论文部分内容阅读
快速准确地识别网络流量的异常是网络故障管理的关键。针对目前一些流量异常检测方法难以兼顾实时、准确和自适应性要求的不足,本文提出网络流量异常检测算法Ntada(Network Traffic Anomaly Detection Algorithm),即通过AR(2)模型描述网络流量,并基于采样值与历史值的异常流量进行修正。与传统阈值检测方法以及Holt-Winter方法进行比较,Ntada算法具有启动延迟小、异常检测正确率高、检测实时性较高、能够处理连续长时间异常的特点。
Identifying network traffic anomalies quickly and accurately is the key to network fault management. Aiming at the shortcomings of some current traffic anomaly detection methods that are difficult to meet real-time, accurate and adaptive requirements, this paper proposes Network Traffic Anomaly Detection Algorithm (Ntada), which describes network traffic through AR (2) Abnormal flow of values and historical values are corrected. Compared with the traditional threshold detection method and the Holt-Winter method, the Ntada algorithm has the characteristics of small start-up delay, high accuracy of anomaly detection, high real-time detection and capable of handling continuous long-term anomalies.