Abstract: Aiming at the recognition of abnormal data flows, this paper proposes an establishment method of K layers abnormal features model based on NetFlow, whose conception is described in detail, in addition to its realizable method. It updates the data of K layers features pattern and adjusts their multilayer PRI. Experimental result shows the method can quickly detect abnormal net-flows, obviously reduce the matching times and improve matching efficiency.

Key words: flow analysis, anomaly detection, features model

摘要： 针对异常数据流的识别问题，提出基于NetFlow的动态K层特征模型库建立方法。描述动态K层异常特征模型的概念，建立K层特征模型库，更新K层特征模型表中的数据，调整分层优先级别。实验结果表明，该方法能快速识别异常数据流，有效减少匹配次数，提高匹配效率。

关键词: 流量分析, 异常检测, 特征模型

CLC Number: 

• TP393