基于Canopy-Kmeans算法的电力企业流量数据分析研究

Research on electric power enterprise flow data analysis based on Canopy-Kmeans algorithm

针对电力企业关键信息基础设施大量业务数据易遭受网络攻击的现象,基于各业务信息系统下已有的网络安全设备,通过辅助设备采集流量数据,采用Canopy-Kmeans算法进行数据分析研究。首先通过实验证明了Canopy-Kmeans算法在处理流量数据时,相比传统K-means算法,具有更好的聚类效果,准确率提高约11%;然后以采集到的电力关键业务系统的流量数据为基础,基于Canopy-Kmeans算法进行挖掘分析实验,完成相同类型流量数据的聚类,分析出攻击流量与业务流量的特征项,排除部分误报信息,合理开展网络安全防护工作。

Aiming at the phenomenon that a large number of business data of the key information infrastructure of electric power enterprises are vulnerable to network attacks,based on the existing network security equipment under each business information system,the flow data is collected through auxiliary equipment,and Canopy-Kmeans algorithm is used for data analysis and research.Firstly,through experiments,it is proved that the Canopy-Kmeans algorithm has a better clustering effect than the traditional K-means algorithm when processing flow data,and the accuracy rate is increased by about 11%.Then,the collected flow data of the power key business system is used,mining and analysis experiments are conducted based on the Canopy-Kmeans algorithm to complete the clustering of the same type of traffic data,analyze the characteristic items of attack traffic and business traffic,eliminate some misreporting information,and carry out network security protection work reasonably.