基于小波变换的网络流量异常监测仿真实验

Optimization of decision tree principal component feature tracking and transient abnormal feature extraction

为有效定位识别和提取网络流量序列的暂态性异常特征,针对网络异常流量特征扰动性和暂态性特点,提出一种基于小波分解的二叉分类回归决策树主分量特征优化跟踪特征提取算法。利用训练集建立决策树模型,采用二叉分类回归决策树模型进行主分量特征优化跟踪建模,利用双正交提升小波分解得到的各层细节信号对暂态性扰动特征的敏感性,通过小波分解得到各层细节信号,将提取的小波分层细节信号的奇异值分解特征再返回到决策树主分量特征优化跟踪模型中,实现网络流量异常特征的定位提取和识别。仿真实验表明,改进算法的抗干扰能力和分辨率提高显著,暂态性异常特征谱图分辨能力提高,异常特征分布谱清晰可见,展示了较好的特征提取和状态识别性能。

For the transient abnormal features location recognition and extraction of network flow traffics,according to the network traffic anomaly features and transient disturbance, this paper proposed aregression tree principal component feature optimal tracking feature extraction algorithm based on twobinary classification of wavelet decomposition. The training set was used to build a decision tree model,and two binary classification decision trees were proposed for optimal principle component feature trackingmodeling. According to the sensitivity of each layer detail signal for wavelet decomposition to the transientdisturbance features, the detail signal of each layer was obtained based on the wavelet decomposition,and the singular value decomposition level of detail signal extraction the characteristics of decompositionand return to the decision tree optimization model. The feature location and recognition was realized forthe network traffic. The simulation results show that the improved algorithm has stronger anti -interference ability and resolution. The transient abnormal feature spectrum is clearer than the traditionalmethod. It shows the good performance of feature extraction recognition.