Research On Website Service Anomaly Detection Technology Based On Clustering Analysis

Network measuring is a key technique which can understand network performance and network workflow pattern.With the fast development of network techniques and Internet applications,the reliability of network communications is becoming more and more important.However,there is a huge gap between network service quality and users’ expectation,so it is quite important to measure and analyse network performance.In the previous network measurement study,studiers tested the network metrics include end-to-end delay,network bandwidth,packet loss rate and network topology structure in active or passive measurement way.However,many of them do not mine the relationship between these network metrics.In this project,network web service is our target role which is the most common Internet application service.We aim to mine the correlation between different web services at the network level abnormaly and then apply our website domain delay anomaly detect model.In order to establish and validate the above model,our study can be divided into three parts:data collection,model construction and model verification.Firstly,we do domain parsing to the Alexa Top 100 website list and do experiments on those websites including round-time-trip,packet loss and topology structure.Through analysis to network domain,DNS parsing and domain extraction and clustering,find out which content delivery network website domains are using.Secondly,detect anomaly of website domain delay based on the iForest algorithm.Then,cluster the anomaly by means of DBSCAN algorithm.Based on the clustering results of DBSCAN,an anomaly detection model of website domain name delay is constructed.Lastly,with experiments,we find that independent forest algorithm can detect delay anomaly effectively.The average AUC of domain name anomaly cluster using DBSCAN algorithm reaches 0.762,which can effectively cluster related domain anomalies.We can find out the relationships between website domains by clustering analysis and detect delay anomaly quickly by watching on a part of website domains rather than the whole domains.