基于流结构多元直觉模糊集组合的流量异常检测算法Trafficanomaly.PDF

基于流结构多元直觉模糊集组合的流量异常检测算法 潮帅，王进法，赵海，贾思媛，余浩 （东北大学 计算机科学与工程学院， 辽宁 沈阳 110169） 摘 要：为了准确检测出大规模网络流的异常行为，提出一种多特征量直觉模糊集组合的流量异 常检测方法。首先在对网络流关系分析的基础上提出时间影响域网络模型（TID ）；其次针对TID 网络特征量不确定性和非一致性特点，运用直觉模糊集构建了单一特征量到多个语言变量上的直 觉模糊表达；然后对多特征量直觉模糊关系建立组合方法，实现对网络流量的行为检测。通过在 数据集上的实验表明该方法的有效性，和已有算法的对比分析证明方法的高效性。 关键字：网络异常检测；网络流交互；复杂网络；直觉模糊集；组合方法； 中图分类号：TP393 文献标识码：A Traffic anomaly detection based on multi-variables intuitionistic fuzzy set ensemble in flow structure CHAO Shuai, WANG Jin-fa, ZHAO Hai, JIA Si-yuan, YU Hao （College of Computer Science and Engineering, Northeastern University, Shenyang 110169, China） Abstract ：In order to detect abnormal behaviors of large-scale network flows accurately, a traffic anomaly detection method based on multiple features’ intuitionistic fuzzy set ensemble was proposed. Firstly, based on the analysis of flow interactions, a Time Influence Domain (TID) model was put forward for the network traffic flows. As the uncertainty and inconsistency of multiple features in TID networks, the intuitionistic fuzzy set (IFS) is introduced to construct the intuitionistic fuzzy expressions from each of feature to multiple linguistic variables. And then an ensemble method of IFSs of multiple feature metrics is developed to detect the network anomalies. The experimental results demonstrate the superiority of our method to state-of-the-art approaches, validating the effectiveness of our method. Keywords ：network anomaly detection, network flow interaction, complex network, intuitionistic fuzzy set, ensemble method 但是综合分析发现其主要研究的是网络流 1 引言 量解析和网络流量统计。例如，Kim 等人[3] 网络流量异常是网络流量行为偏离其 提出了利用攻击时流量大小变化来检测异 正常状态的情况。利用机器学习、统计分析