基于多尺度低秩模型的网络异常流量检测方法Networktrafficdetection.PDFVIP

第33 卷第1 期 通 信 学 报 Vol.33 No.1 2012 年1 月 Journa l on Communications January 2012 基于多尺度低秩模型的网络异常流量检测方法 程国振，程东年，俞定玖 （国家数字交换系统工程技术研究中心，河南郑州450002 ） 摘 要：现有刻画流量异常检测所需的流特征集通常是高维的，增加了检测和分类的复杂度。通过研究发现网络 中异常通常是稀疏性分布的，单个异常仅仅表现在低维流特征中。基于这一现象提出了一种异常流量检测模型— 多尺度低秩 (MRLR, multi-resolution low rank)模型，该模型能够动态筛选出“合适的”特征集并准确分类异常。 基于人工标记的实际网络流量异常和注入异常的数据集验证结果表明：MRLR 对特征集的缩减率可达10%以下； 并且基于MRLR 的分类算法复杂度为O(n) 。 关键词：异常检测；特征选择；多尺度分析；低秩分布 中图分类号：TP393.08 文献标识码：A 文章编号：1000-436X(2012)01-0182-09 Network traffic detection based on multi-resolution low rank model CHENG Guo-zhen, CHENG Dong-nian, YU Ding-jiu (National Digital Switching System Engineering Techno gical RD Center, Zhengzhou 450002, China) Abstract: Because network traffic was usually characterized by its higher-dimensional features, related detectors and classifiers for identifying traffic anomalies were suffering the increased complexity. Several key observations given by existing studies showed that network anomalies were distributed typically in a sparse way, and each of anomalies was es- sentially characterized by its lower-dimensional features. Based on this important finding, a novel model detecting traffic anomalies—multi-resolution low rank (MRLR) was developed. The proposed MRLR allowed us to dynamically filter the “proper” feature sets and then to classify anomalies accurately. The validation shows that MRLR can accurately reduce the dimensions of flow features to lower than 10%, on the other hand, the complexity of MRLR-classifiers