基于尖点突变模型的联动网络流量异常检测方法  

Interaction Network Traffic Anomaly Detection Method Based on Cusp Catastrophic Model

作　　者：邱卫[1] 杨英杰 

机构地区：[1]解放军信息工程大学,郑州450001 [2]河南省信息安全重点实验室,郑州450001

出　　处：《计算机科学》2016年第3期163-166,173,共5页Computer Science

基　　金：国家863计划项目(2012AA012704);国家973计划项目(2011CB311801);郑州市科技领军人才项目(131PLJRC644)资助

摘　　要：针对现有方法没有考虑联动网络流量的非线性动力学特性,以及不能有效区分正常联动业务流量和异常攻击流量的问题,提出了一种基于尖点突变模型的联动流量异常检测方法。通过对联动网络流量非线性动力学特征参数的分析与提取,建立正常流量的尖点突变模型;利用模型的平衡曲面来描述网络流量系统的行为,构造正常网络流量行为的平衡曲面;并以网络流量行为相对于正常平衡曲面的偏离程度作为异常检测的依据。实验结果表明,所提方法具有较高的检测率和较低的误报率。As the exiting methods do not consider the nonlinear dynamics feature of interaction network traffic,and cannot distinguish between normal interaction traffic and abnormal attack traffic effectively,we proposed an interaction traffic anomaly detection method based on cusp catastrophe.The normal traffic cusp catastrophe model is established on the nonlinear dynamics parameters of interaction network traffic,and the equilibrium surface is used to describe the behavior of network traffic system and the balance surface of normal network traffic behavior is structured.Then the deviation of normal balance surface is taken as basis to detect anomaly.Experimental results show that this method gets higher detection rate and lower false alarm rate.

关 键 词：尖点突变 联动 流量异常 非线性动力学 平衡曲面 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]