网络流量异常检测中的维数约简研究

Research on Dimensionality Reduction in Network Traffic Anomaly Detection

对包含大流量数据的高维度网络进行异常检测,必须加入维数约简处理以减轻系统在传输和存储方面的压力。介绍高速网络环境下网络流量异常检测过程以及维数约简方式,阐述流量数据常用特征和维数约简技术研究的最新进展。针对网络流量特征选择和流量特征提取2种特征降维方式,对现有算法进行归纳分类,分别描述算法原理及优缺点。此外,给出维数约简常用的数据集和评价指标,分析网络流量异常检测中维数约简技术研究面临的挑战,并对未来发展方向进行展望。

To implement anomaly detection for a high dimensional network with mass flow data,data dimensionality should be reduced to relieve transmission and storage burdens from the system.This paper introduces network traffic anomaly detection process and dimensionality reduction ways in hig-speed network environment.Then it summarizes common features of feature in network traffic anomaly detection and latest research developments of dimensionality reduction for traffic data.Aiming at two kinds of feature dimensionality reduction ways,network traffic feature selection and network traffic feature extraction,this paper lists and classifies frequently used algorithms and describes the principles,advantages and disadvantages respectively.On this basis,this paper analyzes existing datasets and evaluation indexes used in research of dimensionality reduction.Finally,this paper discusses development directions and challenges of dimensionality reduction technologies in network traffic anomaly detection.