自适应参数的网络异常流量检测方法  

Anomaly Network Traffic Detection Based on Auto-Adapted Parameters Method

作　　者：步山岳[1] 王汝传[2] 张海艳[1] 

机构地区：[1]淮阴工学院计算机工程系,江苏淮安223001 [2]南京邮电大学计算机学院,江苏南京210003

出　　处：《北京交通大学学报》2008年第6期73-77,共5页JOURNAL OF BEIJING JIAOTONG UNIVERSITY

基　　金：国家自然科学基金资助项目(60573141;60773041)

摘　　要：分布式拒绝服务(DDoS)攻击对互联网的稳定性和安全性构成了严重的威胁.对网络流量进行异常检测,发现异常后再对数据包进行分析,实施相应措施,有利于降低系统开销.该文给出了网络流量均值和阈值能够根据网络环境变化的自适应调整算法.分析了参数的设置对误报警、动态调整报警阈值等的影响.实验结果表明设计的系统是有效和正确的,可以在提高异常流量检测准确性的同时降低运行开销,可以直接应用于检测SYN洪水攻击等.Distributed Denial of Service（DDoS） attack presents a very serious threat to the stability and security of the Internet. It should be more efficient to detect the anomaly of network traffic firstly rather than to analyze the data packets directly. In this paper, an algorithm is proposed for the number of network traffic and alarm threshold will be adjusted to adapt the changing of network environment. The influence on setting parameters of the failing alarm and the dynamic adjusting of alarm threshold, etc, is investigated then. The experiment shows that the algorithm is effective and correct, which can improve the accuracy of anomaly traffic detection and reduce the operation cost. So it can be directly applied in detecting SYN flooding attacks and so on.

关 键 词：流量检测 CUSUM算法 EWMA算法 报警闽值 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]