%0 Journal Article
%T 基于流量统计特征的潜在威胁用户挖掘方法<br>Method for threaten users mining based on traffic statistic characteristics
%A 李阳
%A 程雄
%A 童言
%A 陈伟
%A 秦涛
%A 张剑
%A 徐明迪&lt
%A br&gt
%A LI Yang
%A CHENG Xiong
%A TONG Yan
%A CHEN Wei
%A QIN Tao
%A ZHANG Jian
%A XU Ming-di
%J 山东大学学报（理学版）
%D 2018
%R 10.6040/j.issn.1671-9352.2.2017.082
%X 摘要： 为有效的从网络中挖掘出潜在威胁用户,提出了一种基于网络流量统计特征的异常用户挖掘方法。通过分析用户的网络流量,归纳出刻画网络流量集合的13个特征属性,包含网络流大小、数据包大小、数据包持续时间、数据包对称度等。在此基础上采用熵权决策法对每个特征选取合适的权重,计算出用户的行为威胁度,根据威胁度的大小和预先定义的阈值,将用户归为不同的威胁度分类等级。真实网络流量的实验结果显示,所提出的方法能够准确的实现潜在威胁的挖掘。<br>Abstract: With the rapid development and widely used of computer networks, potential threats mining become more and more important. To mine potential threats and solve the challenge posed by signature matching based methods, an abnormal behavior mining method based on statistical characteristics of network traffic was proposed. Firstly, 13 attributes were extracted to capture the traffic characterization exactly, including network flow size, packet size, packet duration, packet symmetry and so on. Secondly, the entropy was employed to select appropriate weight for different attributes. Finally, user behavior threaten degree are obtained and the users were divided into different groups based on the threaten degree. The experimental results based on the actual network traffic verify that the method proposed can achieve the goal of potential threat mining
%K 网络用户管理
%K 异常用户行为挖掘
%K 网络流量统计特征
%K 网络安全监控
%K &lt
%K br&gt
%K abnormal user behavior mining
%K network security monitoring
%K statistical characteristics of network traffic
%K network user management
%U http://lxbwk.njournal.sdu.edu.cn/CN/10.6040/j.issn.1671-9352.2.2017.082