Abstract: In the process of network data processing and analysis, to solve the problems of large observation, poor interpretability and high difficulty of feature separation in traditional methods, the basic method of mapping network flow data from the original "flow" space to the "flow spectrum" space is proposed. The proposed method satisfies and thus the requirements of interpretability, observability, express ability and disposal of network behavior, and thus the downstream tasks can be weel completed. Based on the matrix compression principle of the low rank of high-dimensional objectives, the low-dimensional description of data is realized, and the mapping of the original network flow from "flow" to data characteristic matrix is completed. Based on matrix theory, information theory and metric space theory, multiple base spectral spaces that are expressed as isomorphically as possible are established to complete the separable isomorphic mapping of a characteristic matrix in "spectral" space. The background network flow, network threat, malicious attack and abnormal behavior are descrebed through the "flow spectrum", which is applied in network defense to improve the defense ability of cyberspace and provide new ideas for the defense system of cyberspace.

Key words: network traffic, flow spectrum, network defense, malicious behavior analysis, threat indication