基于层叠模型的网络流量异常检测方法

Network traffic anomaly detection method based on cascade model

进行网络流量异常检测,需要对正常流量行为建立准确的模型,根据异常流量与正常模型间的偏离程度作出判断。针对现有网络流量模型中自相似模型与多分形模型无法全面刻画流量特征的不足,提出了一种基于流量层叠模型分析的异常检测算法,采用层叠模型对整个时间尺度上的流量特征进行更准确的描述,并运用小波变换对流量的层叠模型进行估计,分析异常流量对模型估计的影响,提出统计累计偏离量进行异常流量检测的方法。仿真结果表明,该方法能够有效检测出基于自相似Hurst系数方法不能检测的弱异常以及未明显影响Hurst系数变化的异常流。

Traffic modeling as one of the ways to describe the normal behavior of network traffic was used to detect anomaly. Due to the self-similar model and multi-fractal model were inherently unable to capture the nature of traffic data in all time scales. This paper proposed a novel anomaly detection method based on cascade model analysis to describe the characteristic of traffic data more accurately. By studying the influences of anomalous traffic on the estimation of cascade model through wavelet transform modulus maxima, defined a cumulative deviation to estimate abnormal behavior. The simulation results show that this method is more sensitive to small anomalous traffic than detection methods based on H parameter analysis, and can accurately detect the anomalies which will not cause the Hurst parameter change evidently. Therefore, it is suite for the early stage detection of anomaly traffic.