基于网络聚合行为的异常检测方法研究  

Anomaly Detection Based on Aggregated Network Behavior Metrics

作　　者：苏彦君[1] 沈刚[1] 刘昕[2] 

机构地区：[1]华中科技大学软件学院,湖北武汉430074 [2]华中电网有限公司,湖北武汉430071

出　　处：《计算机工程与科学》2010年第3期38-41,共4页Computer Engineering & Science

摘　　要：异常检测是目前入侵检测领域中非常活跃的一个方向,其作为一种网络测量手段,对于分组报头的信息统计在很多网络管理任务中扮演着重要的角色。将网络分组中报头的信息按不同方式汇聚起来,可以有效地构成网络流量属性的度量。从中提取的特定的子集在理论上可用于刻画网络流量中的攻击行为特征。如果这些度量在无攻击情况下能够表现出相对的稳定性,而在发生攻击时相对敏感,则可用于判断攻击的发生。并利用主成份分析和信息增益对冗余特征进行删减,能够使得判断攻击时需要的开销降低,增加实时性。基于机器学习的分类器是判断攻击导致的异常的有效手段。根据所选取的度量指标设计了三种分类器。Anomaly detection is a very active area of lIDS. As a network measurement tool, anomaly detection plays an important role for a header statistical information in many network management tasks. Assembling the information of network packets can effectively constitute the network traffic measurement metrics. Extracting a specific subset from the metrics can be used to describe the flow of network attack characteristics. If these metrics show a relatively stable performance when there is no attack and a relatively sensitive manner when the attack occurs, they can be used to judge the attacks. And the redundant features are deleted by the use of principal component analysis and information gain. It can reduce spending and increase real-timeness. The classifier based on machine learning is an effective judgment method of the anomaly caused by network attacks. According to the selected metrics, we design three classifiers.

关 键 词：异常检测 主成份分析 信息增益 支持向量机 神经网络 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]