计算机工程与应用 ›› 2015, Vol. 51 ›› Issue (12): 88-93.

• 网络、通信、安全 • 上一篇    下一篇

基于信息熵的网络流异常监测和三维可视方法

陈  鹏,司  健,于子桓,王蔚旻   

  1. 中国电子科技集团公司 第二十八研究所 第一研究部,南京 210007
  • 出版日期:2015-06-15 发布日期:2015-06-30

Flow abnormity supervision based on information entropy and 3D visualization

CHEN Peng, SI Jian, YU Zihuan, WANG Weimin   

  1. The First Research Department, No.28 Research Institute, China Electronics Technology Group Corporation, Nanjing 210007, China
  • Online:2015-06-15 Published:2015-06-30

摘要: 通过分析网络流量可以反映网络运行情况,挖掘异常行为,感知网络安全态势。为了监测网络运行状况和流量异常情况,提高用户对网络流量态势的感知体验,针对大规模网络流量的数据量大和维度广的特点,提出了一种准实时流量数据报出机制,设计了基于三维可视化的流量监测系统,并结合基于信息熵的流量异常挖掘方法,通过人工监测和数据挖掘,实现了异常流量可视化监测,提高了异常检测成功率。给出了监测系统的设计方案和实现结果,解决了网络数据流从抽象到具象的可视化问题,提供了一种更加直观的态势展现方案,提高了用户对网络态势的感知认识能力。

关键词: 网络流, 流量采集, 信息熵, 异常流量, 流量可视化, 流量监测系统

Abstract: Through the analysis of network traffic, the network condition reflecting, abnormal behavior mining, network security situation awareness are enabled. Large scale network flow has mass data and wide range dimensions. Aiming at these features, in order to monitor network running situation and abnormity and improve the users’ awareness experience, this paper puts forward a kind of quasi real time flow reporting mechanism, designs a flow monitoring system based on 3D visualization, and combines with the flow abnormity mining method based on information entropy, through manual monitor and data mining, realizes abnormal flow visualization monitoring. It presents the monitoring system design scheme and implementation results, resolves the hard problem of network flow visualization, puts forward a kind of traffic situation scheme which is more intuitive, improves the users’ network situation awareness capability.

Key words: netflow, traffic collection, information entropy, abnormal flow, flow visualization, traffic monitor system