Multi-scale detecting method of network flow anomaly in dynamic environment

Abstract

The invention relates to the technical field of network anomaly detection and intrusion detection, particularly to a multi-scale detecting method of abnormal network flow in a dynamic environment. The method includes using continuous wavelet transform (CWT) for capturing dynamic time-frequency characteristics of abnormal flow data in a time-frequency domain, using the principal component analysis (PCA) method for eliminating the redundant part of a wavelet coefficient, reducing dimensions of the initial data, and reducing calculation amount so as to guarantee accuracy of the anomaly detection better. When anomaly determination is performed on components of anomaly characteristics, a starting time and duration of the anomaly are determined, and real-time and rapid detection of the abnormal flow is achieved. Compared with the PCA method alone for the anomaly detection, the multi-scale anomaly detection has better detection effect, and can determine the starting time and the duration of the anomaly.

Description

technical field [0001] The invention relates to the technical fields of network anomaly detection and intrusion detection, in particular to a multi-scale detection method for network traffic anomalies in a dynamic environment. Background technique [0002] As the world has entered the Internet age, the network has greatly shortened the time for information release and reception, and avoided unnecessary waste of resources. However, with the further development of network technology, some incidental network security issues and network performance issues also appear in people's sight. Improper network use caused by misconfiguration and malicious attacks will occupy too much bandwidth, consume precious resources, and at the same time degrade network performance, resulting in a disadvantageous position for legitimate applications to use resources, thus quickly and accurately detecting abnormal network traffic It is a hot topic of current research. [0003] Abnormal network beha...

AI Technical Summary

Problems solved by technology

[0006] Compared with the increasing network abnormal traffic and business volume, the above research methods still cannot meet the requirements, there are still insufficient research on the time-frequency domain characteristics of traffic signals, the lack of scale adaptability for traffic anomaly detection, and the lack of confidence in detection algorithms. Insufficient research on the real-time performance of

[0007] In summary, the current detection methods cannot detect abnormal traffic well.

Images