Traffic anomaly detection method in networks based on improved clustering algorithm - Hong-cheng LI; Xiao-ping WU; Hong-hai JIANG (网络与信息安全学报)
To solve the problem that traditional traffic abnormal detection methods were not accurate enough,a traf-fic anomaly detection method based on improved k-means was proposed.All kinds of network traffic data were pre-processed to make k-means algorithm can apply to enumeration data detection.Then a features selection method was pro-posed with the analysis of the distribution of network traffic data to avoid the distance useless caused by too much fea-tures.Furthermore,the clustering process of K clusters was optimized based on dichotomy,aiming to reduce the effects of initial clusters centers selection.Simulation results demonstrate the effectiveness of the algorithm.