用于网络流量异常检测的数据采集方法的研究

Comparative Studies on two Methods of Data Collection Technology in Network Traffic Anomaly Detection

网络带给人们自由开放的同时，也带来不可忽视的安全风险，网络安全越来越成为人们关注的重点。作为网络安全研究领域中重要组成部分的网络流量异常检测技术研究也逐渐得到重视。在网络流量异常检测技术的研究中首先要进行网络流量的采集，然后对所采集的流量进行分析。网络流量的采集主要有两种比较流行的方法：一是基于包的采集方法，另一种是基于流的采集方法。在此主要将这两种数据采集方法进行对比研究，并得出了实验的结果。

Internet is free and open to people, and at the same time security risks can not be ignored. Network and information security has increasingly become the focus of our attention. As the important part of network security, network traffic anomaly detection technology gradually has been studied more and more. This paper mainly focus on two comparative studies on two methods of network traffic collection （one is packet-based data collection method, another is flow-based data collection method）, and gives the simulation results.