会话属性优化的网络异常检测模型

Network anomaly detection model of optimizing session attributes

网络异常检测模型的检测性能在很大程度上依赖于网络会话属性,因网络会话属性在本质上刻画了网络行为模式。基于假设验证的实验分析手段,采用Tcpdump网络数据包作为实验数据源,在将数据包解析成具有基本属性的网络会话记录基础上,提出了一组简洁和精确的会话属性组合模式。实验结果表明,优化后的会话属性组合模式确实能够有效地提高网络异常检测模型对未知攻击的检测能力,采用基本属性、全部属性和任意部分属性训练检测模型,并不能获得良好的检测效果。

The detection performance of network anomaly detection model depends on network session attributes to a great extent because session attributes characterize network behavior profile. Tcpdump network traffic packets were regarded as the experiment data set. Traffic packets were resolved into session records with basic attributes. A concise and exact combination pattern for session attributes is proposed based on what-if experiment analysis. The experiment results indicate that the optimized pattern for session attributes improves the detection performance of anomaly detection model against unknown attacks. Better detection effects are not achieved by training detection model with basic, full and arbitrary attributes.