Flow anomaly detection method based on multi-order Markov chain

Abstract

The invention discloses a flow anomaly detection method based on a multi-order Markov chain, and the method comprises the steps: building a flow normal behavior contour based on a Markov model throughnormal historical flow data, and obtaining the parameters of the Markov model through training; based on the EWMA and a sliding window mechanism, constructing a judgment threshold value at the momentt by utilizing the predicted value at the moment t and the standard deviation of the occurrence probability of the network flow in the sliding window; judging the state of a data packet of the network flow at the moment t so as to convert the network flow at the moment t into a state sequence It; calculating the occurrence probability Pr(It) of the state sequence It by using a trained Markov model, and comparing the occurrence probability Pr(It) with a judgment threshold sigma t at the moment t; if Pr(It) is larger than sigma t, judging that the network flow at the moment t is normal flow; otherwise, judging that the network flow at the moment t is abnormal flow.

Description

technical field [0001] The invention relates to the technical field of computer network management, in particular to a flow anomaly detection method based on a multi-order Markov chain. Background technique [0002] The Internet and information technology are one of the fastest-growing technologies in the world of science and technology research. Because of their convenience, mobility, and low price, they are changing people's way of life. Everything from chatting, shopping, and entertainment to aerospace, weapons and missiles cannot be separated from the Internet. The rapid development of the Internet has promoted profound changes in globalized production and lifestyles. With the development of network theory and technology and the continuous enhancement of network hardware performance, the traffic scale of the entire Internet is also continuously increasing. The rapid expansion of network applications in the Internet age is conducive to the efficient and convenient life ...

AI Technical Summary

Problems solved by technology

Although this method has strong robustness, its computational overhead is relatively large, and its scope of application is relatively limited.

Images