基于分形特性的宏观网络流量异常分析  

Anomaly detection algorithm based on fractal characteristics of large-scale network traffic

作　　者：许晓东[1,2] 朱士瑞[2] 孙亚民[1] 

机构地区：[1]南京理工大学计算机科学与技术学院,江苏南京210094 [2]江苏大学现代教育技术中心,江苏镇江212013

出　　处：《通信学报》2009年第9期43-53,共11页Journal on Communications

基　　金：国家自然科学基金资助项目(60603041);江苏省教育厅高校科学研究基金资助项目(03KJD520073)~~

摘　　要：基于宏观网络流量汇聚的分形结构,从流量的全局标度指数和局部标度指数出发,对流量异常进行定性和定量分析。利用多分形奇异谱和Lipschitz正则性分布分析流量异常的分形参数,试图找出这些参数的变化轨迹与异常出现的对应关系。实验结果表明异常的发生在奇异谱和Lipschitz正则性分布中确实有明显的体现。基于此特性构建了新的多分形异常检测算法并设计了新的检测框架,对DARPA1999年数据的实验表明,算法在低误报率的前提下,达到了较高的检测率,优于EMERALD算法。Based on the fractal structure of the large-scale network traffic aggregation, anomalies were analyzed qualitatively and quantitatively from perspective of the global and local scaling exponents. Multi-fractal singular spectrum and Lipschitz regularity distribution were used to analyze the fractal parameters of abnormal flow, trying to identify the relationship between the changes of these parameters and the emergence of anomalies. Experimental results show that the emergence of anomalies has obvious signs on the singular spectrum and Lipschitz regularity distribution. Using this feature, a new multi-fractal-based anomaly detection algorithm and a new detection framework were constructed. On the DARPA/Lineoln laboratory intrusion detection evaluation data set 1999, this algorithm＇s detection rate is high at low false alarm rate, which is better than EMERALD.

关 键 词：异常检测 多分形奇异谱 Lipschitz正则性分布 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]