网络异常流量分析的相关技术分析与应用-analysis and application of related technologies in network abnormal traffic analysis.docxVIP

贵州大学硕士学位论文 贵州大学硕士学位论文 II II Abstract With the development of internet and the increase of serviecs provided, it makes the people life become more and more convenient. However, the network attack behaviors also become more and more serious. Those behaviors result the abnormal network traffic growing quickly. This abnormal network traffic already makes the serious impact on network service quality. As all know, traffic anomaly analysis is a key part of network-monitor whether detect and prevent the abnormal traffic is important on network quality and service. This paper mainly research and explore on the abnormal network analysis techniques. Firstly, the paper analyzes the two traditional network traffic collected techniques. One is the based on SNMP collection techniques, the other is based on NetFlow collection techniques. Then compare the two collection techniques advantages and disvantages. Both of the collection techniques provide the network source information for network traffic anomaly analysis. Secondly, from study the based threshold, we proposed the base on threshold technoloy to find the abnorm traffic positioning. This technoloy make up the defection that the traditional network traffic can not found the abnormal network traffic host. Then, the article introduces a distributed algorithm which used the information entropy in the network to decision whether the abnormal traffic has happenped. Finally, through the wavelet decompositon the collection anlysis and then put those signal to wavelet decomposition. We obtain the flow component use the RLS model to predict . From experimental on the Matlab 7.0 platform, we find RLS model to predict can obtain the better predict effect. From the experiment, it verify this predict effect . Key words: traffic collection; network anomaly; anomaly detection; information entropy ; regression analysis PAGE PAGE 1 第一章 绪论 1.1 研究背景 随着 Internet 的不断发展，网络中存在着大量的异常流量严重的影响了正 常业务的使用，成为急需解决的问题之一。网络中的异常流量如网络蠕虫病毒、 网络扫描和