中图分类号：TP309 文献标识码：ADOI:10.19358/j.issn.2097-1788.2025.02.001
引用格式：尤刚，徐蕾，李美鹏，等. 基于机器学习和规则的网络异常流量检测研究［J］.网络安全与数据治理，2025，44（2）：1-9.

Research on abnormal network traffic detection based on machine learning and rule-based methods

Abstract：The mainstream methods of network abnormal traffic detection are machine learning-based and rule matching-based. The former can detect unknown abnormal traffic, and the latter can accurately point out the type of attack. In order to combine the advantages of the two, this paper uses a hybrid method to realize the network abnormal traffic detection system. The system is equipped with two filters. The first filter uses the stream clustering algorithm for preliminary filtering, and the second filter uses the open source tool Suricata for fine identification. Based on DenStream algorithm, this paper proposes a flow clustering algorithm DenStream-DRT, which can dynamically determine the radius threshold according to the change of the proportion of abnormal traffic in the network. In addition, in order to improve the problem that Suricata cannot recognize unknown abnormal traffic, this paper proposes a generation algorithm PCRG-Apriori with payload constraint rules based on Apriori. Finally, the rule-based network intrusion detection system Suricata is integrated with the DenStream-DRT classifier to form a new network abnormal traffic detection system. Experimental results show that the integrated system has good performance in speed and accuracy.

Key words :network security; flow clustering algorithm; Apriori algorithm; Suricata; abnormal traffic detection system