Neural network-based low amplitude network flow anomaly detection method

Abstract

The invention discloses a neural network-based low amplitude network flow anomaly detection method. In the method, a neural network module comprises a second multilayer recurrent neural network and a first multilayer recurrent neural network, the input of the second multilayer recurrent neural network is directly measurable link flow, and the output of the second multilayer recurrent neural network is the estimated flow of part of origin-destination (OD) flow; and the input of the first multilayer recurrent neural network is the link flow and the estimated flow of the part of OD flow, which is output by the second multilayer recurrent neural network and serves as supplementary constraint input, and the output of the first multilayer recurrent neural network is the estimated value of a characteristic parameter. In the invention, the step of inversion from a link to the OD flow is skipped, so the influences of errors generated in a prediction process on a detection step are avoided effectively, and the real-time prediction of the OD flow correlation at next moment can be provided. When the method is used, the detection of hidden flow anomaly is easier, the detection process does not completely rely on the estimation from the link to the OD flow any more, the problem that the inversion error influences the detection is solved, and the frame allows for estimation from link flow to multiple OD flow characteristic parameters.

Description

technical field [0001] The invention relates to a method for detecting abnormal network flow, in particular to a method for detecting abnormally low amplitude network flow based on a neural network. Background technique [0002] Abnormal behaviors in the network, such as equipment failures, link or node errors, sudden access, and some abnormal behaviors caused by malicious reasons such as DDoS attacks and worm propagation, will lead to network performance degradation and even network unavailability. These anomalies have distributed characteristics, that is, they exist in multiple links at the same time, forming distributed traffic anomalies; and abnormal traffic may be extremely hidden from a single link, and does not show obvious abnormal characteristics. It is very difficult for network managers to detect and respond to these low-magnitude covert traffic anomalies in a timely and effective manner. [0003] Existing network traffic anomaly detection methods include link tr...

AI Technical Summary

Problems solved by technology

However, OD flow traffic cannot be directly measured. It is generally obtained in two ways. One is obtained by combining flow-level data obtained by netflow with routing protocol analysis. This method usually cannot be used in the real-time online detection process; the other is is obtained by inversion of directly measured link data. However, there are serious underdetermination problems in various inversion techniques. Although the underdetermination problem can be overcome by introducing prior information or modeling OD flow, the flow The abnormality does not match the prior information under normal conditions, or it is difficult to find a certain mathematical model to model the OD flow, which makes the OD flow inversion result inaccurate, which directly affects the detection based on the OD inversion result step

Images