基于网络聚合行为的异常检测方法研究

异常检测是目前入侵检测领域中非常活跃的一个方向,其作为一种网络测量手段,对于分组报头的信息统计在很多网络管理任务中扮演着重要的角色。将网络分组中报头的信息按不同方式汇聚起来,可以有效地构成网络流量属性的度量。从中提取的特定的子集在理论上可用于刻画网络流量中的攻击行为特征。如果这些度量在无攻击情况下能够表现出相对的稳定性,而在发生攻击时相对敏感,则可用于判断攻击的发生。并利用主成份分析和信息增益对冗余特征进行删减,能够使得判断攻击时需要的开销降低,增加实时性。基于机器学习的分类器是判断攻击导致的异常的有效手段。根据所选取的度量指标设计了三种分类器。

Anomaly Detection Based on Aggregated Network Behavior Metrics

Anomaly detection is a very active area of IDS.As a network measurement tool,anomaly detection plays an important role for a header statistical information in many network management tasks.Assembling the information of network packets can effectively constitute the network traffic measurement metrics.Extracting a specific subset from the metrics can be used to describe the flow of network attack characteristics.If these metrics show a relatively stable performance when there is no attack and a relatively se...