Novel Traffic Sampling Method for Anomaly Detection

潘乔; 裴昌幸; 朱畅华

您当前的位置：

首页 >

文章列表页 >

Novel Traffic Sampling Method for Anomaly Detection

更新时间：2025-12-08

- Novel Traffic Sampling Method for Anomaly Detection
- Vol. 42, Issue 2, Pages: 175-178(2008)
- 作者机构：
  
  西安电子科技大学综合业务网国家重点实验室,西安,710071
- 作者简介：
- 基金信息：
- DOI：
  CLC： TP393
- Online First：10 February 2008，
  
  Published：2008
- 稿件说明：
移动端阅览
潘乔, 裴昌幸, 朱畅华. Novel Traffic Sampling Method for Anomaly Detection[J]. 2008, 42(2): 175-178.
DOI：

潘乔, 裴昌幸, 朱畅华. Novel Traffic Sampling Method for Anomaly Detection[J]. 2008, 42(2): 175-178. DOI：

摘要

为了减小抽样数据对网络异常检测的影响

提出了一种新的可变抽样率的网络流量抽样方法.通过利用哈希模式匹配算法

将到达的数据报文按流标识分类并记录下该报文在流中的位置

然后根据报文所属流的位置顺序减函数来设置不同的报文抽样概率.实验结果表明

所提方法增加了短流报文的抽样概率

解决了由于随机报文抽样方法偏向于长流抽样而导致的网络异常丢弃的问题

从而提高了异常检测的正确性.

Abstract

In order to reduce the impact of sampled traffic on network anomaly detecting

a novel method with variable sampling rates in traffic sampling is proposed. By using the hash pattern matching algorithm

the incoming packets are classified by flow's ID and the packet'spositions in the flow are recorded. Then

various sampling rates are specified according to the decreasing order function of the flow that the incoming packet belongs to. Experiment results show that the method increases the sampling rates to small flows

and resolves the problem that a great many network anomalies are discarded by the random packet sampling that has a bias towards large flows

and that the accuracy of anomaly detecting is improved.

关键词

Keywords

references

ZSEBY T, FOKUS F, MOLINA M, et al. Sampling and filtering techniques for IP packet selection [EB/OL].[2007-01-20]. http:∥www.ietf.org/html.charters/psamp-charter.html, 2007.

PAUL B, JEFFERY K, DAVID P, et al. A signal analysis of network traffic anomalies [C]∥Proceedings of ACM SIGCOMM Internet Measurement Workshop. New York: ACM Press, 2002:71-82.

AVINASH S, TAO Ye, SUPRATIK B. Connectionless port scan detection on the backbone [C]∥IEEE International Performance Computing and Communications Conference. Pisataway, USA:IEEE, 2006:567-576.

CHOI B Y, PARK J, ZHANG Zhili. Adaptive random sampling for traffic load measurement [C]∥Proceedings of IEEE International Conference on Communications. Piscataway, USA: IEEE, 2003:1552-1556.

MA Jianning, CHUAH Chen-Nee, ASHWIN S, et al. Is sampled data sufficient for anomaly detection [C]∥Proceedings of the 6th ACM SIGCOMM on Internet Measurement. New York: ACM Press, 2006:165-176.

CISCO Systems Inc. Random sampled NetFlow [EB/OL]. [2007-01-20]. http:∥www.cisco.com/en/US/products/ps6566/products_ feature_ guide 09186a008-0796a49.html.

BEVERLY R. MS-SQL slammer/sapphire traffic analysis [EB/OL]. [2007-01-20]. http:∥momo.lcs.mit. edu/slammer/.

APISDOR I J,CLAFFY K,THOMPSON K,et al. OC3MON: flexible, affordable, high performance statistics collection [C]∥Proceeding of the 7th Annual Conference of the Internet Society. Kuala Lumpur, Malaysia: The Internet Society, 1997:97-112.

LUND D N, THOURUP C M. Estimating flow distributions from sampled flow statistics [J]. IEEE/ACM Transactions on Networking, 2005, 13(5):933-946.

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

On-Line Anomaly Detection Method for Network Traffic Based on Adaptive Filtering

Numerical Simulation of the Energy Conversion Process in Thermoacoustic Engines with Different Stack Materials

Influence of Structural Parameters on the Summer Operational Characteristics of a Three-Tower-in-One Indirect Air-Cooling System

Effects of Steam Addition on the Swirl Combustion and Emission Characteristics of Cracked Ammonia

A Fast Calculation Method for Thermal Flow Fields in Transformer Windings Based on PI-DeepONet

Related Author

颜若愚 1

郑庆华 1

牛国林 1

Related Institution

School of Electronics and Information Engineering, Xi'an Jiaotong University

School of nformation Science, Guangdong Ocean University

⁰