This study uses NetFlowthe supervised learning algorithm Xgboost to analyze network traffic.
Periodical network scanningbrute force behavior are used to improve detection ratedetect attacks as early as possible in real time.
NetFlow information is combined with the proposed feature extraction to enable the current detection to be performed during periodic detection.

Machine learning algorithm (XGBoost) can eliminate effect of the fixed threshold. This method can effectively improve the detection ratedetect more effectively on non-well-known port attacks.

In the machine learning method, the feature of flow relationship is selected,the information provided by the IP list will be used to effectively detect the attack. The system had already run on campus network to detect the abnormal traffic. In the future, it expected to provide to network managersSOC to detect network attacks.