A Method for Detecting Large-scale Network Anomaly Behavior

Abstract

Abstract.A clustering model identification method based on the statistics has been proposed to improve the ability to detect scale anomaly behavior of the traditional anomaly detection technology. By analyzing the distribution of the distance between each clustering objects and clustering center to identify anomaly behavior. It ensures scale abnormal behavior identification while keeping the processing mechanism of the traditional anomaly detection technology for isolation, and breaking through the limitation of the traditional anomaly detection method assumes that abnormal data is the isolation. In order to improve the precision of clustering, we correct the Euclidean distance with the entropy value method to weight the attribute of the data, it optimizes the similarity evaluating electric of the nearest neighbor clustering algorithm, and simulated. Experimental results show that the statistical method and the improved clustering method is more efficient and self-adaptive.

Optimal Network Defense Strategy Selection Method: A Stochastic Differential Game Model

“…However, static defense technology represented by intrusion detection and antivirus software is difficult to cope with complex and changeable network attacks. How to analyze network attack behavior, deploy security defense system, and enhance system defense capability has become an urgent problem to be solved [3].…”