关键词: 密度聚类, 微簇, 数据流, 孤立点检测

Abstract: Since online abnormal detection for backbone network with large flow currently is a research hotspot in network security field, an online network abnormal detection method is proposed to handle big data stream properly. The method processes big data stream into micro-clusters with density-based cluster method, and then micro-clusters absorb data stream directly to enhance the performance. The method regularly executes outlier detection process to find intrusion. The method does not require offline training process and can find any arbitrary clusters. It also supports big data stream and can balance between detection precision and resources with great performance. In the experiment, the prototype system finishes analysis task in 20 s over MIT Lincoln Laboratory LLS_DDOS_1.0 data, with 82% TPR and 6% FPR, which is equivalent to K-means.

Key words: density based clustering, micro-cluster, data stream, outlier detection