ODA-IPNMF: 一种在线全网络流量异常检测方法

为实时、高效地检测网络流量异常,提出一种基于增量投影非负矩阵分解(IPNMF)的全网络流量异常检测方法(ODA-IPNMF).提出一种增量投影非负矩阵算法,该算法不仅具有与PCA相同的表达形式,还能以增量的方式构建正常子空间和异常子空间,进而利用Shewhart控制图实现全网络流量异常的在线检测.理论分析表明,该方法计算开销远小于NMF-NAD,具有更高的实用价值;模拟网络数据以及实测网络数据实验表明,基于NMF异常检测方法(NMF-NAD和ODAIPNMF)的检测性能优于PCA方法;本文所提ODA-IPNMF与NMF-NAD网络异常检测效果相当,且可在线检测网络异常.

ODA-IPNMF: An Online Anomaly Detection Algorithm

An online anomaly detection algorithm based on incremental projective non-negative matrix factorization is proposed to detect the network anomaly real-timely and efficiently. Firstly, an incremental projective non-negative matrix factorization is given, which has the same expression with PCA, and is able to construct normal and abnormal subspace to detect network-wide anomalies online by Shewhart control chart. Theoretic analysis indicates that, the proposed algorithm computation is far smaller than NMF-NAD. In addition, traffic matrix datasets analyzing for internet and simulation results show that the network anomalies detection algorithms based on NMF(such as NMF-NAD and ODA-IPNMF) performs better than that based on PCA, and the proposed ODA-IPNMF has comparable network anomaly detection by NMF-NAD, which the ability to detect the network anomaly online.