一种面向TCP流的异常检测技术  

Anomaly detection technique oriented to TCP flow

作　　者：焦文欢[1] 冯兴杰[2] 

机构地区：[1]中国民航大学信息网络中心,天津300300 [2]中国民航大学教务处,天津300300

出　　处：《中国民航大学学报》2014年第3期50-54,共5页Journal of Civil Aviation University of China

基　　金：国家自然科学基金项目(60672174);中国民用航空局科技基金项目(MHRD200807)

摘　　要：为了解决传统TCP流异常检测中无法区分突变正常流量和异常流量的问题,提出了一种面向TCP流的异常检测技术。模型采用概要数据结构,在基于小波求解Hurst参数判断网络异常的基础上,根据TCP握手和挥手协议的内容对TCP报文的完整性进行验证,不仅实现了大规模数据的概要存储,提高了运算效率,而且实现了对突变的正常流量与异常流量进行区分的目的。实验结果表明,该方法具有较高的检测率和较低的误检率,可较好地应用于网络异常检测。In order to solve the problem that network-flow anomaly detection cannot distinguish between mutations in normal and abnormal traffic flow,an anomaly detection technique oriented to TCP flow is presented.Using method of summary data structure,this model calculates the Hurst parameter and TCP packet integrity to discover the network anomalies.Not only can it achieve a summary of large-scale data storage to improve the efficiency,but also realize the purpose to distinguish between the burst traffic with abnormal tratfic flow.Experimental results show that this method has high detection rate and low false detection rate,it can be better used in network anomaly detection.

关 键 词：突变正常流量 异常流量 概要数据结构 小波系数方差 报文完整性 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]