ODC——在线检测和分类全网络流量异常的方法

ODC: a method for online detecting & classifying network-wide traffic anomalies

提出一种从全网络的视角实时在线检测和分类流量异常的方法(简称ODC),该方法以增量方式构建以流量特征的熵为测度的流量矩阵,利用增量主成分分析算法在线地检测流量异常,然后再利用增量k-means算法实时在线地对流量异常进行分类,以便网络管理员采取相应的防御措施。理论分析和实验分析表明,ODC具有较低的时间复杂度和存储开销,能够满足在线实时处理的要求。实测数据分析和模拟实验分析的结果均证实了ODC具有很好的检测和分类性能。

A method for online detecting classifying traffic anomalies（ODC for short） from a network-wide angle of view was put forward.This method constructed traffic matrix with a metric of traffic feature entropy incrementally,de-tected traffic anomalies online using incremental principal component analysis,and then classified traffic anomalies online using incremental k-means,from which network operators could benefit for taking corresponding countermeasures.Theoretical analysis and experiment analysis show that the method has lower storage and less computing time complexity,which could satisfy the requirements of real-time process.Analysis based on both measurement data from Abilene and simulation experiments demonstrate that the method has very good detection and classification performance.