一种用于异常检测的网络流量抽样方法

Novel Traffic Sampling Method for Anomaly Detection

为了减小抽样数据对网络异常检测的影响,提出了一种新的可变抽样率的网络流量抽样方法.通过利用哈希模式匹配算法,将到达的数据报文按流标识分类并记录下该报文在流中的位置,然后根据报文所属流的位置顺序减函数来设置不同的报文抽样概率.实验结果表明,所提方法增加了短流报文的抽样概率,解决了由于随机报文抽样方法偏向于长流抽样而导致的网络异常丢弃的问题,从而提高了异常检测的正确性.

In order to reduce the impact of sampled traffic on network anomaly detecting, a novel method with variable sampling rates in traffic sampling is proposed. By using the hash pattern matching algorithm, the incoming packets are classified by flow＇s ID and the packet＇s positions in the flow are recorded. Then, various sampling rates are specified according to the decreasing order function of the flow that the incoming packet belongs to. Experiment results show that the method increases the sampling rates to small flows, and resolves the problem that a great many network anomalies are discarded by the random packet sampling that has a bias towards large flows, and that the accuracy of anomaly detecting is improved.