Anomaly detection method for wireless sensor network traffic based on arima model

Abstract

The invention discloses a wireless sensor network flow anomaly detection method based on an ARIMA model. The ARIMA model is used to perform d times of difference to make the sequence stable, which is suitable for wireless sensor network conditions where the flow is unbalanced and unstable; a sliding window with a suitable window size is used. The window makes the amount of historical modeling data fixed, which not only ensures the rapidity of modeling, but also ensures the latest validity of historical data; each sliding window establishes the optimal ARIMA (p, d, q) model to ensure the predicted value Accuracy; the flow prediction value at the next moment, which is finally used for abnormal judgment, is generated by the exponential weighted average of the previous L prediction values, so that a certain "inertia" is introduced into the flow prediction. When the abnormal flow comes, it cannot be easily By changing the normal traffic forecasting model, the predicted value of normal traffic can be obtained better, and abnormal traffic can be detected more easily.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to an ARIMA model-based abnormality detection method for wireless sensor network traffic. Background technique [0002] Wireless sensor network (Wireless Sensor Network, wireless sensor network) is extremely vulnerable to external attacks due to its open environment and long-term exposure of nodes. In common attacks on wireless sensor networks, traffic abnormalities will appear in some or the entire network of sensor nodes. Therefore, traffic anomaly detection in wireless sensor networks plays an extremely important role in improving its security. [0003] At present, most studies on traffic anomaly detection use traffic prediction models. When the predicted traffic value deviates too much from the real value, it is determined that the network traffic is abnormal. For the selection of forecasting models, the existing methods mostly use Autoregressive and Movin...

AI Technical Summary

Problems solved by technology

This method can detect the moment when the network traffic is obviously abnormal, but the detection accuracy is low, and it cannot achieve real-time abnormal detection

When the sliding window is introduced, real-time detection can be achieved, but the continuous fitting and approximation of the model makes it easy to judge a large number of outliers as normal values ​​when anomalies occur

At the same time, the ARMA model is only for the condition that the network traffic is relatively stable, but for the unbalanced and unstable characteristics of the wireless sensor network traffic, its applicability is low.

Images