Abstract: The disclosure relates to a method and device for identifying unknown traffic data based on a dynamic network environment. The method includes following steps. The known traffic in the network data is classified by using the known network traffic classification model, then the preliminary determination is performed according to a classification prediction result, network data preliminarily determined as the unknown traffic data is classified by using the adaptive clustering method, and then respective classes are identified by using a similarity coefficient estimation method so as to identify the classes of the malicious traffic and the normal traffic, that is, to further identify and learn the unknown traffic data, and transform it into known traffic data, and then the known network traffic classification model is trained and updated again with the new known traffic data.

Abstract: Disclosed are a network traffic analysis method and a device based on multi-source network traffic data. The method includes: deploying a pre-training classifier pool in a network stream data source; receiving multi-source network stream data at a current moment for each data source, classifying the multi-source network stream data through an online classifier, performing feature processing and transformation on data collected by each network stream data source at each preset time interval, and transmitting processed traffic data features and a feature transformation matrix to a traffic drift detection module. The traffic drift detection module contains historical concept data to detect a concept drift according to the traffic data features, the feature transformation matrix and the historical concept data; if the concept drift is detected, the online classifier deployed by multiple sources is reset. This method is used for continuous real-time and accurate analysis of the multi-source network traffic data.