摘要： 针对现有异常流量检测方法的识别准确率低且快速识别需要确定阈值等问题,基于词袋模型聚类,提出一种改进的网络异常流量识别方法。通过对已有的异常流量和正常流量进行K-means均值聚类,得到网络流量中的流量关键点,将网络流量转化映射到相应流量关键点后建立直方图,并采用半监督学习方式对异常流量进行检测。实验结果表明,与基于朴素贝叶斯、支持向量机等的识别方法相比,该方法具有更好的异常流量识别效果。

关键词: 词袋模型, 机器学习, 聚类, 数据挖掘, 异常流量识别

Abstract: In view of the problem that the accuracy of abnormal traffic identification is low and fast identification is dependent on the threshold,an abnormal traffic identification method based on BoW(Bag of Words) model clustering is proposed.By means of K-means mean clustering for existing abnormal traffic and normal traffic,it finds the key points of network traffic.The original traffic is tranformed and mapped to the corresponding traffic critical points and then histogram is established.Abnormal traffic is detected by using semi-supervised learning.The experimental results show that this method has better recognition effect of abnormal traffic compared with identification method based on Naive Bayes(NB),Support Vector Machine(SVM) and others.

Key words: Bag of Words(BoW) model, machine learning, clustering, data mining, abnormal traffic identification

中图分类号: 

• TP309