基于二分图模型的主机行为分析

Host Behavior Analysis Based on Bipartite Graph Model

近年来,随着网络规模的不断增长、网络应用的多样化、加密数据传输技术的逐步成熟,终端主机行为的分析也越来越复杂。文章提出一种基于图模型的主机行为分析方法,利用社区检测来发现具有相似行为的终端主机,并通过引入Spark GraphX技术使得该方法具备可扩展性和实用性。实验结果表明,该方法可以有效分析具有相似行为的主机群体,降低了大规模网络异常检测的复杂度。

In recent years,with the continuous increase of the network scale,diversification of network applications and the gradual maturity of the encrypted data transmission technology,the analysis of the terminal host behavior have become more and more complicated.This paper presents a graph-based approach that uses community detection to discover end hosts with similar behavior.And the approach are scalable and practical by introducing Spark GraphX technology.The experimental results show that this method has strong validity and reference in the data analysis based on NetFlow,and can be referenced for large-scale network analysis.