基于抽樣流長(zhǎng)與完全抽樣閾值的異常流自適應(yīng)抽樣算法
doi: 10.11999/JEIT141379
基金項(xiàng)目:
國(guó)家973計(jì)劃項(xiàng)目(2012CB315901, 2013CB329104)
Adaptive Flow Sampling Algorithm Based on Sampled Packets and Force Sampling Threshold S Towards Anomaly Detection
-
摘要: 高速IP網(wǎng)絡(luò)的流量測(cè)量與異常檢測(cè)是網(wǎng)絡(luò)測(cè)量領(lǐng)域研究的熱點(diǎn)。針對(duì)目前網(wǎng)絡(luò)流量測(cè)量算法對(duì)小流估計(jì)精度偏低，對(duì)異常流量篩選能力較差的缺陷，該文提出一種基于業(yè)務(wù)流已抽樣長(zhǎng)度與完全抽樣閾值S的自適應(yīng)流抽樣算法(AFPT)。AFPT算法根據(jù)完全抽樣閾值S篩選對(duì)異常流量敏感相關(guān)的小流，同時(shí)根據(jù)業(yè)務(wù)流已抽樣長(zhǎng)度自適應(yīng)調(diào)整抽樣概率。仿真和實(shí)驗(yàn)結(jié)果表明，AFPT算法的估計(jì)誤差與理論上界相符，具有較強(qiáng)的異常流量篩選能力，能夠有效提高異常檢測(cè)算法的準(zhǔn)確率。
-
關(guān)鍵詞:
- 網(wǎng)絡(luò)測(cè)量 /
- 自適應(yīng)流抽樣 /
- 異常檢測(cè)
Abstract: The network traffic measurement and anomaly detection for high-speed IP network become the hotspot research of network measurement field. Because the current measurement algorithms have large estimation error for the mice flows and poor performance for the sampling anomaly traffic, an Adaptive Flow sampling algorithm based on the sampled Packets and force sampling Threshold S (AFPT) is proposed. According to the force sampling threshold S, the AFPT is able to sample the mice flows which is sensitive to the anomaly traffic, while adaptive adjustment the probability of sampling based on the sampled packets. The simulation and experimental results show that the estimation error of AFPT is consistent with the theoretical upper bound, and provide better performance for the anomaly traffic sampled. The proposed algorithm can effectively improve the accuracy of anomaly detection algorithm. -
Zhou Ai-ping, Cheng Guang, and Guo Xiao-jun. High-speed network traffic measurement method[J]. Journal of Software, 2014, 25(1): 135-153. Peter Lieven and Bj?rnScheuermann. High-speed per-flow traffic measurement with probabilistic multiplicity counting [C]. Proceedings of the INFOCOM 2010, San Diego, CA, USA, 2010: 1-9. Cheng Guang and Tang Yong-ning. Estimation algorithms of the flow number from sampled packets on approximate approaches[J]. Journal of Software, 2013, 24(2): 255-265. Lee Y J, Yeh Y R, and Wang Y C F. Anomaly detection via online oversampling principal component analysis[J]. IEEE Transactions on Knowledge and Data Engineering, 2013, 25(7): 1460-1470. Pham D S, Venkatesh S, Lazarescu M, et al.. Anomaly detection in large-scale data stream networks[J]. Data Mining and Knowledge Discovery, 2014, 28(1): 145-189. Cai Yuan-jun, Wu Bin, Zhang Xin-wei, et al.. Flow identification and characteristics mining from internet traffic with hadoop[C]. Proceedings of the Computer Information and Telecommunication Systems (CITS), Jeju Island, Korea, 2014: 1-5. Brauckhoff D, Tellenbach B, Wagner A, et al.. Impact of packet sampling on anomaly detection metrics[C]. Proceedings. of the 6th ACM Sigcomm conference on Internet measurement, Rio de Janeiro, Brazil, 2006: 159-164. Mai Jian-ning, Chuah C N, Sridharan A, et al.. Is sampled data sufficient for anomaly detection?[C]. Proceedings of the 6th ACM Sigcomm Conference on Internet Measurement, Rio de Janeiro, Brazil, 2006: 165-176. Kumar A and Xu J. Sketch guided sampling using on-line estimates of flow size for adaptive data collection[C]. Proceedings of IEEE INFOCOM 2006, Barcelona, Spain, 2006: 1-11. Li Tao and Chen Shi-gang. Per-flow traffic measurement through randomized counter sharing[J]. IEEE ACM Transactions on Networking, 2012, 13(5): 325-336. 王蘇南. 高速?gòu)?fù)雜網(wǎng)絡(luò)環(huán)境下異常流量檢測(cè)技術(shù)研究[D]. [博士論文], 信息工程大學(xué), 2012:38-49. Wang Su-nan. Research on anomaly detection technology in high-speed complex network environment[D]. [Ph.D. dissertation], The PLA Information Engineering University, 2012: 38-49. 郭通. 基于自適應(yīng)流抽樣測(cè)量的網(wǎng)絡(luò)異常檢測(cè)技術(shù)研究[D]. [博士論文], 信息工程大學(xué), 2013: 38-49. Guo Tong. Research on network anomaly detection technology based on adaptive flow sampling measurement[D]. [Ph.D. dissertation], The PLA Information Engineering University, 2013: 38-49. Lakhina A, Crovella M, and Diot C. Mining anomalies using traffic feature distributions[C]. Proceedings of the 5th ACM Sigcomm Conference on Internet Measurement, Philadelphia, PA, USA, 2005: 217-228. -
計(jì)量
- 文章訪問(wèn)數(shù): 1424
- HTML全文瀏覽量: 183
- PDF下載量: 1187
- 被引次數(shù): 0
下載:
