基于小波的异常检测方法研究  

Anomaly detection method based on wavelet

作　　者：王彦[1] 张玥[1] 胡铭曾[1] 

机构地区：[1]哈尔滨工业大学计算机科学与技术学院,黑龙江哈尔滨150001

出　　处：《哈尔滨商业大学学报（自然科学版）》2006年第6期58-61,共4页Journal of Harbin University of Commerce：Natural Sciences Edition

基　　金：国家高技术研究发展计划(863计划)(2002AA142020)

摘　　要：针对DDoS攻击引起的网络异常,提出基于小波变换的检测方法.将网络流量分解到不同的频段,根据高频段频谱能量,即小波方差的变化对网络流量异常进行检测.为提高预警的准确性,吸取了路由器的设计思想,用LRU Cache滤掉长时流发现突发流量,实验证明本尝试是有效的.The distributed denial-of-service （DDoS） leading to network traffic anomaly is growing rapidly. In this paper, a network traffic anomaly detection method based on wavelet transform is proposed. Network traffic is broken down into different frequency, and anomaly change of network traffic is detected through the high-frequency power analysis, that is the change of wavelet variance. In order to enhance the alarm veracity, a LRU Cache is used to filter the long-term flow and part of outburst flow is found. Experiments proved that it is viable attempt to analyze network traffic from the aspect of frequency.

关 键 词：异常检测 DDOS攻击 小波分析 LRU缓存 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]