一种网络流量异常检测模型

A Model of Anomaly Network Flow Detection

网络流量异常影响网络性能,严重时造成网络中断,在基于统计的网络流量异常检测模型基础上,本文提出一种改进的方法。首先对采样数据进行预处理,去除坏值;然后采用统计学方法对网络流量稳态模型进行建模和更新,选择表现流量特征明显、属性相关性小的指标反映网络流量;最后利用同比和环比相结合的方法对网络流量进行异常判断。实验结果表明,该方法能对网络流量异常有较好的监控,并减小异常检测的误判率。

Anomaly network flow can affect network performance, even causes a serious network interruption. This model is im- proved on the base of anomaly detection model of network traffic based on statistics. First, it preprocesses the sampling data, re- moving bad values, and then statistical methods are used to build and update the steady network flow model. It selects some indi- cators that show the character of flow, and little associate to determine the network flow anomaly. Last, by using the combinative method of year-on-year and chain, it can judge the anomaly network flow more accurately. The experiments show that the method can monitor anomaly network flow well and reduce the rate of false anomaly detection.