基于熵和线性关系的两级流量异常检测方法  

Two-Stage Traffic Anomaly Detection Method Based on Entropy and Linear Relation

作　　者：邱雪松[1] 张珣 宋彦斌 赵兵[3] 徐思雅[1] QUI Xue-song;ZHANG Xun;SONG Yan-bin;ZHAO Bing;XU Si-ya(State Key Laboratory of Networking and Switching Technology,Beijing University of Posts and Telecommunications,Beijing 100876,China;Beijing Smartchip Microelectronics Technology Company Limited,Beijing 102200,China;China Electric Power Research Institute,Beljing 100192,China)

机构地区：[1]北京邮电大学网络与交换技术国家重点实验室,北京100876 [2]北京智芯微电子科技有限公司,北京102200 [3]中国电力科学研究院,北京100192

出　　处：《北京邮电大学学报》2018年第4期56-62,共7页Journal of Beijing University of Posts and Telecommunications

基　　金：国家自然科学基金项目(61702048)

摘　　要：提出了一种基于熵和线性关系的两级流量异常检测方法,综合考虑了流量异常检测方法的准确性和实时性要求.该方法在时间域上设定两级动态阈值,采用基于熵的方法对异常时间点进行检测,对熵值变化程度明显的时间点可使用一级阈值检测出来,而对熵值变化程度处于一级阈值和二级阈值之间的时间点采用基于线性关系的方法再次进行检测,并通过定义的报警触发函数识别异常类型.仿真实验结果证明,该方法在准确性和实时性方面优于现有的方法.To improve the accuracy and real-time traffic anomaly detection methods,a two-stage traffic anomaly detection method based on entropy and linear relation was presented. A two-level dynamic threshold was set and used based on entropy and linear relation to detect abnormal traffic in time domain.The type of traffic anomaly can be indentified through the alarm trigger function. Simulations verify that this method is superior to the existing methods in the accuracy and real-time respects.

关 键 词：流量异常检测 熵 线性关系 两级阈值 

分 类 号：TN929.53[电子电信—通信与信息系统]