Communications and Networking. 12th International Conference, ChinaCom 2017, Xi’an, China, October 10-12, 2017, Proceedings, Part II

Research Article

Dynamic Group Behavior Analysis and Its Application in Network Abnormal Behavior Detection

  • @INPROCEEDINGS{10.1007/978-3-319-78139-6_30,
        author={Yan Tong and Jian Zhang and Wei Chen and Mingdi Xu and Tao Qin},
        title={Dynamic Group Behavior Analysis and Its Application in Network Abnormal Behavior Detection},
        proceedings={Communications and Networking. 12th International Conference, ChinaCom 2017, Xi’an, China, October 10-12, 2017, Proceedings, Part II},
        proceedings_a={CHINACOM},
        year={2018},
        month={4},
        keywords={Group user model Dynamic behavior Optical flow analysis Abnormal detection},
        doi={10.1007/978-3-319-78139-6_30}
    }
    
  • Yan Tong
    Jian Zhang
    Wei Chen
    Mingdi Xu
    Tao Qin
    Year: 2018
    Dynamic Group Behavior Analysis and Its Application in Network Abnormal Behavior Detection
    CHINACOM
    Springer
    DOI: 10.1007/978-3-319-78139-6_30
Yan Tong1,*, Jian Zhang1,*, Wei Chen1,*, Mingdi Xu1,*, Tao Qin2,*
  • 1: Wuhan Digital Engineering Institute
  • 2: Xi’an Jiaotong University
*Contact email: tongyan.cherish@139.com, richardxx@126.com, 772382203@qq.com, mingdixu@163.com, qin.tao@mail.xjtu.edu.cn

Abstract

Focus on the difficulty of large-scale network traffic monitoring and analysis, this paper proposed the concepts of Group Behavior Flow model to aggregate traffic packets and perform abnormal behavior detection. Based on the flow model the pivotal traffic metrics can be extracted while the number of flow records are reduced significantly. Secondly, we employ the graph model to capture the traffic feature distribution between different group users. And optical flow analysis methods are proposed to extract the dynamic behavior changing features between different groups and achieve the goal of abnormal behavior detection. The experimental results based on actual traffic traces show that the methods proposed in this paper can capture the traffic features effectually in the current 10 Gbps network environment, and achieve the goal of abnormal behavior detection and abnormal source location, which is very important for traffic management.