一种用于异常检测的网络流量抽样方法

潘乔; 裴昌幸; 朱畅华

您当前的位置：

首页 >

文章列表页 >

一种用于异常检测的网络流量抽样方法

专题研究 | 更新时间：2025-12-08

- 一种用于异常检测的网络流量抽样方法
- Novel Traffic Sampling Method for Anomaly Detection
- 西安交通大学学报 2008年42卷第2期页码：175-178
- 作者机构：
  
  西安电子科技大学综合业务网国家重点实验室,西安,710071
- 作者简介：
- 基金信息：
  
  : 2007-06-27. 作者简介: 潘乔(1977-),男,博士生;裴昌幸(联系人),男,教授,博士生导师. 基金项目: 国家自然科学基金资助项目(60572147,60132030);陕西省科技攻关资助项目(2006K04-G33)
- DOI：
  中图分类号： TP393
- 网络首发：2008-02-10，
  
  纸质出版：2008
- 稿件说明：
移动端阅览
潘乔, 裴昌幸, 朱畅华. 一种用于异常检测的网络流量抽样方法[J]. 西安交通大学学报, 2008,42(2):175-178.

潘乔, 裴昌幸, 朱畅华. Novel Traffic Sampling Method for Anomaly Detection[J]. 2008, 42(2): 175-178.
潘乔, 裴昌幸, 朱畅华. 一种用于异常检测的网络流量抽样方法[J]. 西安交通大学学报, 2008,42(2):175-178. DOI：

潘乔, 裴昌幸, 朱畅华. Novel Traffic Sampling Method for Anomaly Detection[J]. 2008, 42(2): 175-178. DOI：

摘要

为了减小抽样数据对网络异常检测的影响

提出了一种新的可变抽样率的网络流量抽样方法.通过利用哈希模式匹配算法

将到达的数据报文按流标识分类并记录下该报文在流中的位置

然后根据报文所属流的位置顺序减函数来设置不同的报文抽样概率.实验结果表明

所提方法增加了短流报文的抽样概率

解决了由于随机报文抽样方法偏向于长流抽样而导致的网络异常丢弃的问题

从而提高了异常检测的正确性.

Abstract

In order to reduce the impact of sampled traffic on network anomaly detecting

a novel method with variable sampling rates in traffic sampling is proposed. By using the hash pattern matching algorithm

the incoming packets are classified by flow's ID and the packet'spositions in the flow are recorded. Then

various sampling rates are specified according to the decreasing order function of the flow that the incoming packet belongs to. Experiment results show that the method increases the sampling rates to small flows

and resolves the problem that a great many network anomalies are discarded by the random packet sampling that has a bias towards large flows

and that the accuracy of anomaly detecting is improved.

关键词

Keywords

references

ZSEBY T, FOKUS F, MOLINA M, et al. Sampling and filtering techniques for IP packet selection [EB/OL].[2007-01-20]. http:∥www.ietf.org/html.charters/psamp-charter.html, 2007.

PAUL B, JEFFERY K, DAVID P, et al. A signal analysis of network traffic anomalies [C]∥Proceedings of ACM SIGCOMM Internet Measurement Workshop. New York: ACM Press, 2002:71-82.

AVINASH S, TAO Ye, SUPRATIK B. Connectionless port scan detection on the backbone [C]∥IEEE International Performance Computing and Communications Conference. Pisataway, USA:IEEE, 2006:567-576.

CHOI B Y, PARK J, ZHANG Zhili. Adaptive random sampling for traffic load measurement [C]∥Proceedings of IEEE International Conference on Communications. Piscataway, USA: IEEE, 2003:1552-1556.

MA Jianning, CHUAH Chen-Nee, ASHWIN S, et al. Is sampled data sufficient for anomaly detection [C]∥Proceedings of the 6th ACM SIGCOMM on Internet Measurement. New York: ACM Press, 2006:165-176.

CISCO Systems Inc. Random sampled NetFlow [EB/OL]. [2007-01-20]. http:∥www.cisco.com/en/US/products/ps6566/products_ feature_ guide 09186a008-0796a49.html.

BEVERLY R. MS-SQL slammer/sapphire traffic analysis [EB/OL]. [2007-01-20]. http:∥momo.lcs.mit. edu/slammer/.

APISDOR I J,CLAFFY K,THOMPSON K,et al. OC3MON: flexible, affordable, high performance statistics collection [C]∥Proceeding of the 7th Annual Conference of the Internet Society. Kuala Lumpur, Malaysia: The Internet Society, 1997:97-112.

LUND D N, THOURUP C M. Estimating flow distributions from sampled flow statistics [J]. IEEE/ACM Transactions on Networking, 2005, 13(5):933-946.

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

自适应滤波实时网络流量异常检测方法

采用机器学习的大规模并行程序I/O性能建模与预测方法

张角凹坑气膜孔对双层壁气膜冷却特性的影响

三塔合一间接空冷系统结构参数对夏季运行特性的影响研究

电动车辆间接热系统快速除湿响应迟滞机理及优化控制策略