基于NetFlow时间序列的网络异常检测  

Detecting network anomalies based on NetFlow time series

作　　者：贾冠昕[1] 杨波[2] 陈贞翔[2] 彭立志[2] 

机构地区：[1]济南大学图书馆,济南250022 [2]济南大学信息科学与工程学院网络中心,济南250022

出　　处：《计算机工程与应用》2008年第24期128-131,135,共5页Computer Engineering and Applications

摘　　要：网络流量在正常运行的情况下是具有一定的周期性、稳定性的,异常流量会打破这种规律使流量产生异常波动。提出了一种基于NetFlow时间序列滑动窗口检测网络异常的方法,利用时间序列异常发现算法发现网络流量的异常波动从而实现了实时高效的异常流量发现及预警。已经被检测到的网络异常会持续产生预警信息并影响后续的异常检测,为此还提出了两种平抑异常的方法。实验结果表明该方法能够有效地发现网络异常。Network traffic shows periodicity and stability when network works normally,but network anomaly would break this rule.This paper presents a novel method which can find out network anomalies based on NetFlow time Series sliding window.Using the time-series-based anomaly finding theory,the method realizes real-time finding network anomalies and making announce- ment of anomalies.To prevent an anomaly from persistent announcement and disturbing following detection,this paper also presents two ways to ignore announced anomalies.The results show that the method differentiates anomalies efficiently.

关 键 词：NETFLOW 时间序列 网络异常 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]