A Network Anomaly Detection Method Based on Relative Position Metric

Abstract

The invention discloses a network anomaly detection method based on relative position measurement, which samples the traffic in the backbone communication network; introduces Shannon entropy to preprocess the sampled data; introduces a relative position measurement method of z score to process the preprocessed data Perform calculations; build a z-score map based on the Shannon entropy value; use Shannon entropy changes combined with the z-score map to analyze whether the network is abnormal. Beneficial effects of the present invention: through the introduction of Shannon entropy, the aggregated and discrete trends of attributes in network traffic can be represented, and then by introducing z-scores, according to the rules of thumb in statistics, a z-score map based on Shannon entropy can be built. Intuitively judge whether there is a suspected abnormality, as well as the time and degree of the suspected abnormality; by comparing the degree of suspected abnormality and related attributes, and comparing the characteristics of common abnormalities in the network, the detection range of suspected abnormalities can be further narrowed to achieve The purpose of effective detection and improving detection efficiency.

Description

technical field [0001] The invention belongs to the field of network detection, in particular to a network anomaly detection method based on relative position measurement. Background technique [0002] With the development of the Internet and the continuous growth of business volume, large-scale communication networks are developing in the direction of high speed, diversification, and complexity. The amount of data exchanged in the network is increasing, and the harm of abnormal network traffic is also increasing. . [0003] Anomalies in network traffic are characterized by sudden onset, unknown aura characteristics, and massive consumption of network resources, resulting in network congestion, decreased network link utilization, and significantly reduced network service quality, which may cause extreme damage to network operators and customers in a short period of time. Therefore, detecting and responding to traffic anomalies in real time is an important means to prevent a...

AI Technical Summary

Problems solved by technology

[0006] Existing network traffic anomaly detection technologies have some shortcomings, such as unclear alarm meaning, poor scalability, real-time performance and accuracy are still not high, etc.

Images