基于抽样流长与完全抽样阈值的异常流自适应抽样-电子与信息学报.pdfVIP

第 37 卷第 7 期 电 子 与 信 息 学 报 Vol.37 No.7 2015 年 7 月 Journal of Electronics Information Technology Jul. 2015 基于抽样流长与完全抽样阈值的异常流自适应抽样算法 * 伊 鹏 钱 坤 黄万伟 王 晶 张 震 (国家数字程控交换系统工程技术研究中心 郑州 450002) 摘 要：高速 IP 网络的流量测量与异常检测是网络测量领域研究的热点。针对目前网络流量测量算法对小流估计 精度偏低，对异常流量筛选能力较差的缺陷，该文提出一种基于业务流已抽样长度与完全抽样阈值 S 的自适应流 抽样算法(AFPT)。AFPT 算法根据完全抽样阈值 S 筛选对异常流量敏感相关的小流，同时根据业务流已抽样长度 自适应调整抽样概率。仿真和实验结果表明，AFPT 算法的估计误差与理论上界相符，具有较强的异常流量筛选 能力，能够有效提高异常检测算法的准确率。 关键词：网络测量；自适应流抽样；异常检测 中图分类号： TP393 文献标识码： A 文章编号：1009-5896(2015)07-1606-06 DOI: 10.11999/JEIT141379 Adaptive Flow Sampling Algorithm Based on Sampled Packets and Force Sampling Threshold S Towards Anomaly Detection Yi Peng Qian Kun Huang Wan-wei Wang Jing Zhang Zhen (National Digital Switching System Engineering Technological RD Center, Zhengzhou 450002, China) Abstract: The network traffic measurement and anomaly detection for high-speed IP network become the hotspot research of network measurement field. Because the current measurement algorithms have large estimation error for the mice flows and poor performance for the sampling anomaly traffic, an Adaptive Flow sampling algorithm based on the sampled Packets and force sampling Threshold S (AFPT) is proposed. According to the force sampling threshold S, the AFPT is able to sample the mice flows which is sensitive to the anomaly traffic, while adaptive adjustment the probability of sampling based on the sampled packets. The simulation and experimental results show that the estimation error of AFPT is consistent with the theoretical upper bound, and provide better performance for the anomaly traffic s