基于改进灰色聚类算法的云架构数据中心网络异常流量过滤算法

doi:10.11959/j.issn.1000-0801.2023137

摘要/Abstract

摘要：

为避免异常流量影响云架构数据中心网络安全运行，需要对云架构数据中心网络异常流量进行过滤。异常流量在不同信噪比和信道条件下过滤难度不同，为了在不同过滤条件下保障异常流量过滤效果，提出了基于改进灰色聚类算法的云架构数据中心网络异常流量过滤算法。通过时间-频率分析构建了云架构数据中心网络流量传输模型，采集网络流量序列；引入加权广义距离改进灰色聚类算法，利用改进的灰色聚类算法计算网络流量序列特征最佳聚类结果，实现流量序列特征提取；通过主成分分析法获取流量序列特征的主分量特征值，构建两个子空间，将流量特征以矩阵方式映射到两个子空间中；根据映射周期向量的平方预测误差与阈值计算结果，过滤异常流量。实验结果表明，该算法可通过聚类实现数据中心网络流量序列特征提取，在不同信噪比和信道条件下有效过滤异常流量；当网络信噪比为 25 dB 且流量在高斯信道中传输时，异常流量过滤效果更突出。

关键词: 改进灰色聚类, 云架构, 数据中心网络, 异常流量, 加权广义距离, 主成分分析

Abstract:

To avoid abnormal traffic affecting the safe operation of the cloud architecture data center network, it was necessary to filter the abnormal traffic of the cloud architecture data center network.The difficulty of filtering abnormal traffic varies under different signal-to-noise ratios and channel conditions.In order to ensure the filtering effect of abnormal traffic under different filtering conditions, a cloud architecture data center network abnormal traffic filtering algorithm based on improved grey clustering algorithm was proposed.A network traffic transmission model was built for cloud architecture data centers through time-frequency analysis, and network traffic sequences were collected.Weighted generalized distance was introduced to improve the grey clustering algorithm, and the improved grey clustering algorithm was used to calculate the optimal clustering results of network traffic sequence features, achieving traffic sequence feature extraction.The principal component eigenvalues of traffic sequence features were obtained through principal component analysis, two subspaces were constructed, and traffic features were mapped in a matrix manner to the two subspaces.Abnormal traffic was filtered based on the square prediction error of the mapping period vector and the threshold calculation results.The experimental results show that this algorithm can achieve feature extraction of data center network traffic sequences through clustering, effectively filtering abnormal traffic under different signal-to-noise ratios and channel conditions.When the signal-to-noise ratio of the network was 25 dB and the traffic was transmitted in a Gaussian channel, the filtering effect of abnormal traffic was more prominent.

Key words: improved grey clustering, cloud architecture, data center network, abnormal traffic, weighted generalized distance, principal component analysis

中图分类号:

TP393

周雪峰, 徐强, 谭艳婷, 郎嘉忆, 经航, 赵志强. 基于改进灰色聚类算法的云架构数据中心网络异常流量过滤算法[J]. 电信科学, 2023, 39(7): 90-98.

Xuefeng ZHOU, Qiang XU, Yanting TAN, Jiayi LANG, Hang JING, Zhiqiang ZHAO. Cloud architecture data center network abnormal traffic filtering algorithm based on improved grey clustering algorithm[J]. Telecommunications Science, 2023, 39(7): 90-98.

