MOADA-SVR:一种基于支持向量回归的多元在线异常检测方法  

MOADA-SVR:a multivariate online anomaly detection algorithm based on SVR

作　　者：钱叶魁[1,2] 陈鸣[1] 

机构地区：[1]解放军理工大学指挥自动化学院,江苏南京210007 [2]解放军防空兵指挥学院,河南郑州450052

出　　处：《通信学报》2011年第2期106-113,共8页Journal on Communications

基　　金：国家自然科学基金资助项目(90304016);国家高技术研究发展计划("863"计划)基金资助项目(2007AA01Z418);江苏省自然科学基金资助项目(BK2009058)~~

摘　　要：网络异常检测对于保证网络稳定高效运行极为重要。基于主成分分析的全网络异常检测方法虽然具有很好的检测性能,但无法满足在线检测的要求。为了解决此问题,引入流量矩阵模型,利用支持向量回归及其支持向量解的在线稀疏化方法建立流量的一种常态模型,提出了一种基于支持向量回归的多元在线异常检测算法MOADA-SVR。理论分析和因特网实测数据分析表明,该算法与主成分分析算法相比具有类似的检测效果,但具有更低的存储和计算开销。Network anomaly detection is critical to guarantee stabilized and effective network operation.Although PCA-based network-wide anomaly detection algorithm has good detection performance,it cannot satisfy demands of online detection.In order to solve the problem,after traffic matrix model was introduced,a normality model of traffic was constructed using SVR and the sparsification of support vector solutions.Based on these,a multivariate online anomaly detection algorithm based on SVR named MOADA-SVR was proposed.Theoretic analysis showed that MOADA-SVR had lower storage and less computing overhead compared with PCA.Analysis for traffic matrix datasets Internet showed that MOADA-SVR had also good detection performance,approximating PCA.

关 键 词：异常检测 在线检测 支持向量回归 多元分析 流量矩阵 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]