基于主成分分析的实时全网络异常检测方法

doi:10.16180/j.cnki.issn1007-7820.2019.12.004

电子科技 ›› 2019, Vol. 32 ›› Issue (12): 17-21.doi: 10.16180/j.cnki.issn1007-7820.2019.12.004

基于主成分分析的实时全网络异常检测方法

张天奇,张顺康

南京航空航天大学计算机科学与技术学院,江苏南京 211106

收稿日期:2018-12-05 出版日期:2019-12-15 发布日期:2019-12-24
作者简介:张天奇(1995-),男,硕士研究生。研究方向:网络功能虚拟化,网络测量。|张顺康(1995-),男,硕士研究生。研究方向:计算机网络、网络功能虚拟化。
基金资助:
江苏省研究生科研与实践创新计划项目(KYCX18_0308)

A Real-time Full Network Performance Anomaly Detection Algorithm Based on Principal Component

ZHANG Tianqi,ZHANG Shunkang

School of Computer Science and Technology,Nanjing University of Aeronautics and Astronautics,Nanjing 211106,China

Received:2018-12-05 Online:2019-12-15 Published:2019-12-24
Supported by:
Postgraduate Research & Practice Innovation Programe of Jiangsu Province(KYCX18_0308)

摘要/Abstract

摘要：

网络性能异常检测对于促进网络健康发展具有重要意义。针对目前全网性能异常检测大多通过离线检测,无法提供良好的实时在线检测性能的问题。文中采用主成分分析方法建立异常检测模型,结合历史性能数据和近期网络性能波动状况去适应性调整网络异常判断阈值,实现了异常检测的实时在线化,并在NFV网络上进行数据采集。实验结果表明,与被广泛采用的离线检测方法比较,该方法在检测的误报率上减少了5%8%,对于网络运行商而言具有较大的使用价值。

关键词: 异常检测, 网络性能矩阵, 主成分分析, 滑动窗口, 动态阈值, 在线实时检测

Abstract:

Network performance anomaly detection is of great significance to promote the healthy development of the network. In order to solve the problem that the existing anomaly detection methods are mostly offline and cannot provide good real-time online detection performance, the principal component analysis method was used to establish the anomaly detection model, and the network anomaly detection threshold was adjusted adaptively by combining historical performance data with recent network performance fluctuations. The real-time online anomaly detection was realized and the data was collected on NFV network. The experimental results showed that the proposed method reduced the false alarm rate by 5% to 8% compared with the offline detection method which was widely used, indicating the greater use value of the proposed method for network operators.

Key words: anomalydetection, network performance matrix, principal component analysis, slidingwindow, dynamicthreshold, online real-time monitoring

中图分类号:

TP915.08

张天奇,张顺康. 基于主成分分析的实时全网络异常检测方法[J]. 电子科技, 2019, 32(12): 17-21.

ZHANG Tianqi,ZHANG Shunkang. A Real-time Full Network Performance Anomaly Detection Algorithm Based on Principal Component[J]. Electronic Science and Technology, 2019, 32(12): 17-21.

