一种网络异常实时检测方法

传统的网络管理工具通常根据预先设定的阈值来报警，这种方法虽然简单，但适应性不好．因此出现了网络异常检测技术，有时异常检测技术不但能发现网络故障，而且具有预警的效果1]；该文介绍了一种新的实时网络流量异常检测方法，转换网络流量观测值序列并假定序列的局部是平稳的，然后建立AR模型，定义一个统计量来检测异常．结果表明，该检测方法具有GLR测试方法所没有的优点．

A Real-Time Detection Method for Network Traffic Anomalies

The traditional network management tools usually generate alarms according to the preset threshold. This method is straightforward, but it has poor adaptability. Therefore, the technique to detect network anomaly appeared, sometimes it can find even predict faults of the network. In this paper, a novel method to detect network anomaly is introduced. According to the method, the observation series of network traffic is transformed and assumed to be stationary, an AR model is built to fit it, and a statistic is defined for network anomaly detection. The result shows that the proposed method has more advantages compared with GLR method.