基于抽樣流長與完全抽樣閾值的異常流自適應(yīng)抽樣算法
doi: 10.11999/JEIT141379 cstr: 32379.14.JEIT141379
基金項目:
國家973計劃項目(2012CB315901, 2013CB329104)
Adaptive Flow Sampling Algorithm Based on Sampled Packets and Force Sampling Threshold S Towards Anomaly Detection
-
摘要: 高速IP網(wǎng)絡(luò)的流量測量與異常檢測是網(wǎng)絡(luò)測量領(lǐng)域研究的熱點。針對目前網(wǎng)絡(luò)流量測量算法對小流估計精度偏低,對異常流量篩選能力較差的缺陷,該文提出一種基于業(yè)務(wù)流已抽樣長度與完全抽樣閾值S的自適應(yīng)流抽樣算法(AFPT)。AFPT算法根據(jù)完全抽樣閾值S篩選對異常流量敏感相關(guān)的小流,同時根據(jù)業(yè)務(wù)流已抽樣長度自適應(yīng)調(diào)整抽樣概率。仿真和實驗結(jié)果表明,AFPT算法的估計誤差與理論上界相符,具有較強的異常流量篩選能力,能夠有效提高異常檢測算法的準(zhǔn)確率。
-
關(guān)鍵詞:
- 網(wǎng)絡(luò)測量 /
- 自適應(yīng)流抽樣 /
- 異常檢測
Abstract: The network traffic measurement and anomaly detection for high-speed IP network become the hotspot research of network measurement field. Because the current measurement algorithms have large estimation error for the mice flows and poor performance for the sampling anomaly traffic, an Adaptive Flow sampling algorithm based on the sampled Packets and force sampling Threshold S (AFPT) is proposed. According to the force sampling threshold S, the AFPT is able to sample the mice flows which is sensitive to the anomaly traffic, while adaptive adjustment the probability of sampling based on the sampled packets. The simulation and experimental results show that the estimation error of AFPT is consistent with the theoretical upper bound, and provide better performance for the anomaly traffic sampled. The proposed algorithm can effectively improve the accuracy of anomaly detection algorithm. -
Zhou Ai-ping, Cheng Guang, and Guo Xiao-jun. High-speed network traffic measurement method[J]. Journal of Software, 2014, 25(1): 135-153. Peter Lieven and Bj?rnScheuermann. High-speed per-flow traffic measurement with probabilistic multiplicity counting [C]. Proceedings of the INFOCOM 2010, San Diego, CA, USA, 2010: 1-9. Cheng Guang and Tang Yong-ning. Estimation algorithms of the flow number from sampled packets on approximate approaches[J]. Journal of Software, 2013, 24(2): 255-265. Lee Y J, Yeh Y R, and Wang Y C F. Anomaly detection via online oversampling principal component analysis[J]. IEEE Transactions on Knowledge and Data Engineering, 2013, 25(7): 1460-1470. Pham D S, Venkatesh S, Lazarescu M, et al.. Anomaly detection in large-scale data stream networks[J]. Data Mining and Knowledge Discovery, 2014, 28(1): 145-189. Cai Yuan-jun, Wu Bin, Zhang Xin-wei, et al.. Flow identification and characteristics mining from internet traffic with hadoop[C]. Proceedings of the Computer Information and Telecommunication Systems (CITS), Jeju Island, Korea, 2014: 1-5. Brauckhoff D, Tellenbach B, Wagner A, et al.. Impact of packet sampling on anomaly detection metrics[C]. Proceedings. of the 6th ACM Sigcomm conference on Internet measurement, Rio de Janeiro, Brazil, 2006: 159-164. Mai Jian-ning, Chuah C N, Sridharan A, et al.. Is sampled data sufficient for anomaly detection?[C]. Proceedings of the 6th ACM Sigcomm Conference on Internet Measurement, Rio de Janeiro, Brazil, 2006: 165-176. Kumar A and Xu J. Sketch guided sampling using on-line estimates of flow size for adaptive data collection[C]. Proceedings of IEEE INFOCOM 2006, Barcelona, Spain, 2006: 1-11. Li Tao and Chen Shi-gang. Per-flow traffic measurement through randomized counter sharing[J]. IEEE ACM Transactions on Networking, 2012, 13(5): 325-336. 王蘇南. 高速復(fù)雜網(wǎng)絡(luò)環(huán)境下異常流量檢測技術(shù)研究[D]. [博士論文], 信息工程大學(xué), 2012:38-49. Wang Su-nan. Research on anomaly detection technology in high-speed complex network environment[D]. [Ph.D. dissertation], The PLA Information Engineering University, 2012: 38-49. 郭通. 基于自適應(yīng)流抽樣測量的網(wǎng)絡(luò)異常檢測技術(shù)研究[D]. [博士論文], 信息工程大學(xué), 2013: 38-49. Guo Tong. Research on network anomaly detection technology based on adaptive flow sampling measurement[D]. [Ph.D. dissertation], The PLA Information Engineering University, 2013: 38-49. Lakhina A, Crovella M, and Diot C. Mining anomalies using traffic feature distributions[C]. Proceedings of the 5th ACM Sigcomm Conference on Internet Measurement, Philadelphia, PA, USA, 2005: 217-228. -
計量
- 文章訪問數(shù): 1467
- HTML全文瀏覽量: 198
- PDF下載量: 1189
- 被引次數(shù): 0