Network-wide Anomaly Detection and Localization Method Based on Robust Multivariate Probability Calibration Model

Abstract

The present invention relates to a full network anomaly detection positioning method based on a robust multivariate probability calibration model. The full network anomaly detection positioning method comprises a normal flow modeling step 1 of using the acquired flow data to establish a normal state model, wherein the normal flow modeling comprises the normal model construction containing the abnormal noise data and the normal model construction on the condition of missing the flow data; a flow anomaly detection step 2 of utilizing a mahalanobis distance of a sample and the normal state model to measure whether the sample is abnormal; an abnormal OD positioning step 3 of positioning the anomaly position by the contribution analysis on an abnormal sample OD flow. The full network anomaly detection positioning method based on the robust multivariate probability calibration model can process the complete data, also can process the data missing condition, and is stronger in abnormal noise interference resistance, lower in model parameter sensitivity and stable in performance.

Description

(1) Technical field

[0001] The invention relates to a network anomaly detection method, in particular to a network-wide anomaly detection and positioning method based on a robust multivariate probability calibration model. (two), background technology

[0002] In the current Internet environment, various network abnormal events emerge in endlessly. Large-scale network intrusions such as DDos attacks and botnets pose serious threats to the safe operation of the Internet, and network congestion and network failures will also seriously affect the quality of Internet services. Therefore, , the detection and location of network abnormal behavior is very necessary. At the same time, there are many types of network anomalies, which change rapidly, and are often hidden in complex and huge background traffic, which brings great difficulties to the detection and location of network anomalies.

[0003] There are also many studies on network anomaly detection. Some use host system logs...

Examples

Embodiment Construction

[0166] The network-wide anomaly detection and localization method based on the robust multivariate probabilistic calibration model (robust multivariate probabilistic calibration model, RMPCM) contains the following steps:

[0167] Step 1. Normal traffic modeling: use the collected traffic data to establish a normal model;

[0168] Step 2. Traffic anomaly detection: use the Mahalanobis distance between the sample and the normal model to measure whether the sample is abnormal;

[0169] Step 3. Abnormal OD location: locate the location where the abnormality occurs by analyzing the contribution to the OD flow of abnormal samples.

[0170] The relationship between abnormal events in the network and network anomaly detection and location is (such as figure 2 shown): Abnormal events will affect the statistics of some flows in the network, and the change of the corresponding statistics of the overall network flow triggers the alarm of the anomaly detector. After receiving the alarm,...

(1) Technical field

[0001] The invention relates to a network anomaly detection method, in particular to a network-wide anomaly detection and positioning method based on a robust multivariate probability calibration model. (two), background technology

[0002] In the current Internet environment, various network abnormal events emerge in endlessly. Large-scale network intrusions such as DDos attacks and botnets pose serious threats to the safe operation of the Internet, and network congestion and network failures will also seriously affect the quality of Internet services. Therefore, , the detection and location of network abnormal behavior is very necessary. At the same time, there are many types of network anomalies, which change rapidly, and are often hidden in complex and huge background traffic, which brings great difficulties to the detection and location of network anomalies.

[0003] There are also many studies on network anomaly detection. Some use host system logs...

Examples

Embodiment Construction

[0166] The network-wide anomaly detection and localization method based on the robust multivariate probabilistic calibration model (robust multivariate probabilistic calibration model, RMPCM) contains the following steps:

[0167] Step 1. Normal traffic modeling: use the collected traffic data to establish a normal model;

[0168] Step 2. Traffic anomaly detection: use the Mahalanobis distance between the sample and the normal model to measure whether the sample is abnormal;

[0169] Step 3. Abnormal OD location: locate the location where the abnormality occurs by analyzing the contribution to the OD flow of abnormal samples.

[0170] The relationship between abnormal events in the network and network anomaly detection and location is (such as figure 2 shown): Abnormal events will affect the statistics of some flows in the network, and the change of the corresponding statistics of the overall network flow triggers the alarm of the anomaly detector. After receiving the alarm,...

Images