Switch attack defense method for judging deviation behavior based on historical statistics

The invention relates to a network security protocol, in particular to a switch attack defense method for judging deviation behaviors based on historical statistics. According to the method, the real-time access behaviors are investigated on the basis of the characteristics of the historical access behaviors, if obviously different behaviors occur in the real-time access behaviors, it is considered that attack risks exist, and the judgment efficiency can be improved; through a clustering statistics method, judgment interference caused by individual differentiated access behaviors is eliminated, and the judgment accuracy of attack behaviors is improved; machine attacks are judged through a mode of calculating a difference set after clustering, the machine attacks in the prior art can have certain regularity, preset attack characteristics can be shown under clustering statistics even through random attack behaviors, and the machine attacks can be judged through difference set calculation after clustering. Accor