大规模校园网络子空间流量异常检测仿真  

Simulation of Traffic Anomaly Detection in Large Campus Network Subspace

作　　者：高廷红 赵军辉 GAO Ting-hong;ZHAO Jun-hui(Computer Department of Yishui Campus,Linyi University,Linyi Shandong 276400,China)

机构地区：[1]临沂大学沂水校区计算机系,山东临沂276400

出　　处：《计算机仿真》2024年第3期246-249,291,共5页Computer Simulation

摘　　要：与其它网络不同,校园网络功能分区较多,极易受到网络恶意攻击,为此提出一种大规模校园网络子空间流量异常检测算法。建立校园网络流量采集拓扑结构,按照IP地址段将网络划分为5个网段,利用NetFlow机制分别采集每个网段的流量数据;采用主成分分析法归一化处理采集的校园网络流量数据,通过建立样本矩阵,从大量的样本指标中筛选出主成分;将校园网络划分为正常子空间和异常子空间,并将流量测量向量映射到两个子空间中,位于门限值以外的点即为异常点,完成流量异常的检测。实验结果表明,所提方法可以精准检测网络流量异常,并取得理想的检测率和保持率。At present,the campus network has many functional partitions,so it is extremely vulnerable to malicious network attacks.To this end,this paper puts forward an algorithm for detecting subspace traffic anomalies in large-scale campus networks.First of all,the collection and topology of campus network traffic were constructed.According to IP address segments,the network was divided into five network segments.And then,the NetFlow mechanism was adopted to collect the traffic data of the network segment.Moreover,the principal component analysis method was used to normalize the collected data.After that,principal components were selected from a large number of samples by establishing a sample matrix.Furthermore,the campus network was divided into normal subspace and abnormal subspace,and the traffic measurement vectors were mapped into two subspaces.The points outside the threshold were abnormal points.Finally,the detection was achieved.Experimental results show that the proposed method can accurately detect network traffic anomalies,and achieves ideal detection rate and retention rate.

关 键 词：子空间方法 校园网络流量 地址段 主成分分析 归一化处理 

分 类 号：TP364[自动化与计算机技术—计算机系统结构]