Detecting Abnormal Interactions among Intranet Groups Based on Netflow Data

Abstract

This paper proposes a method for detecting abnormal interactions among intranet groups based on netflow data. Firstly, the netflows of each group are aggregated, and two anomaly detection indicators are constructed, i.e., the group network traffic and the uncertainty of group network traffic distribution. Secondly, the time series of two anomaly detection indicators of each group are analyzed, and four prediction models are used for prediction. Finally, the best-performing model is selected as the prediction benchmark, and the difference between the predicted result and the real data is used to detect whether there is an interaction anomaly among groups. The experimental results show that the proposed method can effectively detect the abnormal interaction among groups in intranet.