基于小波分析的网络流量异常侦测方法研究与实现..docVIP

毕业论文 基于小波分析的网络流量异常侦测方法研究与实现 系 别 电子信息系 通信工程 4070707 学生姓名 张鹏 指导教师 黄力群 2011年6月1日基于小波分析的网络流量异常侦测方法研究与实现 摘 要 网络流量异常指的是网络的流量行为偏离其正常行为的情形，引起网络流量异常的原因是多种多样的。异常流量的特点是发作突然，先兆特征未知，可以在短时间内给网络或网络上的计算机带来极大的危害，因此准确、快速地检测网络流量的异常行为，并做出合理的响应是保证网络有效运行的前提之一，也是目前学术界和工业界共同关注的前沿课题之一。 本文通过统计特性分析与小波分析结合的方法设计一个异常侦测系统，通过该系统可以准确可靠地侦测出输入信号中攻击信号的位置。该异常侦测系统由两个级联阶段组成，第一阶段为作为预侦测使用了自适应门限算法和累积和算法，并对两种算法进行了对比分析；第二阶段为最终侦测，把预侦测结果结合连续小波分析得出最终的侦测结果。 文章详细分析了异常侦测系统中各个模块的原理及功能，并分析其侦测的性能。并在Windows平台下利用Matlab进行了仿真，仿真结果表明所提出的网络流量异常侦测算法能准确侦测出异常流量，具有较好的侦测性能。 关键词：异常侦测系统， 流量异常， 累积和， 自适应门限， 连续小波变换 Wavelet-based Detection of Network Traffic Anomaly Author：Zhang Peng Tutor：Huang Liqun Abstract Network traffic anomaly refers to the status that traffic behaviors depart from the normal behaviors. Many reasons will cause network anomaly. The characteristic of anomaly traffics is that it breaks out without any omen and can destroy networks and computers in a short time. Therefore, to detect anomaly rapidly and accurately is one of the precondition of ensuring the efficient network operation and detection of anomalous traffic has become the attractive and valuable subject in the present academic and industrial circles. In this paper we propose an automated system to detect anomalies in network traffic caused by Distributed Denial of Service. The system has a two-stage architecture that combines more traditional approaches (Adaptive Threshold and Cumulative Sum) with a novel one base on the Continuous Wavelet Transform. Thanks to the proposed architecture, we obtain good results in terms of trade-off between correct detections and false alarms. The algorithm we put forward in this paper is simulated with Matlab windows platform. The simulation results of these anomaly detection methods show that the proposed network traffic anomaly detection algorithm can detect abnormal traffic accurately