基于独立流量平稳模型的异常检测算法研究  

AN ANOMALY DETECTION ALGORITHM BASED ON THE INDEPENDENT TRAFFIC STATIONARY MODEL

作　　者：费金龙[1] 蔡靖[1] 贺新征[1] 祝跃飞[1] Fei Jinlong Cai Jing He Xinzheng Zhu Yuefei(Information Engineering University, Zhengzhou 450001, Henan, China)

机构地区：[1]解放军信息工程大学,河南郑州450001

出　　处：《计算机应用与软件》2017年第3期272-276,328,共6页Computer Applications and Software

基　　金：国家科技支撑计划项目(2012BAH47B01);信息保障技术重点实验室开放基金项目(KJ-14-105)

摘　　要：当链路流量由不同流复合而成时,不同流的短时变化(增大或降低)可以相互中和,使链路上的所有流趋于平稳。当流之间相互独立,链路流量趋于平稳状态。但是,当链路中出现相关流时,该平稳状态将被打破。研究证明许多异常流量发生时会违反流的独立性。基于此,提出了独立流量平稳模型i TSM(independent Traffic Stationary Model),并设计了一种异常流量检测算法。实验证明:针对单链路异常检测,该算法显著优于其他算法的检测效果。When the link traffic is traversed by many flows, their volume＇ s changes are short-lived, and such changes tend to cancel each other out, making total changes of link traffic approach to zero. If the flows on the link are independent with each other, total link traffic is stationary. When small and correlated flows present themselves on the link, this stationary state will be violated. Many anomalies meet this feature. Based on this observation, an independent traffic stationary model （iTSM） is provided, and an algorithm to detect single link anomahes is proposed. The simulation validates that the proposed method uncovers single link anomalies better than previous techniques.

关 键 词：异常检测 假设检验 流量测量 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]