基于改进CUSUM算法的网络异常流量检测.PDFVIP

第26卷第 2期 计 算 机 应 用 研 究 Vo.l 26No. 2 2009年 2月 ApplicationR esearch ofComputers Feb. 2009 CUSUM* 1 1 2 步山岳 , 张海艳 , 王汝传 ( 1. 淮阴工学院计算机工程系, 江苏淮安 223001; 2. 南京邮电大学计算机学院, 南京 210003) : 首先对 络流量进行异常检测, 发现异常后再对数据包进行分析, 实施相应措施, 有利于降低系统开 销。针对在使用 CU UM算法进行流量异常检测时产生的累积和效应问题, 提出用自适应算法消除累积和效应 的影响, 分析了参数的设置对解除报警的延迟时间、误报警等的影响。实验结果表明设计的算法是有效和正确 的,可以直接应用于检测 YN 洪水攻击等。 : 流量检测; 累积和算法; 指数加权滑动平均值算法; 报警阈值 : TP393 : A : 100123695(2009) 0220500202 Anomaly network traffic detection based on modified CU UM algorithm 1 1 2 BU han2yue , ZHANG H a2iyan , WANG Ru2chuan ( 1. Dept. of Computer Engineering, Huaiyin In stitute of Technology, Huaian Jiangsu 223001, China; 2. School of Computer Technology, Nanjing ost Communication University, Nanjing 210003, China ) Ab stra ct: It should bemore efficient to detect the anomaly ofnetwork traffic firstly rather than to analyze the data packets di2 rectly. Th is paper proposed an auto2adapted algorithm to elmi inate the cumulative effect occurringwhen detecting anomalies of network traffic based on theCU UM algorithm, then investigated the influence on setting parametersof the delay tmi e ofalarm re2 lieving and failing alarm, etc. The expermi ent shows that the algorithm is effective and correct, wh ich can mi prove the accuracy of anomaly traffic detection and reduce the operation cost. o it can be directly app lied in detecting YN flooding attacks and soon. K ey w or ds: traffic