基于奇异值分解更新的多元在线异常检测方法  

A Multivariate Online Anomaly Detection Algorithm Based on SVD Updating

作　　者：钱叶魁[1,2] 陈鸣[1] 

机构地区：[1]解放军理工大学指挥自动化学院,南京210007 [2]解放军防空兵指挥学院,郑州450052

出　　处：《电子与信息学报》2010年第10期2404-2409,共6页Journal of Electronics & Information Technology

基　　金：国家自然科学基金重大研究计划(90304016);国家863计划项目(2007AA01Z418);江苏省自然科学基金(BK2009058)资助课题

摘　　要：网络异常检测对于保证网络稳定高效运行极为重要。基于主成分分析的全网络异常检测算法虽然具有很好的检测性能,但无法满足在线检测的要求。为了解决此问题,该文引入流量矩阵模型,提出了一种基于奇异值分解更新的多元在线异常检测算法MOADA-SVDU,该算法以增量的方式构建正常子空间和异常子空间,并实现网络流量异常的在线检测。理论分析表明与主成分分析算法相比,该算法具有更低的存储和计算开销。因特网实测的流量矩阵数据集以及模拟试验数据分析表明,该算法不仅实现了网络异常的在线检测,而且取得了很好的检测性能。Network anomaly detection is critical to guarantee stabilized and effective network operation.Although PCA-based network-wide anomaly detection algorithm has good detection performance,it can not satisfy demands of online detection.In order to solve the problem,the traffic matrix model is introduced and a Multivariate Online Anomaly Detection Algorithm based on Singular Value Decomposition Updating named MOADA-SVDU is proposed.The algorithm constructs normal subspace and abnormal subspace incrementally and implements online detection of network traffic anomalies.Theoretic analysis shows that MOADA-SVDU has lower storage and less computing overhead compared with PCA.Analyses for traffic matrix datasets from Internet and simulation experiments show that MOADA-SVDU algorithm not only achieves online detection of network anomaly but also has very good detection performance.

关 键 词：网络异常检测 在线算法 奇异值分解 多元分析 增量学习 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]