基于时间序列分析的网络流量异常检测  

Network traffic anomaly detection based on time series analysis

作　　者：李彦 

机构地区：[1]景德镇陶瓷大学信息工程学院,江西景德镇333403

出　　处：《现代电子技术》2017年第7期85-87,91,共4页Modern Electronics Technique

摘　　要：为了准确检测出网络流量的异常现象,保证网络的正常工作,提出基于时间序列分析的网络流量异常检测模型。根据网络流量数据间的相似性,采用小波分析对网络流量进行分解,划分为更小尺度的分量,然后采用时间序列分析法——灰色模型和马尔可夫模型分别对高频分量和低频分量进行网络流量异常检测,并采用小波分析对它们的检测结果进行融合,最后采用网络流量异常仿真实验进行分析。结果表明,时间序列分析模型的工作过程简单,提高了网络流量异常检测率,误检率要低于其他网络流量异常检测模型,获得更优的网络流量异常检测实时性。A network traffic anomaly detection model based on time series analysis is proposed to detect the network traffic anomaly accurately and ensure the network normal operation. The wavelet analysis is used to decompose the network traffic ac- cording to the similarity of the network traffic data, so as to divide it into the components with smaller scale. And then the gray model and Markov model of the time series analysis method are used to perform the network traffic anomaly detection for the high- frequency component and low frequency component respectively, their results are fused with the wavelet analysis, and analyzed with the simulation experiment of the network traffic anomaly. The results show that the time series analysis model has simple working process, increased the detection rate of the network traffic anomaly, its false alarm rate is lower than that of other net- work traffic anomaly detection models, and can obtain better real-time performance of the network traffic anomaly detection.

关 键 词：网络系统 流量异常检测 灰色模型 小波分析 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP391[自动化与计算机技术—计算机科学与技术]