Behavior Similarity Awared Abnormal Service Identification Mechanism
In order to maintain network security, it is very important to identify services with abnormal behavior and take targeted measures to prevent abnormal behaviors. We propose abnormal service identification mechanism based on behavior similarity. This method proposes a formula for service behavior similarity calculation of flow ports for services with correlation. And then k-similarity clustering algorithm is proposed to find abnormal service behaviors. Meanwhile, we analyse outliers to improve the accuracy of clustering results. At last, the experimental results show that k-similarity clustering algorithm can differentiate abnormal services accurately.
KeywordsBehavior similarity Abnormal service K-similarity clustering algorithm
This work was financially supported by Research and Application on Intelligent Operation Management Technology in Voice Exchange Network (036000KK52160009) hosted by Power Grid Dispatching Control Center of Guangdong Power Grid Co., Ltd., China Southern Power Grid.
- 2.Parvat, T.J., Chandra, P.: Performance improvement of deep packet inspection for Intrusion Detection. In: Wireless Computing and Networking, pp. 224–228. IEEE (2015)Google Scholar
- 3.Zhou, Y., Wang, Y., Ma, X.: A service behavior anomaly detection approach based on sequence mining over data streams. In: International Conference on Parallel and Distributed Computing, Applications and Technologies. IEEE (2017)Google Scholar
- 4.Shi, Q., Xu, L., Shi, Z., Chen, Y., Shao, Y.: Analysis and research of the campus network service’s behavior based on k-means clustering algorithm. In: 2013 Fourth International Conference on Digital Manufacturing & Automation, pp. 196–201 (2013)Google Scholar
- 6.Cao, J., Chen, A., Widjaja, I., et al.: Online identification of applications using statistical behavior analysis. In: Global Telecommunications Conference, pp. 1–6. IEEE (2008)Google Scholar
- 8.Moore, A.W., Papagiannaki, K.: Toward the accurate identification of network applications. In: International Conference on Passive and Active Network Measurement, pp. 41–54. Springer (2005)Google Scholar
- 9.Nychis, G., Sekar, V., Andersen, D.G., Kim, H., Zhang, H.: An empirical evaluation of entropy-based traffic anomaly detection. In: Internet Measurement Conference, pp. 151–156 (2008)Google Scholar
- 10.Zhou, Y.J.: Behavior analysis based traffic anomaly detection and correlation analysis for communication networks. University of Electronic Science and Technology of China (2013)Google Scholar
- 11.Wei, S., Mirkovic, J., Kissel, E.: Profiling and clustering internet hosts. In: International Conference on Data Mining, Las Vegas, Nevada, USA, pp. 269–275. DBLP (2006)Google Scholar
- 13.Gordeev, M.: Intrusion detection techniques and approaches. Comput. Commun. 25(15), 1356–1365 (2008)Google Scholar
- 14.Rajaraman, A., Ullman, J.D.: Bigdata: large scale data mining and distributed processing. China Sci. Technol. Inf. (22), 26 (2012)Google Scholar