Diagnosing Traffic Anomalies Using a Two-Phase Model |
| |
Authors: | Bin Zhang Jia-Hai Yang Jian-Ping Wu Ying-Wu Zhu |
| |
Affiliation: | (1) Network Research Center, Tsinghua University, Beijing, 100084, China;(2) Tsinghua National Laboratory for Information Science and Technology (TNList), Beijing, China;(3) Department of Computer Science and Technology, Tsinghua University, Beijing, 100084, China |
| |
Abstract: | Network traffic anomalies are unusual changes in a network, so diagnosing anomalies is important for network management. Feature-based
anomaly detection models (ab)normal network traffic behavior by analyzing packet header features. PCA-subspace method (Principal
Component Analysis) has been verified as an efficient feature-based way in network-wide anomaly detection. Despite the powerful
ability of PCA-subspace method for network-wide traffic detection, it cannot be effectively used for detection on a single
link. In this paper, different from most works focusing on detection on flow-level traffic, based on observations of six traffic
features for packet-level traffic, we propose a new approach B6-SVM to detect anomalies for packet-level traffic on a single
link. The basic idea of B6-SVM is to diagnose anomalies in a multi-dimensional view of traffic features using Support Vector
Machine (SVM). Through two-phase classification, B6-SVM can detect anomalies with high detection rate and low false alarm
rate. The test results demonstrate the effectiveness and potential of our technique in diagnosing anomalies. Further, compared
to previous feature-based anomaly detection approaches, B6-SVM provides a framework to automatically identify possible anomalous
types. The framework of B6-SVM is generic and therefore, we expect the derived insights will be helpful for similar future
research efforts. |
| |
Keywords: | anomaly detection entropy support vector machine classification traffic feature |
本文献已被 CNKI SpringerLink 等数据库收录! |
|