摘要
针对网络异常流量检测中大数据小异常造成的难题,提出了一种新的基于残差分析的网络异常流量检测方法。从多个角度提取网络流量的特征属性,以准确刻画正常行为和异常行为之间的差异性。利用提取的特征属性构建属性矩阵,采用流之间的相似性构建邻接矩阵。使用属性矩阵和邻接矩阵构建网络异常检测模型,采用CUR矩阵分解方法重构属性矩阵得到主模式,对属性矩阵和重构的属性矩阵进行残差计算进而获得残差矩阵。对残差矩阵中的每一个流计算其残差,根据每个流的残差和预设阈值进行异常判定。采集了西安交通大学校园网流量数据进行实验,实验结果表明:所提方法在不需要任何先验知识的情况下能够使异常检测率达到90%以上;与其他异常检测方法相比,所提方法不仅具有较高的检测率,而且能够实现异常源定位。
Focusing on the challenges caused by the increasing traffic volumes and the cunning abnormal attacks,a new algorithm for network anomaly detection by residual analysis is developed.The network behavior attributes from different aspects are described to characterize the differences between the normal and abnormal behavior.The attributes are extracted to construct an attribute matrix,and the similarity of the flows is considered to construct an adjacency matrix,the model of network anomaly detection is then established by the two matrices.CUR matrix decomposition is realized to reconstruct attribute matrix to obtain the primary pattern.The residual matrix is obtained by analyzing the difference between the attribute matrix and reconstructed attribute matrix.The anomalies can be distinguished according to the residual value of each flow.Experimental results based on the traces collected from the campus network of Xi’an Jiaotong University show that the proposed algorithm holds a detection accuracy higher than 90%without any prior knowledge.Compared with the other anomaly detection algorithms,the proposed one can determine the goal of anomaly location with higher detection accuracy.
作者
孟永伟
秦涛
赵亮
马文强
王换招
MENG Yongwei;QIN Tao;ZHAO Liang;MA Wenqiang;WANG Huanzhao(MOE Key Laboratory for Intelligent and Network Security,Xi’an Jiaotong University,Xi’an 710049,China;Shenzhen Institute of Science and Technology,Xi’an Jiaotong University,Shenzhen,Guangdong 518057,China;Xi’an Institute of Space Radio Technology,Xi’an 710100,China)
出处
《西安交通大学学报》
EI
CAS
CSCD
北大核心
2020年第1期42-48,84,共8页
Journal of Xi'an Jiaotong University
基金
国家自然科学基金资助项目(61772411)
深圳市基础研究计划资助项目(JCYJ20170816100819428)
陕西省自然科学基金资助项目(2018 JM6109)
关键词
异常检测
网络流量
矩阵分解
残差分析
anomaly detection
network traffic
matrix decomposition
residual analysis
