Abstract
Focus on the difficulty of large-scale network traffic monitoring and analysis, this paper proposed the concepts of Group Behavior Flow model to aggregate traffic packets and perform abnormal behavior detection. Based on the flow model the pivotal traffic metrics can be extracted while the number of flow records are reduced significantly. Secondly, we employ the graph model to capture the traffic feature distribution between different group users. And optical flow analysis methods are proposed to extract the dynamic behavior changing features between different groups and achieve the goal of abnormal behavior detection. The experimental results based on actual traffic traces show that the methods proposed in this paper can capture the traffic features effectually in the current 10 Gbps network environment, and achieve the goal of abnormal behavior detection and abnormal source location, which is very important for traffic management.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Baldi, M., Baralis, E., Risso, F.: Data mining techniques for effective and scalable traffic analysis. In: IEEE International Symposium on Integrated Network Management, 15–19 May 2005, pp. 105–118 (2005)
Zhou, A., Guang, C., Guo, X.: High-speed network traffic measurement methods. J. Softw. 25(1), 135–153 (2014)
Zhang, B., Yang, J., Wu, J.: Survey and analysis on the internet traffic model. J. Softw. 22(01), 115–131 (2011)
Wang, J., Rossell, D., Cassandras, C.G., et al.: Network anomaly detection: a survey and comparative analysis of stochastic and deterministic methods. In: Proceedings of the 52nd IEEE Conference on Decision and Control, Florence, Italy (2013)
CISCO NetFlow: Cisco systems, Inc. (2004). http://www.cisco.com/en/US/products/ps6601/products_white_paper09186a00800a3db9.shtml
Kim, S.S., Reddy, A.L.N.: A study of analyzing network traffic as images in real-time. In: 24th Annual Joint Conference of the IEEE Computer and Communications Societies, 13–17 March 2005, vol. 3, pp. 2056–2067 (2005)
Lakhina, A., Papagiannaki, K., Crovella, M., et al.: Structural analysis of network traffic flows. In: Proceedings of the Joint International Conference on Measurement and Modeling Of Computer Systems, pp. 61–72 (2004)
Freedman, M.J., Vutukuru, M., Feamster, N., et al.: Geographic locality of IP prefixes. In: Proceedings of the ACM Internet Measurement Conference Berkeley, CA, pp. 153–158, October 2005
Wang, X., Zhang, G.: Research on moving object detection method based on optical flow. J. Comput. Eng. Appl. 40(1), 43–46 (2004)
Acknowledgments
The research presented in this paper is supported in part by the Natural Science Foundation of China (61502438, 61672026), Natural Science Foundation of Shaanxi Province (2016JM6040), and Chinese Defense Advance Research Program (B0820132036).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering
About this paper
Cite this paper
Tong, Y., Zhang, J., Chen, W., Xu, M., Qin, T. (2018). Dynamic Group Behavior Analysis and Its Application in Network Abnormal Behavior Detection. In: Li, B., Shu, L., Zeng, D. (eds) Communications and Networking. ChinaCom 2017. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 237. Springer, Cham. https://doi.org/10.1007/978-3-319-78139-6_30
Download citation
DOI: https://doi.org/10.1007/978-3-319-78139-6_30
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-78138-9
Online ISBN: 978-3-319-78139-6
eBook Packages: Computer ScienceComputer Science (R0)