Wireless sensor network traffic abnormality detection method based on ARIMA model

Abstract

The invention discloses a wireless sensor network traffic abnormality detection method based on an ARIMA model. The ARIMA model is used for carrying out difference operation for d times to stabilize a sequence, which is suitable for wireless sensor network conditions with non-balanced and unstable traffics; a sliding window with an appropriate window size is used for fixing a historical modeling data volume, so as to both guarantee the modeling rapidity and guarantee the latest validity of historical data; an optimal ARIMA (p, d, q) model is established for each time of window sliding to guarantee the accuracy of a predicted value; a next moment traffic predicted value applied to final abnormality judgment is generated through exponentially weighted averaging of predicted values of previous L times, and certain "inertia" is introduced into the traffic prediction in this way, so that in the case of abnormal traffics, a normal traffic prediction model cannot be changed easily, predicated values of normal traffics can be better obtained, and traffic abnormality can be detected more easily.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to an ARIMA model-based abnormality detection method for wireless sensor network traffic. Background technique [0002] Wireless sensor network (Wireless Sensor Network, wireless sensor network) is extremely vulnerable to external attacks due to its open environment and long-term exposure of nodes. In common attacks on wireless sensor networks, traffic abnormalities will appear in some or the entire network of sensor nodes. Therefore, traffic anomaly detection in wireless sensor networks plays an extremely important role in improving its security. [0003] At present, most studies on traffic anomaly detection use traffic prediction models. When the predicted traffic value deviates too much from the real value, it is determined that the network traffic is abnormal. For the selection of forecasting models, the existing methods mostly use Autoregressive and Movin...

AI Technical Summary

Problems solved by technology

This method can detect the moment when the network traffic is obviously abnormal, but the detection accuracy is low, and it cannot achieve real-time abnormal detection

When the sliding window is introduced, real-time detection can be achieved, but the continuous fitting and approximation of the model makes it easy to judge a large number of outliers as normal values ​​when anomalies occur

At the same time, the ARMA model is only for the condition that the network traffic is relatively stable, but for the unbalanced and unstable characteristics of the wireless sensor network traffic, its applicability is low.

Images