Hurst参数变化在网络流量异常检测中的应用

An exploratory development on the Hurst parameter variety of network traffic abnormity signal

极端异常突发流量给互联网服务带来不可估量的损失,从技术角度讲,目前并没有适当的解决办法,关键在于防患未然.研究表明,真实网络流量普遍存在统计上的自相似性.针对传统检测方法存在的问题,通过对正常和异常网络流量信号的合成进行分析,并针对极端突发网络流量时的自相似性参数(Hurst参数)进行观测.试验研究表明,Hurst系数可以作为一种新的极端突发流量检测测度,为更好满足大规模网络高可靠性、实时性检测极端异常突发流量的需求提供了可能.

Most researches regard the real traffic has self- similarity. Extreme bursty traffic is the most menace to the Internet. Traditionary intrusion detection system （IDS） based microcosmic viewpoint can＇ t adapt itself to the evolution of the Internet. Real - world tests show overwhelming numbers of false alarms, miss alarms in IDS, and little success in filtering them out. This paper, aimed at DoS traffic, the performance of self - similarity traffic is analyzed. As results, Hurst parameter is the important presentiment measure for extreme bursty traffic to meet the continuing demand of real time abnormity detection of high - speed network.