Network flow rate abnormality detecting method based on super stochastic theory

Abstract

The invention discloses a method for detecting network traffic anomaly based on super-statistics theory, which comprises the steps that: (1) a distribution model is selected according to the actual characteristic of the network traffic and the distribution meets the requirements of test for the fitting of distribution of the network traffic; (2) slow variable sequence of the time sequence of the network traffic, namely, distribution parameter sequence, is calculated according to the distribution model; (3) the network traffic anomaly is detected according to the abnormal fluctuation of the slow variable sequence. By establishing the network traffic model based on the super-statistics (statistics of statistics), the method of the invention can describe the time sequence of the network traffic which shows abruptness, non-stationarity, long-range dependence and heavy-tail and carry out anomaly detection on the network traffic. The slow variable sequence of the time sequence of the network traffic calculated by the method of the invention accurately describes the characteristics of the network traffic; the network traffic can be accurately analyzed by analyzing the slow variable sequence and calculating work is greatly reduced. The experiments indicate that the method for detecting the network traffic anomaly based on the slow variable is obviously superior to the traditional detection method.

Description

technical field [0001] The present invention relates to technologies related to network information security and mathematical statistics, in particular to a network traffic anomaly detection method based on super-statistics, which can detect network faults and performance problems in time, and is useful for improving network availability and reliability and ensuring network service quality is of great significance. Background technique [0002] With the continuous development of the Internet, a large number of network attacks have occurred, resulting in abnormal network traffic, and the possibility of significantly degrading network service quality has greatly increased. By detecting network traffic anomalies, network faults and performance problems can be quickly discovered, and measures can be taken in time. It has strong real-time performance and is of great significance for improving network availability, reliability, and ensuring network service quality. [0003] The a...

AI Technical Summary

Problems solved by technology

[0006] Traditional short-term correlation models are difficult to accurately describe the long-term correlation and heavy-tail characteristics of network traffic, but these classic models have a sound theoretical basis, and the parameters of the model are easy to calculate

The long-term correlation model better describes the long-term correlation and heavy-tail characteristics of network traffic, but this advantage is limited to long-term correlation

For the short-term correlation characteristics in network traffic, the long-term correlation model is difficult to describe, and because the parameters of the long-term correlation model are usually difficult to estimate, this also limits the use of the long-term correlation model

Images