MUCM: Multilevel User Cluster Mining Based on Behavior Profiles for Network Monitoring
MUCM: Multilevel User Cluster Mining Based on Behavior Profiles for Network Monitoring
复制标题
DOI：
10.1109/jsyst.2014.2350019
复制
发表时间：
2015-12
影响因子：
4.4
通讯作者：
Tao Qin;X. Guan;Chenxu Wang;Zhaoli Liu
中科院分区：
文献类型：
--
作者：
Tao Qin;X. Guan;Chenxu Wang;Zhaoli Liu
掌握用户的行为特征对有效的网络管理和安全监控具有重要意义。在本文中，我们开发了一个新的框架，称为多级用户簇挖掘（MUCM）来衡量用户在不同网络前缀级别下的行为相似度。关注不同网络前缀下的聚合流量行为，不仅可以减少流量数量，还可以揭示一组具有相似行为的用户的详细模式。首先，我们采用双向流和二部图来模拟大规模网络中的网络流量特征。然后提取四个流量特征来描述用户的行为概况。其次，采用一种有效的权重因子可调方法计算用户行为相似度，并利用熵增益自适应选择权重因子；利用行为相似度度量，采用一种基于κ均值的简单聚类算法对用户进行基于行为特征的聚类。最后，我们研究了行为聚类在分析网络流量模式和检测异常行为方面的应用。利用中国教育和科研网络西北区域中心采集的实际交通轨迹进行了大量实验，验证了该方法的有效性，聚类结果可用于流量控制和交通安全监控。
Mastering user's behavior character is important for efficient network management and security monitoring. In this paper, we develop a novel framework named as multilevel user cluster mining (MUCM) to measure user's behavior similarity under different network prefix levels. Focusing on aggregated traffic behavior under different network prefixes cannot only reduce the number of traffic flows but also reveal detailed patterns for a group of users sharing similar behaviors. First, we employ the bidirectional flow and bipartite graphs to model network traffic characteristics in large-scale networks. Four traffic features are then extracted to characterize the user's behavior profiles. Second, an efficient method with adjustable weight factors is employed to calculate the user's behavior similarity, and entropy gain is applied to select the weight factor adaptively. Using the behavior similarity metrics, a simple clustering algorithm based on κ-means is employed to perform user clustering based on behavior profiles. Finally, we examine the applications of behavior clustering in profiling network traffic patterns and detecting anomalous behaviors. The efficiency of our methods is verified with extensive experiments using actual traffic traces collected from the northwest region center of China Education and Research Network (CERNET), and the cluster results can be used for flow control and traffic security monitoring.