基于卡尔曼滤波器的网络异常检测

Adaptive Algorithm for Anomaly Detection based on Kalman Filter

通过分析网络异常所引起的网络设备参数变化的特点,对传统的卡尔曼滤波器进行了相应的改进,以时间序列预测方法中的指数平滑的方式对卡尔曼滤波器的噪声系数进行了自适应的调整与改进。并且基于改进后的卡尔曼滤波器,提出了一种自适应的单节点异常检测模型与多节点异常监控模型,这两种模型能够对网络中的单个节点或者多个节点的关键参数进行检测,且具有较低的复杂度以及良好的实时性。

Based on analyzing the variance behavior of a network device caused by anomaly,the traditional Kalman filter is improved by exponentially smoothing its noise vector in an adaptive way.In addition,an adaptive model for single-node anomaly detection and multi-node anomaly monitoring is proposed,which is real-time,expansible and predictable.By implementing this low-cost and real-time model,the key parameters on single node or multiple nodes in a network could be detected.