Abstract: Through the analysis of network traffic, the network condition reflecting, abnormal behavior mining, network security situation awareness are enabled. Large scale network flow has mass data and wide range dimensions. Aiming at these features, in order to monitor network running situation and abnormity and improve the users’ awareness experience, this paper puts forward a kind of quasi real time flow reporting mechanism, designs a flow monitoring system based on 3D visualization, and combines with the flow abnormity mining method based on information entropy, through manual monitor and data mining, realizes abnormal flow visualization monitoring. It presents the monitoring system design scheme and implementation results, resolves the hard problem of network flow visualization, puts forward a kind of traffic situation scheme which is more intuitive, improves the users’ network situation awareness capability.

Key words: netflow, traffic collection, information entropy, abnormal flow, flow visualization, traffic monitor system

摘要： 通过分析网络流量可以反映网络运行情况，挖掘异常行为，感知网络安全态势。为了监测网络运行状况和流量异常情况，提高用户对网络流量态势的感知体验，针对大规模网络流量的数据量大和维度广的特点，提出了一种准实时流量数据报出机制，设计了基于三维可视化的流量监测系统，并结合基于信息熵的流量异常挖掘方法，通过人工监测和数据挖掘，实现了异常流量可视化监测，提高了异常检测成功率。给出了监测系统的设计方案和实现结果，解决了网络数据流从抽象到具象的可视化问题，提供了一种更加直观的态势展现方案，提高了用户对网络态势的感知认识能力。

关键词: 网络流, 流量采集, 信息熵, 异常流量, 流量可视化, 流量监测系统