云计算下大规模网络流量异常检测仿真  

Simulation of Large-Scale Network Traffic Anomaly Detection under Cloud Computing

作　　者：罗宏芳[1] 王春枝[2] LUO Hong-fang;WANG Chun-zhi(Hubei University of Technology Engineering and Technology College,Wuhan Hubei 430068,China;Hubei University of Technology School of Computer Science,Wuhan Hubei 430068,China)

机构地区：[1]湖北工业大学工程技术学院,湖北武汉430068 [2]湖北工业大学计算机学院,湖北武汉430068

出　　处：《计算机仿真》2023年第1期433-436,532,共5页Computer Simulation

基　　金：国家自然科学基金(61772180)。

摘　　要：云计算空间中存储着海量网络流量数据,若计算机频繁重复访问会产生网络崩溃情况,为此提出面向云计算的大规模网络流量异常检测方法。采用DWT信号处理方法提取网络流量特征,运用BIRCH算法聚类处理网络流量数据,通过大规模网络流量特征提取、聚类分析以及分组融合,得到流量数据分组。基于流量分组结果,基于NMF多源异常检测算法构建常规子空间、生成残余矩阵,并添加Shewhart控制图描述异常与正常数据之间的差别,判断网络流量是否为异常,根据判断结果实现网络流量异常检测。实验结果表明,所提方法的异常流量检测精度召回率和F1值均较高,能够有效提升检测效果。In this paper, a large-scale network traffic anomaly detection method for cloud computing was proposed. Firstly, the DWT signal method was used to extract network traffic features, and then BIRCH algorithm was adopted to cluster network traffic data. After the large-scale network traffic feature extraction, cluster analysis and grouped fusion, traffic data packets were obtained. Based on traffic grouping results, the NMF multi-source anomaly detection algorithm was used to construct a conventional subspace and generate a residual matrix. Meanwhile, a Shewhart control chart was added to describe the difference between abnormal data and normal data, thus judging whether the network traffic was abnormal. Finally, network traffic anomaly detection was achieved. Experimental results show that the proposed method has high detection accuracy, high recall rate as well as high F1 value, and can effectively improve the detection effect.

关 键 词：云计算 特征提取 控制图 流量异常检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]