基于预测和动态阈值的流量异常检测机制研究

Research on Traffic Anomaly Detection Mechanism Based on Prediction and Dynamic Threshold

针对流量异常检测中的基线和阈值难以精确刻画的问题,提出了一种基于预测和动态阈值的异常检测机制。通过构造混沌支持向量机预测模型对流量基线值进行确定;采用假设检验的异常检验方法,利用一天中各时段对应训练集拟合残差符合正态分布的特点构造符合t分布的随机变量,进而计算各时段预测残差的置信区间来动态地确定网络流量的阈值。实验结果表明,预测模型具有很高的预测精度,该异常检测机制具有一定的可行性。

Aiming the problem that baseline and threshold of traffic anomaly detection is difficult to describe, an anomaly detection mechanism based on prediction and dynamic threshold is proposed. The traffic baseline value is determined by constructing chaos support vector machine prediction model. Statistical hypotheses testing approach is employed to detect anomaly. Under the characteristics that the training residual in various periods of the day follows normal distribution, the random variable satisfying t distribution is constructed. Then the threshold of network traffic is determined dynamically according to calculating the confidence interval of prediction residual in various periods. Experimental results verify the high accuracy of the prediction model and the feasibility of anomaly detection mechanism.