基于复杂网络挖掘的用户行为感知机制

用户行为感知是进行网络管理、安全检测以及应用趋势分析的基础.针对基于流量统计特征检测方法具有计算复杂度高和"概念漂移"的缺陷,提出了一种基于用户复杂网络图的用户行为感知机制算法(UBP-CN).算法将用户标识{IP,Port}和用户交互分别抽象为一个点和一条边,构建了用户复杂网络图;应用社团挖掘算法将复杂网络图划分为互不相交的行为子簇,使得用户之间的通信抽象为一种"社会团体";通过定义基于相对熵的"用户行为模式"(UBM),表征了各个子簇背后表现出的行为特性,并使用"UBM+Port"对各个子簇进行标签映射,实现了用户行为的有效感知.仿真结果表明:在不牺牲用户行为分类准确率的前提下,算法不仅能克服"概念漂移"问题,还能有效降低算法的计算复杂度.

User behavior perception based on mining complex network

User behavior perception is fundamental to network management, security diagnosis and application prediction analysis. Considering that detecting algorithms using flow statistics have deficiencies of high complexity and concept drift, a novel scheme called user behavior perception based on minging complex network （UBP-CN） is proposed. UBP-CN constructs a host complex graph with abstracting every node and every edge from the user identifier IP, Port and communications between users. Based on the theory of community detection, the host complex graph is partitioned into mutually exclusive behavior clusters which represent social communities. To nicely depict implicit traffic characteristics for every intersected community, user behavior mode （UBM） is defined by introducing the idea of relative entropy. Both UBM and protocol port are utilized to map the behavior label to every host. Experiments demonstrate that UBP-CN can circumvent the concept shift problem and gracefully ameliorate computational complication without sacrificing accuracy.