一种基于分组抽样的TRW改进算法

端口扫描是最常见的网络异常流量,TRW是端口扫描检测中最有代表性的算法之一。在高速网络环境下,网络测量通常采用分组抽样技术。已有的研究表明,分组抽样对原始流的流大小分布有细化和扭曲的作用,使得TRW检测算法随着抽样率的增加,成功检测率和误检率呈现出先增加后减少的趋势。本文提出了一种TRW的改进算法,原理是利用抽样后样本流中包含的TCP协议信息改善分组抽样下的流大小分布估计,从而提高TRW检测算法的有效性。实验证明,新算法与原算法相比,在成功检测率差不多的情况下,误检率明显降低了。

An Improved TRW Algorithm Based on Packet Sampling

The portscan is most popular anomaly in the network and the TRW is the most representative algorithm for the portscan detection.The packet sampling is currently the majority of packet selection method used by many business demands.Prior work has shown that the packet sampling thins traffic flows and impacts anomaly detection.The success ratio and the false negative ratio of the TRW initially increases for low sampling intervals before dropping off for high sampling intervals as the traffic is increasingly thinned.Based on previous researches , we design an improved TRW using theTCP protocol information in the sampling packet.Experimental results show that using the algorithm the false negative ratio drops off while the success ratio does not change.