基于网络流量模型的异常检测方法（Anomaly detection method based on network traffic model）.docVIP

基于网络流量模型的异常检测方法（Anomaly detection method based on network traffic model） Network traffic anomaly detection method based on the model with the development of Internet, network security has become more and more concerned about the problem, the intrusion detection system is one of the means of protection after the firewall is rising gradually, more and more scholars and engineers pay attention to. The shortcomings of traditional intrusion detection Traditional intrusion detection methods are divided into two kinds: Misuse Based Detection (misused-based) and anomaly detection (anomaly-based) based methods. The former requires attack samples, and is tested by describing the special patterns of each attack. The method has a high precision, and can provide detailed attack types and descriptions. It is the main method used in the commercial products of intrusion detection. However, after the research and application of long time, the method also exposed some weaknesses, due to the characteristics of the intrusion detection system based on artificial realization relies on a predefined rules alarm, has its inherent defects, so in the face of changing network attacks such as the need to maintain a library, expensive attack mode can only detect known attacks using this method. On the other hand, attackers can hide their own behavior by modifying their attack characteristic patterns, and some attack methods have no specific attack patterns at all. Anomaly detection method aims at solving the problem of misuse detection method. Therefore, this paper mainly discusses the intrusion detection method based on network traffic anomaly. Based on the traffic anomaly detection method has a lot of, more commonly used detection method based on threshold detection method based on statistics detection method based on wavelet transform method based on Markov stochastic process model and some machine learning, data mining and neural network based detection methods, but these methods mainly have