基于概要数据结构可溯源的异常检测方法

提出一种基于sketch概要数据结构的异常检测方法.该方法实时记录网络数据流信息到sketch数据结构,然后每隔一定周期进行异常检测.采用EWMA(exponentially weighted moving average)预测模型预测每一周期的预测值,计算观测值与预测值之间的差异sketch,然后基于差异sketch采用均值均方差模型建立网络流量变化参考.该方法能够检测DDoS、扫描等攻击行为,并能追溯异常的IP地址.通过模拟实验验证,该方法占用很少的计算和存储资源,能够检测骨干网络流量中的异常IP地址.

Sketch-Based Anomalies Detection with IP Address Traceability

In this paper, an anomaly detection method is proposed based on the summary data structure-sketch. It records the network traffic information in sketch online and detects anomalies at every circle. After using EWMA forecasting model to get each circle's forecast sketch, this paper computes the errors between the recoded sketch and forecast sketch. Then, the network traffic change reference is constructed by establishing the Mean-Standard deviation model on the error sketch. The method is effective in detecting DDOS attack, scan attack and so on. Particularly, it can track the IP address of anomaly. Evaluated by the experiment, this method can detect anomaly in the backbone network with small computing and memory resource.