【作者】 王风宇； 云晓春； 曹震中；

【Author】 Wang Feng-Yu~(1,2) Yun Xiao-Chun~1 Cao Zhen-Zhong~3 (1.Institute of Computing Technology,Chinese Academy of Sciences,Beijing 100080)2.Graduate University of Chinese Academy of Science, Beijing 100039)(3.Computer Science College,Qufu Normal University,Qufu 273165)

【机构】 中国科学院计算技术研究所信息智能与信息安全研究中心； 曲阜师范大学计算机科学学院；

【摘要】 高速网络流量吞吐量大且复杂多变,对网络流量异常检测的准确性和及时性提出了挑战。本文提出了一种多时间尺度同步的异常检测算法 DA-MTS。该算法通过无抽取 Haar 小波变换对网络流量时间序列进行分解,获得不同时间尺度下的细节信号,去冗余后的无抽取 Haar 小波变换细节信号为平稳随机序列且逼近高斯白噪声,根据正态分布的“3σ”法则可以判断细节信号中的异常情况。随着新数据的获取,该算法能够同时在多个时间尺度上以递推方式进行无延后的异常检测,不但提高了异常检测的准确性,而且保证了异常发现的及时性。分析和实验表明,该方法能够显著提高网络异常检测的性能。更多还原

【Abstract】 Due to the volume and complexity of high-speed network traffic, it’s difficult to detect anomaly timely and precisely.In this paper, we proposed an anomaly detection algorithm that can progress on several time-scales synchronously. Firstly, pre-process the time series of traffic with non-decimated Haar wavelet transform to produce detail signals, which are stationary random series and follow Gaussian white noise, then detect anomaly on principal of"3 o "of normal distribution. Along with the arriving of new data, this algorithm detects anomaly on several time-scales recursively without delay, so it can detect anomaly precisely and timely.Analysis and experiments reveal that this algorithm can improve the performance of anomaly detection obviously, o更多还原