图/表 5

图1

表1

图2

表2

图3

参考文献 27

[1]	李炜东, 李宏慧 . 基于K-means和SVM的数据中心网络流量预测[J]. 内蒙古农业大学学报(自然科学版), 2022,43(2): 93-97.
	LI W D , LI H H . Prediction model of data center network traffic based on K-means and SVM[J]. Journal of Inner Mongolia Agricultural University (Natural Science Edition), 2022,43(2): 93-97.
[2]	麻文刚, 张亚东, 郭进 . 基于 LSTM 与改进残差网络优化的异常流量检测方法[J]. 通信学报, 2021,42(5): 23-40.
	MA W G , ZHANG Y D , GUO J . Abnormal traffic detection method based on LSTM and improved residual neural network optimization[J]. Journal on Communications, 2021,42(5): 23-40.
[3]	贺玉海, 周庆琨, 程埮晟 ,等. 基于改进K-Medoids的组合聚类算法及异常值检测研究[J]. 大连理工大学学报, 2022,62(4): 403-410.
	HE Y H , ZHOU Q K , CHENG T S ,et al. Research on combinatorial clustering algorithm and anomaly detection based on improved K-Medoids[J]. Journal of Dalian University of Technology, 2022,62(4): 403-410.
[4]	任艳, 徐春, 张蕾 ,等. 基于改进密度峰值聚类的异常流量检测[J]. 济南大学学报(自然科学版), 2022,36(5): 597-602.
	REN Y , XU C , ZHANG L ,et al. Abnormal traffic detection based on improved density peaks clustering[J]. Journal of University of Jinan (Science and Technology), 2022,36(5): 597-602.
[5]	郁滨, 熊俊 . 基于平衡迭代规约层次聚类的无线传感器网络流量异常检测方案[J]. 电子与信息学报, 2022,44(1): 305-313.
	YU B , XIONG J . A novel WSN traffic anomaly detection scheme based on BIRCH[J]. Journal of Electronics ＆ Information Technology, 2022,44(1): 305-313.
[6]	王胜, 唐超, 张凌浩 ,等. 面向IEC61850智能变电站的网络安全异常流量分析方法[J]. 重庆大学学报, 2022,45(1): 1-8.
	WANG S , TANG C , ZHANG L H ,et al. Research on network security abnormal flow analysis method for IEC61850 intelligent substation[J]. Journal of Chongqing University (Natural Science Edition), 2022,45(1): 1-8.
[7]	何欣峰, 邢伟 . 基于改进 RNN 的网络异常流量检测研究[J]. 无线互联科技, 2021,18(22): 21-23,53.
	HE X F , XING W . Research on network abnormal traffic detection based on improved RNN[J]. Wireless Internet Technology, 2021,18(22): 21-23,53.
[8]	胡向东, 张婷 . 基于时空融合深度学习的工业互联网异常流量检测方法[J]. 重庆邮电大学学报:自然科学版, 2022,34(6): 1056-1064.
	HU X D , ZHANG T . Abnormal traffic detection method for industrial Internet based on deep learning with time-space fusion[J]. Journal of Chongqing University of Posts and Telecommunications (Natural Science Edition), 2022,34(6): 1056-1064.
[9]	谢燕, 裴浪 . 基于SDN技术的数据中心网络异常流量检测算法[J]. 吉林大学学报(信息科学版), 2022,40(2): 240-246.
	XIE Y , PEI L . Research on abnormal traffic detection algorithm of data center network based on SDN technology[J]. Journal of Jilin University (Information Science Edition), 2022,40(2): 240-246.
[10]	段雪源, 付钰, 王坤 ,等. 基于多尺度特征的网络流量异常检测方法[J]. 通信学报, 2022,43(10): 65-76.
	DUAN X Y , FU Y , WANG K ,et al. Network traffic anomaly detection method based on multi-scale characteristic[J]. Journal on Communications, 2022,43(10): 65-76.
[11]	龚艳 . 面向公共卫生安全网络舆情预警的弱关联挖掘方法研究[J]. 情报科学, 2022,40(6): 19-24.
	GONG Y . Research on weak association mining method for public opinion early warning of public health safety network[J]. Information Science, 2022,40(6): 19-24.
[12]	杨月麟, 毕宗泽 . 基于深度学习的网络流量异常检测[J]. 计算机科学, 2021,48(S2): 540-546.
	YANG Y L , BI Z Z . Network anomaly detection based on deep learning[J]. Computer Science, 2021,48(S2): 540-546.
[13]	朱素霞, 龙翼飞, 孙广路 . 基于大流调度的软件定义数据中心网络负载均衡算法[J]. 计算机应用与软件, 2021,38(1): 27-32,75.
	ZHU S X , LONG Y F , SUN G L . Software-defined data center network load balancing algorithm based on large flows scheduling[J]. Computer Applications and Software, 2021,38(1): 27-32,75.
[14]	魏建行, 衣龙洋, 魏俊甫 . 基于数据挖掘的船舶通信网络流量异常识别方法[J]. 舰船科学技术, 2022,44(14): 147-150.
	WEI J H , YI L Y , WEI J F . Abnormal traffic identification method of ship communication network based on data mining[J]. Ship Science and Technology, 2022,44(14): 147-150.
