通过研究网络异常检测,提出了一种基于流分解消除网络噪声的异常检测算法。该算法从高维、非平稳流量中分离出包含异常的随机部分,通过计算随机部分参数的边缘分布和残差,揭示了流量异常对随机部分参数的影响,并提出判断网络流量异常的参数标准。实验表明,由于不必将整个时间序列进行分片和单独拟合,算法可以直接处理非稳态流量数据,实现了真正意义上的网络异常检测功能。
Diagnosing anomalies are difficult problem because one must extract and interpret anomalous patterns from large amounts of high-dimensional, noisy data. In this paper the network traffic is validated to possess a non-stationary characteristic and a general method was proposed to diagnose anomalies. This method is based on a separation of the non-stationary traffic into disjoint components corresponding to normal and anomalous network conditions. This separation can be performed effectively by both marginal distribution and qq-plot analysis of parameters of anomalous component. We evaluate the method' s ability to diagnose both existing and synthetically injected traffic anomalies in real traffic. Experiment shows the method can: ①accurately detect when traffic anomaly is occurring; ②does so with a very low false alarm rate.