基于流量行为特征的网络异常稳定识别仿真  

Simulation of Network Anomaly Stability Identification Based on Traffic Behavior Characteristics

作　　者：任立胜 陈红红 包永红[1] REN Li-sheng;CHEN Hong-hong;BAO Yong-hong(Inner Mongolia Agricultural University,Department of Computer Technology&Information Management,Huhehot Inner Mongolia 010018,China)

机构地区：[1]内蒙古农业大学计算机技术与信息管理系,内蒙古呼和浩特010018

出　　处：《计算机仿真》2023年第8期403-407,共5页Computer Simulation

基　　金：内蒙古自治区科技厅科研计划项目(2020GG0033)。

摘　　要：异常行为识别是保证网络安全运行不可缺少的步骤,但异常行为识别过程易受噪声流量、网络性能、冗余信号的干扰。为了解决上述问题,提出基于流量行为特征的网络异常行为识别方法。采用提升小波变换法剔除网络流量中的噪声,避免识别过程受到噪声干扰,采用矢量量化技术与主题模型提取流量行为特征,将提取的特征输入到支持向量机模型中,利用支持向量机的二分类特性实现特征的分类,完成网络异常行为的识别。实验结果表明,所提方法的异常识别精度高,且AUC-PR数值比较稳定,说明其在识别过程中不受噪声数据的影响。Abnormal behavior identification is an indispensable step to ensure the safe operation of the network.However,the identification process is easily disturbed by noise traffic,network performance and redundant signals.Therefore,this paper presented a method of identifying network abnormal behaviors based on traffic behavior characteristics.Firstly,the lifting wavelet transform was used to remove the noise in network traffic,thus avoiding noise interference in the identification process.Secondly,vector quantization technology and topic model were used to extract the traffic behavior characteristics,and then these characteristics were input into the support vector machine model.Based on the binary characteristic of the support vector machine,the features were classified.Finally,the identification of abnormal network behavior was completed.Experimental results show that the proposed method has high accuracy of anomaly identification and stable AUC-PR value,indicating that is not affected by noise data.

关 键 词：提升小波变换 分裂函数 矢量量化 主题模型 流量行为特征 分类超平面 

分 类 号：U463.67[机械工程—车辆工程]