基于支持向量机的网络流量异常检测

Network traffic anomaly detection based on support vector machine

提出了一种基于支持向量机的网络流量异常检测方法.分析了支持向量机的基本原理,结合网络流量异常检测的特点,讨论了异常检测的特征选择问题;提出了网络流量对称性、TCP报文SYN和SYN/ACK对称性以及协议分布等具有鲁棒性的特征参数,描述了数据的预处理方法.测试结果表明,所选特征参数可有效地检测网络攻击导致的流量异常变化,说明基于支持向量机的检测方法具有较好的泛化能力.

A network traffic anomaly detection mechanism is presented based on support vector machine (SVM). Theory of SVM is introduced first,and then feature selection is discussed in depth. Many features, including symmetry of network traffic, symmetry of SYN and SYN/ACK packets, protocol distribution, are introduced in network traffic anomaly detection.And preprocessing of data is explained in detail.Experimental results show that the selected features can be used to detect traffic anomaly incurred by network attacks,and the detection mechanism based on SVM has good capability of generalization.