自适应滤波实时网络流量异常检测方法

针对网络中的各种常见攻击,提出一种基于自适应滤波的网络流量异常检测方法.首先对多种流量指标进行递推最小二乘法预测,然后以预测误差所构造的统计量容许范围进行异常检测,最后对检测结果实施归一化评估.该方法具有无需任何历史训练数据、能大量减少报警次数、突出报警严重程度的特点.在DARPA入侵检测评估数据集上的实验表明,所提方法更适合检测拒绝服务攻击引起的异常,较之相同权向量下的同类方法,其异常检测率、误报率和检测速度等性能更好.

On-Line Anomaly Detection Method for Network Traffic Based on Adaptive Filtering

A network traffic anomaly detection method based on adaptive filter is proposed to de-tect all kinds of network traffic attacks.Multiple network traffic indicators are predicted by re-cursive least square and the allowable statistical range based on the prediction errors are used to detect anomaly.Detection results are finally normalized.The method has the following traits:no training from any historical data,reducing the number of alarms,remarkably,and highlighting the severity of alarms.Testing results on DARPA intrusion detection data sets show that the proposed method is more suitable to detect denial of service attacks,and has a higher detection rate,faster speed and lower alarm rate than similar existing methods with same dimension of weight vectors.