基于数据挖掘的企业网流量异常检测的研究与实现

发布时间：2018-04-18 22:40

本文选题：数据挖掘 + 异常流量检测　；参考：《上海交通大学》2014年硕士论文

【摘要】：网络自从诞生以来就因其无可替代的优势而在全球迅猛发展，如今已遍布生产、生活、服务、教育等人们社会活动的方方面面，就如同空气和水一样无形而又无处不在，在给与人们方便的同时也深刻影响着人们的活动习惯。 TCP/IP协议不是一个完美的产品，在病毒和黑客入侵遍布网络的环境下，TCP/IP协议的漏洞使得没有哪个企业可以幸免。一旦受到攻击，网络越发达的企业遭受的损失越惨重。所以如今保护本企业网络成了各公司网络管理人员的首要任务，对网络防护技术的研究也是方兴未艾，一日千里。本文正是在这样的环境下开展了对网络防护的研究工作，集中在使用数据挖掘技术对企业局域网的异常流量的分析与检测上。在对企业网络中病毒感染、黑客入侵、设备故障等导致的异常流量进行了分析的基础上，研究异常流量的属性选择，，提出使用统计及聚类算法对异常流量进行分级检测的方法，并使用异常模型对其进行分类。进一步提出一个企业异常流量检测分类系统，该系统能够监控网络，侦测到异常流量并进行识别，能协助对网络进行自动调整。最后，在企业实际网络环境中对该系统进行了测试，系统对异常流量检测精度达到90%。
[Abstract]:Since its birth, the Internet has developed rapidly in the world because of its irreplaceable advantages. Now it has spread all aspects of people's social activities, such as production, life, service, education and so on, just as air and water are invisible and ubiquitous.While giving people convenience, it also deeply affects people's activity habits.The TCP/IP protocol is not a perfect product, and no enterprise is immune from the vulnerability of the TCP / IP protocol in the presence of viruses and hackers invading all over the network.Once attacked, the more developed the network of enterprises to suffer more heavy losses.Therefore, the protection of the enterprise network has become the first task of network managers, and the research of network protection technology is in the ascendant.In this paper, the research work of network protection is carried out in this environment, which focuses on the analysis and detection of abnormal traffic in enterprise LAN by using data mining technology.Based on the analysis of abnormal traffic caused by virus infection, hacker intrusion and equipment failure in enterprise network, this paper studies the attribute selection of abnormal traffic, and puts forward a method of classifying abnormal traffic by using statistical and clustering algorithms.The abnormal model is used to classify it.Furthermore, an enterprise anomaly traffic detection and classification system is proposed, which can monitor the network, detect and identify the abnormal traffic, and help to adjust the network automatically.Finally, the system is tested in the actual network environment, and the accuracy of the system is 90%.
【学位授予单位】：上海交通大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.06;TP311.13

【参考文献】