图/表 4

参考文献 16

[1]	Odom W. Cisco CCENT/CCNA ICND1 100-101 official cert guide[M]. Indianapolis: Cisco Press, 2016.
[2]	郭通, 兰巨龙, 李玉峰 . 基于量子自适应粒子群优化径向基函数神经网络的网络流量预测[J]. 电子与信息学报, 2013,35(9):2220-2226. doi: 10.3724/SP.J.1146.2012.01343
	Guo Tong, Lan Julong, Li Yufeng . Network traffic prediction based on quantum adaptive particle swarm optimization radial basis function neural network[J]. Journal of Electronics and Information, 2013,35(9):2220-2226. doi: 10.3724/SP.J.1146.2012.01343
[3]	Aubry F, Lebrun D, Vissicchio S , et al. SCMon: Leveraging segment routing to improve network monitoring [C].San Francisco:The IEEE International Conference on Computer Communications,IEEE, 2016.
[4]	钱叶魁, 陈鸣, 叶立新 . 基于多尺度主成分分析的全网络异常检测方法[J]. 软件学报, 2012,23(2):361-377.
	Qian Yekui, Chen Ming, Ye Lixin . Full network anomaly detection method based on multi-scale principal component analysis[J]. Journal of Software, 2012,23(2):361-377.
[5]	Chen Wenji, Liu Yang, Guan Yong . Cardinality change-based early detection of large-scale cyber-attacks [C].Turin:Proceeding of IEEE Infocom, 2013.
[6]	Bhuyan M H, Bhattacharyya D K, Kalita J K . Networkanomaly detection: methods, systems and tools[J]. IEEE Communications Surveys&Tutorials, 2014,16(1):303-336. doi: 10.1109/TOH.2019.2925339 pmid: 31251195
[7]	Zhang Jing Paschalidis,Loannis . Statistical anomaly detection via composite hypojournal testing for Markov models[J]. IEEE Transactions on Signal Processing, 2017,66(3):589-602. doi: 10.1109/TSP.2017.2771722
[8]	Agrawal S, Agrawal J . Survey on anomaly detection using data mining techniques[J]. Procedia Computer Science, 2015,60(1):708-713. doi: 10.3390/s131012929 pmid: 24072029
[9]	Mascaro S, Nicholso A E, Korb K B . Anomaly detection in vessel tracks using Bayesian networks[J]. International Journal of Approximate Reasoning, 2014,55(1):84-98. doi: 10.1016/j.ijar.2013.03.012
[10]	Ahmed T, Coates M, Lakhina A . Multivariate online anomaly detection using kernel recursive least squares [C].Alaska:Infocom IEEE International Conference on Computer Communications,IEEE, 2007.
[11]	赵雷, 苏庆刚, 罗宜元 . 一种基于MIB信息熵统计的网络异常检测方法[J]. 上海电机学院学报, 2015,18(2):95-101.
	Zhao Lei, Su Qinggang, Luo Yiyuan . Anetwork anomaly detection method based on MIB information entropy statistics[J]. Journal of Shanghai Dianji University, 2015,18(2):95-101.
[12]	Qian Yekui, Chen Ming . Amatrix-based method for evaluating ISP network performance [C].Wuhan:International Workshop on Education Technology & Computer Science, 2009.
[13]	王晓鸽 . 基于PGM-NMF的网络流量异常检测研究[J]. 电子科技, 2014,27(5):175-178.
	Wang Xiaoge . Research on network traffic anomaly detection based on PGM-NMF[J]. Electronic Secience and Technology, 2014,27(5):175-178.
[14]	Barford P, Duffield G N, Ron A , et al. Network Performance Anomaly Detection and Localization [C]. Rio de Janeiro:Infocom IEEE,IEEE, 2009.
[15]	Grill M, Pevny M, Rehak M . Reducing false positives of network anomaly detection by local adaptive multivariate smoothing[J]. Journal of Computer & System Sciences, 2017,83(1):43-57. doi: 10.1007/s11096-019-00949-6 pmid: 31865596
[16]	Emma D, Pescape A, Ventre G . Analysis and experimentation of an open distributed platform for synthetic traffic generation [C].Sedona:IEEE International Workshop on Future Trends of Distributed Computing Systems,IEEE, 2004.

基于主成分分析的实时全网络异常检测方法

A Real-time Full Network Performance Anomaly Detection Algorithm Based on Principal Component

RichHTML

PDF (PC)

赞

可视化

摘要/Abstract

引用本文

使用本文

图/表 4

参考文献 16

相关文章 15

Metrics

本文评价

推荐阅读 10

[1]	程晓雅,张雷. 基于深度学习的有遮挡人脸识别方法研究[J]. 电子科技, 2022, 35(1): 35-39.
[2]	彭荣杰,彭亚雄,陆安江. 基于改进PCA+SVM的人脸识别系统[J]. 电子科技, 2021, 34(12): 56-61.
[3]	邹俊晨,齐金鹏,李娜,刘佳伦,朱厚杰. 一种快速的突变点在线检测算法设计与实现[J]. 电子科技, 2020, 33(8): 10-16.
[4]	万东燕,许桢英,杨卿,吴梦琪. 基于PCA与SVM的焊缝缺陷信号分类方法[J]. 电子科技, 2020, 33(5): 9-14.
[5]	熊士婷,张玉金,刘婷婷,方翔宇. 基于最优颜色通道的图像拼接检测[J]. 电子科技, 2020, 33(12): 49-53.
[6]	缪冉,李菲菲,陈虬. 基于卷积神经网络与多尺度空间编码的场景识别方法[J]. 电子科技, 2020, 33(12): 54-58.
[7]	刘芬. 基于线性和非线性算法的高效人脸识别系统[J]. 电子科技, 2019, 32(7): 82-86.
[8]	侯严明,李菲菲,陈虬. 基于多特征融合的视频检索算法[J]. 电子科技, 2019, 32(5): 44-49.
[9]	褚天,潘金满,杜磊. 基于自适应滑动窗口的RFID漏读数据清洗算法[J]. , 2016, 29(4): 24-.
[10]	吴健健,陈玮. 基于多特征融合与支持向量机的手势识别[J]. , 2015, 28(5): 127-.
[11]	翟小超. 基于可变阈值的无线传感网络异常值检测[J]. , 2015, 28(2): 18-.
[12]	穆新亮. 基于混合核函数的快速KPCA人脸识别算法[J]. , 2015, 28(2): 46-.
[13]	江楠,徐秦. 数据流聚类算法在数据处理中的应用[J]. , 2015, 28(1): 155-.
[14]	王晓鸽. 基于PGM-NMF的网络流量异常检测研究[J]. , 2014, 27(5): 175-.
[15]	穆新亮, 武亚静. 基于双向主成分分析和压缩感知的人脸识别算法[J]. , 2014, 27(1): 45-.