自适应滤波实时网络流量异常检测方法

颜若愚 1; 2; 郑庆华 1; 牛国林 1

您当前的位置：

首页 >

文章列表页 >

自适应滤波实时网络流量异常检测方法

更新时间：2025-07-09

- 自适应滤波实时网络流量异常检测方法
- On-Line Anomaly Detection Method for Network Traffic Based on Adaptive Filtering
- 西安交通大学学报 2009年43卷第12期页码：1-5
- 作者机构：
  
  1. 西安交通大学电子与信息工程学院,西安,710049
  2. 广东海洋大学信息学院,广东,湛江,524088
- 作者简介：
- 基金信息：
  
  : 2009-03-17. 作者简介: 颜若愚(1974-),男,博士生;郑庆华(联系人),男,教授,博士生导师. 基金项目: 国家自然科学基金资助项目(60633020, 60473136);国家高技术研究发展计划资助项目(2006BAH02A24-2, 2006BAK11B02, 2007AA01Z475, 2008AA01Z415)
- DOI：
  中图分类号： TP393
- 网络首发：2009-12-10，
  
  纸质出版：2009
- 稿件说明：
移动端阅览
颜若愚 1, 2, 郑庆华 1, 等. 自适应滤波实时网络流量异常检测方法[J]. 西安交通大学学报, 2009,43(12):1-5.

On-Line Anomaly Detection Method for Network Traffic Based on Adaptive Filtering[J]. 2009, 43(12): 1-5.
颜若愚 1, 2, 郑庆华 1, 等. 自适应滤波实时网络流量异常检测方法[J]. 西安交通大学学报, 2009,43(12):1-5. DOI：

On-Line Anomaly Detection Method for Network Traffic Based on Adaptive Filtering[J]. 2009, 43(12): 1-5. DOI：

摘要

针对网络中的各种常见攻击

提出一种基于自适应滤波的网络流量异常检测方法.首先对多种流量指标进行递推最小二乘法预测

然后以预测误差所构造的统计量容许范围进行异常检测

最后对检测结果实施归一化评估.该方法具有无需任何历史训练数据、能大量减少报警次数、突出报警严重程度的特点.在DARPA入侵检测评估数据集上的实验表明

所提方法更适合检测拒绝服务攻击引起的异常

较之相同权向量下的同类方法

其异常检测率、误报率和检测速度等性能更好.

Abstract

A network traffic anomaly detection method based on adaptive filter is proposed to detect all kinds of network traffic attacks. Multiple network traffic indicators are predicted by recursive least square and the allowable statistical range based on the prediction errors are used to detect anomaly. Detection results are finally normalized. The method has the following traits: no training from any historical data

reducing the number of alarms

remarkably

and highlighting the severity of alarms. Testing results on DARPA intrusion detection data sets show that the proposed method is more suitable to detect denial of service attacks

and has a higher detection rate

faster speed and lower alarm rate than similar existing methods with same dimension of weight vectors.

关键词

Keywords

references

姚婷婷, 郑庆华, 管晓宏, 等. 一种基于主机实时流量的安全评估方法[J].西安交通大学学报,2006,40(4):415-419.

YAO Tingting, ZHENG Qinghua, GUAN Xiaohong,et al. Security evaluation method based on real time traffic of hosts [J]. Journal of Xi'an Jiaotong University, 2006, 40(4): 415-419.

邹柏贤. 一种网络异常实时检测方法[J]. 计算机学报, 2003, 26(8): 940-947.

ZOU Boxian. A real-time detection method for network traffic anomalies [J]. Chinese Journal of Computers, 2003, 26(8): 940-947.

曹晓梅,韩志杰,陈贵海.基于流量预测的传感器网络拒绝服务攻击检测方案[J]. 计算机学报, 2007, 30(10): 1798-1805.

CAO Xiaomei,HAN Zhijie, CHEN Guihai. DoS attack detection scheme for sensor networks based on traffic prediction [J]. Chinese Journal of Computers, 2007, 30(10): 1798-1805.

ZARE M H, MASNADI-SHIRAZI M A. Arima model for network traffic prediction and anomaly detection[C]∥Proceedings of ITSim International Symposium on Information Technology. Piscataway, NJ, USA: IEEE, 2008:1-6.

VOELKER M D, SAVAGE S G M. Inferring internet denial-of-service activity [C]∥Proceeding of the 10th USENIX Security Symposium. Berkeley, CA, USA: The Advanced Computing Systems Association, 2001:9-22.

Massachusetts Institute of Technology. Lincoln. Laboratory. DARPA intrusion detection evaluation[EB/OL].(2008-06-01)[2009-03-02]. http:∥www.ll.mit.edu/IST/ideval/data/data-index.html.

AUGUSTIN S, KAVE S, NINA T. Combining filtering and statistical methods for anomaly detection [C]∥Prceedings of USENIX Association Internet Measurement Conference. Berkeley, CA, USA: The Advanced Computing Systems Association, 2005:331-344.

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

使用交叉熵检测和分类网络异常流量

一种用于异常检测的网络流量抽样方法

轻量级主机数据采集与实时异常事件检测方法研究

盾构机刀盘主驱动电机异常检测与性能评估

混合电解槽阵列协同的风光耦合制氢系统双层多目标优化