中圖分類號：TP309文獻標識碼：ADOI:10.19358/j.issn.2097-1788.2025.02.001
引用格式：尤剛，徐蕾，李美鵬，等. 基于機器學習和規則的網絡異常流量檢測研究［J］.網絡安全與數據治理，2025，44（2）：1-9.

Research on abnormal network traffic detection based on machine learning and rule-based methods

Abstract： The mainstream methods of network abnormal traffic detection are machine learning-based and rule matching-based. The former can detect unknown abnormal traffic, and the latter can accurately point out the type of attack. In order to combine the advantages of the two, this paper uses a hybrid method to realize the network abnormal traffic detection system. The system is equipped with two filters. The first filter uses the stream clustering algorithm for preliminary filtering, and the second filter uses the open source tool Suricata for fine identification. Based on DenStream algorithm, this paper proposes a flow clustering algorithm DenStream-DRT, which can dynamically determine the radius threshold according to the change of the proportion of abnormal traffic in the network. In addition, in order to improve the problem that Suricata cannot recognize unknown abnormal traffic, this paper proposes a generation algorithm PCRG-Apriori with payload constraint rules based on Apriori. Finally, the rule-based network intrusion detection system Suricata is integrated with the DenStream-DRT classifier to form a new network abnormal traffic detection system. Experimental results show that the integrated system has good performance in speed and accuracy.

Key words : network security; flow clustering algorithm; Apriori algorithm; Suricata; abnormal traffic detection system