网络数据流异常检测研究

Research on Network Data Flow Anomaly Detection

网络数据流是典型的时间序列。具有动态性、高维性、无限性等特点。数据流每时每刻在不断变化,传统的处理方法存在多种弊端。根据网络数据流特性,提出基于DT-KNN的网络数据流异常检测算法,在理论和实验两个方面验证其高效性。具体地,在KNN算法中引入累计距离的概念,用以预测待检测未知点的变化趋势,并在流式处理平台Storm上加以实现,最终对基于DT-KNN的网络数据流异常检测算法进行MATLAB仿真。仿真结果表明,基于DT-KNN的网络数据流异常检测算法具有更高的准确率和更好的时效性。

Network data stream is a typical time series, which is characterized by dynamics, high dimensionality, and infinity. The data flow is constantly changing every moment, and the traditional processing methods have many drawbacks. According to the characteristics of network data stream, a network data flow anomaly detection algorithm based on DT-KNN is proposed, which is proved to be efficient in both theoretical and experimental aspects. Specifically, the concept of cumulative distance is introduced in the KNN algorithm to predict the trend of the unknown point to be detected, and is implemented on the streaming platform Storm. Finally, MATLAB simulation is performed on the DT-KNN-based network data flow anomaly detection algorithm. The simulation results indicate that the DT-KNN based network data flow anomaly detection algorithm has higher accuracy and better timeliness.