基于在线特征选择的网络流异常检测

Anomaly detection in network traffic based on online feature selection

针对传统批处理特征选择方法处理大规模骨干网数据流存在时间和空间的限制,提出基于在线特征选择(online feature selection,OFS)的网络流异常检测方法,该方法将在线思想融入线性分类模型,在特征选择过程中,首先使用在线梯度下降法更新分类器,并将其限制在L1球内,然后用截断函数控制特征选择的数量。研究结果表明,提出的方法能充分利用网络流的时序性特点,同时减少检测时间且准确率和批处理方法相近,能满足网络流异常检测的实时性要求,为网络流分类和异常检测提供一种全新的思路。

Traditional batch feature selection methods had the limitations in time and space when dealing large-scale backbone network traffic. A method based on online feature selection detection was proposed to address the limitations,which integrated the idea of online learning into the linear classification model. When selecting the features,the classifier was first updated by online gradient descent and projected to a L1 ball to ensure that the norm of the classifier is bounded,and then the truncate function was used to control the quantity of features. The analysis results showed that the proposed method could make a good use of the time-sequence property of traffic,reduce the time of anomaly detection and hold the similar accuracy when comparing with the batch methods,and meet the real-time demand of network traffic anomaly detection. The proposed method provided a newidea for the network traffic anomaly detection.