A Network Misuse Detection Mechanism Based on Traffic Log

Setting up a large number of network connections and using up a lot of bandwidth are usually regarded as a network misuse behavior. It is significance for the network supervision to find and recognize these behaviors timely and correctly. This paper proposes a network misuse detection mechanism based on traffic log, combining the payload independent traffic classification technology. Through this mechanism, we can complete the selection of behavior features, and overcome the problems for both sample insufficiency and adaptability by using collaborative learning method. The experiment result shows that the method can separate 99% of the normal types from the misuse types, and the recognition rate of various misuse types can reach 80% or so, even be above 90% for some misuse types, which meets the application demand.