Method, apparatus, and device for determining network anomaly behavior, and readable storage medium

An apparatus for determining a network anomaly behavior, comprising:

• an acquisition module, configured to acquire network data traffic in a target network, and determine each data packet contained in the network data traffic as a node of a complete graph, to construct a data complete graph;
• an optimization module, configured to optimize the data complete graph into a minimum spanning tree by means of Kruskal algorithm, and determine each node of the minimum spanning tree as a cluster center;
• a classification module, configured to classifying all data packets contained in the network data traffic based on cluster centers, to acquire data element sets corresponding to the cluster centers respectively;
• and
• a determination module, configured to determine an anomaly behavior in the target network based on a type of each of the data element sets, wherein the type of the data element set is determined by a type of a network attack contained in the network data traffic.