基于信息熵的大规模网络流量异常检测

Network-wide Traffic Anomaly Detection Based on Entropy

提出了基于信息熵的大规模网络流量异常检测方法。该方法吸收了子空间方法的思想,并结合了K-means分类方法。以校园网为实验环境,应用基于信息熵的方法实现了网络流量异常检测的全过程。通过实验结果与应用标准子空间方法对测量数据分析结果的对比,证明了基于信息熵的大规模网络流量异常检测有着更高的检测精度。

This paper presents a new method of network-wide traffic anomaly detection. The method is based on entropy, which absorbs the idea of subspace method and combines K-means clustering method. In experiment environment of campus networks, the process of detecting network traffic anomalies is realized by applying the method based on entropy. Through the comparison of the results from the experiment and standard subspace method analysis of measurement data, it shows that network-wide traffic anomaly detection based on entropy has a higher detection precision.