基于多维时间序列分析的网络异常检测
Network Anomaly Detector Based on Multiple Time Series Analysis
作者：陈兴蜀(四川大学 网络空间安全研究院, 四川 成都 610065)；江天宇(四川大学 计算机学院, 四川 成都 610065)；曾雪梅(四川大学 网络空间安全研究院, 四川 成都 610065)；尹学渊(四川大学 计算机学院, 四川 成都 610065)；邵国林(四川大学 计算机学院, 四川 成都 610065)
Author：CHEN Xingshu(Cybersecurity Research Inst., Sichuan Univ., Chengdu 610065, China)；JIANG Tianyu(College of Computer Sci., Sichuan Univ., Chengdu 610065, China)；ZENG Xuemei(Cybersecurity Research Inst., Sichuan Univ., Chengdu 610065, China)；YIN Xueyuan(College of Computer Sci., Sichuan Univ., Chengdu 610065, China)；SHAO Guolin(College of Computer Sci., Sichuan Univ., Chengdu 610065, China)
收稿日期：2016-09-18 年卷（期）页码：2017,49(1):144-150
期刊名称：工程科学与技术
Journal Name：Advanced Engineering Sciences
关键字：异常检测;时间序列;网络流量;多维特征;网络安全
Key words：anomaly detection;time series;network traffic;multiple features;network security
基金项目：国家自然科学基金资助项目（61272447）
中文摘要
针对实际网络异常检测要求高检测率、低误报率的问题，提出了一种基于多维时间序列的检测方法。首先，通过对实际网络流量进行长期观测，提取多维特征对网络流量进行描述；然后，利用时间序列分析方法对多维特征进行预测，计算预测值与真实值的时间序列偏离度，并且实时更新偏离度，适应多变的网络环境；最后，利用支持向量机（SVM）算法对偏离度向量进行分类判别，判断是否发生异常。目前该方法已应用于校园网关键服务器的实时监测与防护工作中，实际服务器流量的预测、告警结果表明，该方法可以有效检测网络中的异常流量。
英文摘要
The anomaly detection of network traffic in practice requires both high detection rate and low false alarm rate.To address this problem,a detection approach based on multidimensional time series analysis was proposed.Firstly,the network traffic was observed in a long time,and multiple network features were chosen for building the network behavior model.Subsequently,multiple features were predicted by the method of time series analysis.Then the degree of deviation between the predict value and the real value was calculated and updated.Finally,the state of whether the network flow is normal was determined by using support vector machine to classify the degree of deviation in time series.This method has been applied to real-time monitoring and protection on a campus key server.The results showed that it can detect anomalies effectively in network traffic.
【关闭】