[15]	张秋雁, 宋强, 张俊玮 ,等. 基于扩展面板大数据的电力经济特征提取新方法[J]. 电网与清洁能源, 2021,37(2): 64-70,78.
	ZHANG Q Y , SONG Q , ZHANG J W ,et al. A novel feature extraction method in power economic assessment research based on extraction panel data[J]. Advances of Power System＆Hydroelectric Engineering, 2021,37(2): 64-70,78.
[16]	周刚, 吴树霖, 张江龙 ,等. 基于拓扑链路识别的光网络流量数据合成算法[J]. 光通信研究, 2022(1): 31-36.
	ZHOU G , WU S L , ZHANG J L ,et al. Traffic data synthesis algorithm for optical network based on topological link recognition[J]. Study on Optical Communications, 2022(1): 31-36.
[17]	刘奕, 李建华, 陈玉 . 基于对偶分解的数据中心网络流量工程方法[J]. 计算机仿真, 2022,39(6): 346-350.
	LIU Y , LI J H , CHEN Y . Data center network traffic engineering method based on duality decomposition[J]. Computer Simulation, 2022,39(6): 346-350.
[18]	代荣荣, 李宏慧, 付学良 . 基于差分进化融合蚁群算法的数据中心流量调度机制[J]. 计算机应用, 2022,42(12): 3863-3869.
	DAI R R , LI H H , FU X L . Data center flow scheduling mechanism based on differential evolution and ant colony optimization algorithm[J]. Journal of Computer Applications, 2022,42(12): 3863-3869.
[19]	张帆, 谢光伟, 郭威 ,等. 基于拟态架构的内生安全云数据中心关键技术和实现方法[J]. 电信科学, 2021,37(3): 39-48.
	ZHANG F , XIE G W , GUO W ,et al. Key technologies and implementation methods of endogenous safety and security cloud data center based on mimic architecture[J]. Telecommunications Science, 2021,37(3): 39-48.
[20]	余少锋, 佘俊, 钟建栩 ,等. 融合机器学习的云监控数据分析仿真[J]. 自动化仪表, 2022,43(3): 75-78.
	YU S F , SHE J , ZHONG J X ,et al. Analysis and simulation of cloud monitoring data based on machine learning[J]. Process Automation Instrumentation, 2022,43(3): 75-78.
[21]	樊锐轶, 高志, 曹海门 ,等. 基于灰色理论的电力监控数据多因素预测模型[J]. 电子器件, 2022,45(2): 427-431.
	FAN R Y , GAO Z , CAO H M ,et al. Multi-factor prediction model of power monitoring data based on grey theory[J]. Chinese Journal of Electron Devices, 2022,45(2): 427-431.
[22]	赵杉 . 云平台安全监控大数据集群调度容错控制仿真[J]. 计算机仿真, 2021,38(7): 486-490.
	ZHAO S . Simulation of scheduling fault tolerant control of big data cluster for security monitoring of cloud platform[J]. Computer Simulation, 2021,38(7): 486-490.
[23]	郑震, 查冰婷, 谭钰然 ,等. 基于灰色关联分析的三维点云识别算法[J]. 南京理工大学学报(自然科学版), 2022,46(6): 679-687.
	ZHENG Z , ZHA B T , TAN Y R ,et al. 3D point cloud recognition algorithm based on grey relational analysis[J]. Journal of Nanjing University of Science and Technology, 2022,46(6): 679-687.
[24]	张苏颖, 竺兴妹, 许曙青 . 基于灰色关联分析的传感器节点连通算法[J]. 传感技术学报, 2022,35(1): 127-131.
	ZHANG S Y , ZHU X M , XU S Q . Sensor node connectivity algorithm based on grey relational analysis[J]. Chinese Journal of Sensors and Actuators, 2022,35(1): 127-131.
[25]	智春, 杨呈永, 崔建明 . 基于LMD 改进GPR优化的网络流量预测[J]. 桂林理工大学学报, 2022,42(1): 236-241.
	ZHI C , YANG C Y , CUI J M . Network traffic prediction based on LMD improved GPR optimization[J]. Journal of Guilin University of Technology, 2022,42(1): 236-241.
[26]	翟慧鹏, 尚晓凯, 韩龙龙 ,等. 基于大数据技术的网络安全分析研究[J]. 现代电子技术, 2022,45(16): 93-98.
	ZHAI H P , SHANG X K , HAN L L ,et al. Research on network security analysis based on big data technology[J]. Modern Electronics Technique, 2022,45(16): 93-98.
[27]	丁建立, 刘亦舟, 梁婷婷 . 基于特征约简与多层极限学习机的网络流量异常检测[J]. 现代电子技术, 2022,45(5): 84-89.
	DING J L , LIU Y Z , LIANG T T . Network traffic anomaly detection based on feature reduction and multi-layer extreme learning machine[J]. Modern Electronics Technique, 2022,45(5): 84-89.

序号	流量特征聚类结果
1	protocol_type
2	service
3	flag
4	hot
5	logged_in
6	is_guest_login
7	count
8	srv_rerror_rate
9	dst_host_count
10	dst_host_srv_count
11	dst_host_same_srv_rate
12	dst_host_srv_diff_host_rate
13	dst _host_srv_serror_rate

流量类型	攻击类型	过滤数量	未过滤数量
正常流量	—	125	7 875
异常流量	DoS	1 352	98
	R2L	142	8
	U2R	194	6
	Probing	190	10