| SDN架构下基于ICMP流量的网络异常检测方法 |
| |
| 引用本文： | 史振华,刘外喜,杨家烨.SDN架构下基于ICMP流量的网络异常检测方法[J].计算机系统应用,2016,25(4):135-142. |
| |
| 作者姓名： | 史振华 刘外喜 杨家烨 |
| |
| 作者单位： | 绍兴职业技术学院 信息工程学院, 绍兴 312000,广州大学 电子信息工程系, 广州 510006,广州大学 电子信息工程系, 广州 510006 |
| |
| 基金项目： | 浙江省教育厅科研项目(Y201534903);广东省自然科学基金(2014A030310349,2014A030313637);2014年大学生创新训练项目 |
| |
| 摘 要： | 互联网控制报文协议(Internet Control Message Protocol,ICMP)实时地反映着网络的状态,当网络故障或受到攻击时,ICMP报文在整个流量中出现的概率,以及ICMP流量中不同类型的报文比例等特征都会发生变化.本文利用ICMP流量小的特点,并结合SDN架构中控制面可对ICMP流量进行集中观察的优势,采用SVM分类的方法,提出一种轻量级的异常检测机制以改善异常检测的实时性和准确性——AD-ICMP-SDN(Anomaly Detection Method based on ICMP Traffic for SDN).实验结果证明,AD-ICMP-SDN在检测准确率和误报率等指标上展现了较好的性能.
|
| 关 键 词： | SDN 异常检测 支持向量机 ICMP |
| 收稿时间： | 2015/8/30 0:00:00 |
| 修稿时间： | 2015/10/14 0:00:00 |
Anomaly Detection Method Based on ICMP Traffic for SDN |
| |
| SHI Zhen-Hu,LIU Wai-Xi and Yang Jia-Ye.Anomaly Detection Method Based on ICMP Traffic for SDN[J].Computer Systems& Applications,2016,25(4):135-142. |
| |
| Authors: | SHI Zhen-Hu LIU Wai-Xi and Yang Jia-Ye |
| |
| Affiliation: | Information Engineering Institute, Shaoxing Vocational & Technical College, Shaoxing 312000, China,Department of Electronic and Information Engineering, Guangzhou University, Guangzhou 510006, China and Department of Electronic and Information Engineering, Guangzhou University, Guangzhou 510006, China |
| |
| Abstract: | ICMP(Internet Control Message Protocol) provides a good way to observe the status of network in real time. When the network is in fault or is attacked, the percent of ICMP traffic and the percent of packet type in ICMP characteristics will change. Since the control plane in Software-Defined Networking(SDN) can observe ICMP traffic, and the value of ICMP traffic is also small, this paper proposes a lightweight anomaly detection system based on SVM classification method to improve the accuracy and real-time performance of anomaly detection system. We name it as AD-ICMP-SDN(Anomaly Detection Method based on ICMP Traffic for SDN). The experiment results have shown that AD-ICMP-SDN can effectively improve the accuracy rate and false rate. |
| |
| Keywords: | SDN anomaly detection support vector machine ICMP |
|
| 点击此处可从《计算机系统应用》浏览原始摘要信息 |
|
点击此处可从《计算机系统应用》下载全文 |
|
