基于分层抽样算法的异常攻击流量检测  

Anomalous Attack Traffic Detection Based on Stratified Sampling Algorithm

作　　者：王苏南[1] 李印海[1] 罗兴国[1] 

机构地区：[1]国家数字交换系统工程技术研究中心,郑州450002

出　　处：《计算机工程》2012年第12期105-109,共5页Computer Engineering

基　　金：国家"863"计划基金资助项目"面向融合网络的大规模接入汇聚路由器关键技术研究与产业化应用"(2011BAH19B00)

摘　　要：在高速互联网应用中,海量数据无法逐包检测分析,异常攻击流量也不易被识别。为解决该问题,利用泊松帕累托突发过程的经典流量模型对网络流量自相似特性进行分析,将网络流量分为长流与短流,并根据数据流到达时间的抽样比增量进行分层抽样,由此实现异常攻击流量的检测。在基于数据报文级检测的snort异常入侵检测系统上对该方法进行仿真实验,结果证明其能有效缩小异常攻击数据范围,快速准度地检测出攻击。With the application of high-speed Internet,all packets can not be followed by detection in massive data.Abnormal attack traffic is hardly identified.Poisson Pareto Burst Process（PPBP） of Classic model is used to analyze self-similarity of network traffic.Flow size is divided into long and short for a stratified sampling algorithm,according to sampling ratio incremental based on flow arrival time.The method is applied in anomalous detection system based on snort,and simulation results show that it can effectively reduce range of abnormal attack data,and detect quickly and precisely.

关 键 词：异常流量 流量抽样技术 泊松帕累托突发过程 三明治抽样 分层抽样 异常攻击检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]