网络流量正常行为模型的建立

MODELING NORMAL BEHAVIOR OF NETWORK TRAFFIC

网络规模的迅速扩大和网络技术的复杂化 ,以及网络设备的多样化 ,使得网络出现各种问题的可能性增大。传统的网络管理一般是根据预先设定的阈值来报警的 ,但是 ,这种方法的缺点是适应性差 ,而且该阈值难以确定。由此出现了预先网络管理 ,预测网络问题的发生。为了进行网络流量的预测 ,文中介绍了一种建立网络正常行为模式的方法 ,通过方差分析的方法 (ANOVA) ,对实际网络中非单播包的观测值时间序列平稳化 ,建立自回归滑动平均模型 (ARMA) ,利用该方法建立的网络流量行为模型 ,可以预测网络流量及其变化趋势 ,并检测网络异常情况的发生。

With the rapid development of the network, it now has a large size and complexity, increasing various applications based on it, consequently the network management is increasingly difficult. Generally the traditional network management systems alarm in terms of a fixed threshold, however, it has a shortcoming that it cannot adapt the changes of the network, moreover, it is not an easy thing to find the appropriate threshold, so the techniques of proactive network management occurred. Therefore, a normal behavior model is founded with the numbers of the non-unicasting packet collected from a real network, with the Analysis of Variance (ANOVA), stabilize the normal behavior serial and estimate the coefficients of the ARMA model. So network anomaly behavior may be detected with this model, the traffic of the network may be predicted, and the trend of network can be seen.