城域网应用层流量异常检测与分析

Detecting traffic anomalies at application layer in metro area network

首先对流量数据按应用层协议进行分类分析,采用小波分析对原始流量数据进行去噪处理,建立流量数据矩阵;然后采用主元分析(PCA)方法进行流量建模;在此基础上,通过SPE统计量的控制图能快速检测出流量异常,结合SPE统计量的贡献图可以分析出导致异常的主要原因。实验结果表明,小波去噪能降低异常检测的误警率,SPE贡献图可有效分析流量异常的原因。

This paper constructed a traffic data matrix with the application layer metrics provided by the measurement system developed by ourselves. Applied wavelet analysis to deal with the noise of raw data, and then used PCA method to model the traffic. Experiments show that traffic anomalies can be effectively monitored with SPE statistic, and the main causes of the anomalies can be found out with contribution plot of SPE statistic.