骨干通信网多流多特征流量异常检测

Traffic anomaly detection using multi-flows and multi-parameters in backbone network

异常流量的隐蔽性和异常检测的实时性是骨干通信网流量异常检测面临的两大难题,为此提出一种多流多特征的流量异常检测方法:将网络业务量细分为多个与网络异常密切相关的子流,在各子流中分别提取多种流量特征参数与数据包特征参数等中粒度信息,对多流多特征参数同时进行异常检测。Internet2的实际数据检测结果表明,该方法能够快速准确检测出骨干网络的洪泛攻击和端口扫描等异常流量,检测结果与离线精细检测结果大致相当。

Anomaly detection in backbone network faces two problems：anomaly traffic is relatively small and real-time detection is difficult to implement.Aiming at these two difficulties,this paper proposed a detection method of traffic anomaly based on multi-flows and multi-parameters.Our method classified network traffic into several sub-flows which are closely related to network anomaly,extracted a variety of traffic features and packets features,and then detected traffic anomaly through multi-flows and multi-parameters.The detection results in Internet2＇s real data show that the proposed method can effectively detect flood attacks and port scans,these results almost equal to the results of the offline analysis.