基于Hurst参数评估的网络异常检测方法的研究

Research on method of network abnormal detection based on Hurst parameter estimation

真实的网络流量普遍存在统计上的自相似性,因此传统的基于泊松过程和马尔科夫模型等已不能反映实际测量的流量。针对传统检测方法存在的问题,将基于Hurst参数评估应用到DoS攻击检测中,由H参数变化来检测DoS攻击。通过分析DARPA 1998入侵检测数据表明,基于该法的Hurst参数评估能够检测到DoS攻击,此法比传统的基于特征匹配的网络流量异常检测法在检测精度上有较大提高。

Most researches regard the real traffic has self-similarity, so traditional model based possion or Markov can＇t adapt to the real traffic. In order to resolve these problems, the estimation is used based on Hurst parameter to detect DoS attack, researching on the affect of Hurst parameter change brought by DoS attack. By analyzing the 1998 DARPA intrusion detection evaluation dataset show that this method detect DoS attack, and is more reliable on the recognition of all kinds of DoS attack than any other method based on measure precision.