基于改进密度峰值聚类的异常流量检测

Abnormal Traffic Detection Based on Improved Density Peaks Clustering

针对网络异常流量检测技术准确率较低、簇的误划分等问题,提出基于改进密度峰值聚类算法的网络异常流量检测方案;首先对网络流量数据进行预处理和分组乱序,然后计算相应属性值并利用局部密度发现簇中心点,最后采用一种新的标签传递方式形成相应的簇群直至处理完所有数据。结果表明,相对于k均值算法和具有噪声的基于密度的聚类算法,基于改进的密度峰值聚类算法提升了网络异常流量的检测准确率,综合性能较优。

Aiming at the problems of low accuracy and cluster misclassification of network abnormal traffic detection technology, a network abnormal traffic detection scheme based on improved density peaks clustering algorithm was proposed. Firstly, the network traffic data were preprocessed and grouped out of order, then the corresponding attribute values were calculated and the local density was used to find the cluster center points. Finally, a new label transfer mode was used to form the corresponding cluster group until all of the data were processed. The results show that compared with k-means algorithm and density-based spatial clustering of applications with noise, the improved density peaks clustering algorithm improves detection accuracy of network abnormal traffic, and the comprehensive performance is better.