基于网络业务量建模的流量异常检测-通信与信息系统专业论文.docxVIP

摘要(5)针对现有单链路流量异常检测和全局流量异常检测方法存在的不足，本文 摘要 (5)针对现有单链路流量异常检测和全局流量异常检测方法存在的不足，本文 提出一种基于全局的多流量相关异常检测方法。该方法首先使用时间序列模型 AlwA模型来对每个oD流或链路的流量数据进行建模，从而对下一时刻的流量 数据进行预测，然后将实际流量数据减去预测流量值得到预测差，最后再通过对 这多个oD流或链路的预测差序列之间的全局相关分析来实现流量异常检测。仿 真实验表明该方法能检测到某些全局流量异常检测方法无法检测到的异常。 关键词：异常检测，自相似模型，层叠模型，AlmA模型，全局网络相关性分 析 AbstractAbstract Abstract Abstract Network仃af!ck勰omaly啪ically refcrs t0 circumstances wh∞仃afnc behaviors deviate f如m the nornlal bebaviors．Ne呻ork仃af：fic anomalies can arise due to various causes，such越malfIlnctioning netw01．k devio懿，netwofk overload，malicious DDoS attacl【s and network in仇lsion．The anomalv缸桶c ch锄．ac删stics are mat“breal【s out witb伽“my伽即and can desnDy ne脚ofI【s and co】珥加lers in a shon石me(Iof instal】ce， tlle burst伽ic bebaVior c蚰sed by spccific attack pm争抛s or w咖outbrcal【)． Thereforc，to detect删ic aIlonlaIies rapidly alld accurately is∞e of me preconditions w11ich ensure me emciem network ol，训ons．And aIlomalous由raf!fic detection has bccome one of tlle attr。active and valudble research directions in the present acadeIIlic 卸d industriaI c疵I∞．This paper intcnds to rese砌trafj丘c anon：laly detec“on based on n吐丘c Inodel：we inVestigatcs廿le e侬斌of弛omal叩s tr棚c∞tIle self-si砌arity of恤 a埘【bient打afnc；we inVestigalcs nle ef艳ct of anolnalous廿娟c on me cascadc ch馘蜘stics of the ambiem缸affic to realize the detecti∞bascd on IDC m0(1el： 蛐g al lbe dc厅cjency of tbc pr髂ent sin掣e lill】(打a施c彻0maly detection a11d ne脚ork-wideⅡ锄c anomaly dctection，、】l，e realize the n咖ork-wide multi一仃affic con．clation柚omaly detc圮tion． (1)On the basis of tlle innDduction of some b雒ic concepts about ne铆ork仃affk 弛omaly detection，Ⅱlis paper reviews the cu玳Int tramc勰onlaly dete蛳on metllods龃d cl勰sifies tllem into mrec cl雏ses．AIld fbr tlle naws of the c咖t仃锄c距omaly detecti∞metho(1s，we point out some directions on the p￡d研mance improvement of n岫． (2)111is paper systematically reVieWS traf!fic modcling tbeory， including self二simil缸mo捌，multi—f}actal model，infinitcly mvisible c雒cades and ARMA tilne series model． (3)11lis pap