Research On Network Behavior Analysis Based On Sampling Stream Data Mining

With the rapid development and popularization of high-speed network, the network structure becomes increasingly complex. The business on the Internet become more and more extensive, and highly need the network reliability and availability. The network of security threats has become diverse. Network Behavior Analysis can identify internal anomalies and external attacks. It acts as a new means for detecting network anomalies.With the study in depth on data stream mining, data stream mining method is used in network anomaly behavior analysis, aimed to build an efficient framework. The effectiveness of sFlow technology is analysised to providing the basis for the research. The data stream mining has been studied to illustrate the advantage in high-speed, continuous, order, and changing network environment. Subsequently, Network behavior analysis model and system architecture is proposed, its data preparation module, the network rules of conduct mining and management module designing and functional components are degined. Data flow clustering algorithm is improved, using density-based two-stage clustering, and adding time decay mechanism. It will more efficiently reflect the changes.The network behavior analysis program and algorithm is applied to Campus Network security management practice, the results show that the method makes up for the deficiencies of traditional intrusion detection technology that can effectively reduce the burden of network data analysis, and improve the speed and real-time response, with a certain application and popularization.