基于sketch数据结构与正则性分布的骨干网流量异常分析与识别  

ANOMALY ANALYSIS AND IDENTIFICATION OF BACKBONE NETWORK BASED ON SKETCH AND REGULARITY DISTRIBUTION

作　　者：罗玲[1] 殷保群[1] 曹杰[1] 

机构地区：[1]中国科学技术大学自动化系,合肥230027

出　　处：《系统科学与数学》2015年第1期1-8,共8页Journal of Systems Science and Mathematical Sciences

基　　金：国家自然科学基金(61174124;61233003);高等学校博士点基金(20123402110029);安徽省高校自然科学研究项目(KJ2012A286)资助课题

摘　　要：随着互联网爆炸性的增长,网络安全问题如恶意攻击,蠕虫病毒,DDoS攻击等事件的数量和影响也一直在不断增加.如何能够及时准确地检测到网络流量异常是我们面临的一个重要问题.作者根据网络流量的信号特性,结合sketch数据结构和网络流量Lipschitz正则性分布,提出了一种新的异常检测技术.该方法不仅能有效地定位骨干网流量异常发生的源IP地址和发生时刻,还能根据源IP地址熵值的分析,对异常进行识别。实验分析的结果验证了该方法在检测和可溯源方面的有效性.With the rapid development and the rising complexity of communication systems and networks, the threats from malicious attacks, worms, DDoS attacks also grow. How to detect the anomalies of the network traffic timely and accurately becomes an important issue. We propose a novel method based on the combining sketch and Lipschitz regularity distribution of backbone network traffic to reveal the anomalies. In this paper, our approach can not only locate time points that anomalies occurred and track the IP addresses of anomalies effectively on backbone network traffic, but also identify the anomalies by analyzing the entropy of source IP addresses. Analysis based on simulation experiments demonstrates that the method has very good performance on detection and traceability.

关 键 词：骨干网流量异常 sketch数据结构 Lipschitz正则性分布 熵值. 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]