高速实时的一种邮件蠕虫异常检测模型

提出了一种基于带泄漏的积分触发测量方法的电子邮件蠕虫异常检测方法,用来检测邮件蠕虫在传播过程中的流量异常。根据邮件流量所表现出的明显的日周期特性和周周期特性,首先计算出当前邮件流量和历史邮件流量的最小Hellinger距离,通过带泄漏的积分触发方法把邮件流量的Hellinger积累起来,从而把邮件蠕虫在传播过程中没有明显流量特征的慢速酝酿阶段的异常特征进行积累,达到在其进入快速传播期之前检测出异常的目的。检测过程只需要检查邮件的流量信息,因而适合大规模高速网络的异常检测。

Real-time anomaly detection model for worm mails in high-speed network

An Email flow anomaly detection method based on leaky integrate-and-fire model was presented for detecting flow anomaly in the process of mail worm propagation.According to the day period and week period properties of the mail flow,Firstly the Hellinger distance between current mail flow and history statistic was calculated,and then integrate the Hellinger distance with Leaky integrate-and-fire method.In this way,the slice variety of flow was accumulated in the mail worm propagation slow start phase to archive the capability of the anomaly detection before the worm enter the fast spread phase.As this method only checks the mail flow information,it is suitable for high speed network mail flow anomaly detection.