| 基于IP地址聚类的网络异常流量分析 |
| |
| 引用本文： | 于寒冰,王继龙. 基于IP地址聚类的网络异常流量分析[J]. 中国海洋大学学报(自然科学版), 2008, 0(Z1) |
| |
| 作者姓名： | 于寒冰 王继龙 |
| |
| 作者单位： | [1]清华信息科学与技术国家实验室（筹） [2]清华大学信息网络工程研究中心 |
| |
| 摘 要： | 异常流量在目的地址与出现时间上的分布均与正常流量有很大区别。文中对校园网的出口流量进行分析实验,将其NetFlow记录按校外IP地址的前16位聚类,得到的部分网段在出入流量中的出现频度有明显特点。分析2种典型网段,研究由此发现校园网内的异常流量源的方法,并对2种异常流量源的区别进行了分析。此方法与常用的异常检测方法相比,所需处理的数据量大为减少,大大提高了检测效率。
|
| 关 键 词： | NetFlow 异常检测 流量分析 |
Abnormal Network Traffic Analysis Based on IP Address Clustering |
| |
| YU Han-Bing,WANG Ji-Long,Network Research Center,Tsinghua University,Beijing ,China). Abnormal Network Traffic Analysis Based on IP Address Clustering[J]. Periodical of Ocean University of China, 2008, 0(Z1) |
| |
| Authors: | YU Han-Bing WANG Ji-Long Network Research Center Tsinghua University Beijing China) |
| |
| Affiliation: | YU Han-Bing,WANG Ji-Long(Tsinghua National Laboratory for Information Science , Technology(TNList),Network Research Center,Tsinghua University,Beijing 100084,China) |
| |
| Abstract: | Abnormal traffic appears very different from normal traffic on the distribution of both destination IP address and time.This paper clusters the Netflow records of the traffic via the campus network based on the higher 16 bits of the outer IP address,finding that some clusters appear unusual on frequency of the emergence.This paper analyzes two kinds of typical cluster,proposes a method to detect anomaly sources insides the campus network using the clusters,and finds the differences of two kinds of anomaly s... |
| |
| Keywords: | NetFlow anomaly detection network traffic analysis |
| 本文献已被 CNKI 维普 等数据库收录！ |
|
