Behavior Similarity Awared Abnormal Service Identification Mechanism

  • Yingyan Jiang
  • Yezhao Chen
  • Feifei Hu
  • Guoyi Zhang
  • Peng LinEmail author
Conference paper
Part of the Advances in Intelligent Systems and Computing book series (AISC, volume 905)


In order to maintain network security, it is very important to identify services with abnormal behavior and take targeted measures to prevent abnormal behaviors. We propose abnormal service identification mechanism based on behavior similarity. This method proposes a formula for service behavior similarity calculation of flow ports for services with correlation. And then k-similarity clustering algorithm is proposed to find abnormal service behaviors. Meanwhile, we analyse outliers to improve the accuracy of clustering results. At last, the experimental results show that k-similarity clustering algorithm can differentiate abnormal services accurately.


Behavior similarity Abnormal service K-similarity clustering algorithm 



This work was financially supported by Research and Application on Intelligent Operation Management Technology in Voice Exchange Network (036000KK52160009) hosted by Power Grid Dispatching Control Center of Guangdong Power Grid Co., Ltd., China Southern Power Grid.


  1. 1.
    Guo, Y.T., Gao, Y., Wang, Y.: DPI & DFI: a malicious behavior detection method combining deep packet inspection and deep flow inspection. Procedia Eng. 174, 1309–1314 (2017)CrossRefGoogle Scholar
  2. 2.
    Parvat, T.J., Chandra, P.: Performance improvement of deep packet inspection for Intrusion Detection. In: Wireless Computing and Networking, pp. 224–228. IEEE (2015)Google Scholar
  3. 3.
    Zhou, Y., Wang, Y., Ma, X.: A service behavior anomaly detection approach based on sequence mining over data streams. In: International Conference on Parallel and Distributed Computing, Applications and Technologies. IEEE (2017)Google Scholar
  4. 4.
    Shi, Q., Xu, L., Shi, Z., Chen, Y., Shao, Y.: Analysis and research of the campus network service’s behavior based on k-means clustering algorithm. In: 2013 Fourth International Conference on Digital Manufacturing & Automation, pp. 196–201 (2013)Google Scholar
  5. 5.
    Parwez, M.S., Rawat, D.B., Garuba, M.: Big data analytics for service-activity analysis and service-anomaly detection in mobile wireless network. IEEE Trans. Ind. Inform. 13(4), 2058–2065 (2017)CrossRefGoogle Scholar
  6. 6.
    Cao, J., Chen, A., Widjaja, I., et al.: Online identification of applications using statistical behavior analysis. In: Global Telecommunications Conference, pp. 1–6. IEEE (2008)Google Scholar
  7. 7.
    Bernaille, L., Teixeira, R., Akodkenou, I., Soule, A., Salamatian, K.: Traffic classification on the fly. ACM SIGCOMM Comput. Commun. Rev. 36(2), 23–26 (2006)CrossRefGoogle Scholar
  8. 8.
    Moore, A.W., Papagiannaki, K.: Toward the accurate identification of network applications. In: International Conference on Passive and Active Network Measurement, pp. 41–54. Springer (2005)Google Scholar
  9. 9.
    Nychis, G., Sekar, V., Andersen, D.G., Kim, H., Zhang, H.: An empirical evaluation of entropy-based traffic anomaly detection. In: Internet Measurement Conference, pp. 151–156 (2008)Google Scholar
  10. 10.
    Zhou, Y.J.: Behavior analysis based traffic anomaly detection and correlation analysis for communication networks. University of Electronic Science and Technology of China (2013)Google Scholar
  11. 11.
    Wei, S., Mirkovic, J., Kissel, E.: Profiling and clustering internet hosts. In: International Conference on Data Mining, Las Vegas, Nevada, USA, pp. 269–275. DBLP (2006)Google Scholar
  12. 12.
    Xu, K., Wang, F., Gu, L.: Behavior analysis of internet traffic via bipartite graphs and one-mode projections. IEEE/ACM Trans. Netw. 22(3), 931–942 (2014)CrossRefGoogle Scholar
  13. 13.
    Gordeev, M.: Intrusion detection techniques and approaches. Comput. Commun. 25(15), 1356–1365 (2008)Google Scholar
  14. 14.
    Rajaraman, A., Ullman, J.D.: Bigdata: large scale data mining and distributed processing. China Sci. Technol. Inf. (22), 26 (2012)Google Scholar

Copyright information

© Springer Nature Switzerland AG 2020

Authors and Affiliations

  • Yingyan Jiang
    • 1
  • Yezhao Chen
    • 1
  • Feifei Hu
    • 2
  • Guoyi Zhang
    • 2
  • Peng Lin
    • 3
    Email author
  1. 1.Power Grid Dispatching Control Center of Guangdong Power Grid Co., Ltd.GuangzhouChina
  2. 2.Power Grid Dispatching Control Center of China Southern Power GridGuangzhouChina
  3. 3.Beijing Vectinfo Technologies Co., Ltd.BeijingChina

Personalised recommendations