类算法TAC HC,通过特征属性的训练过程逐步建立分类树,把相似的异常嵌入到子树中,在未知数据集聚类数目的情况下对新的异常进行分类。仿真结果表明,TAC HC算法的分类平均准确率达到89%,对网络扫描这类小异常事件的分类精确率也能达到95.3%。Most methods of root cause analysis often require manual intervention,and the classification results of anomaly events are not satisfied.This paper proposes a novel model named Traffic Anomaly Classification based on Hierarchical Clustering（TAC HC）.It utilizes the learning process of its feature attributes to establish classification tree gradually and the similar anomaly is embedded in the subtree.The classification tree classifies new anomalies with the number of clusters unknown.Experimental results show that the classification accuracy of TAC HC algorithm reaches 89%,and the classification accuracy of anomalies with low traffic volumes such as network scan reaches 95.3%.

关 键 词：流特征 属性向量 网络异常事件 层次聚类 异常分类算法 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]