Reduction of traffic sampling impact on anomaly detection

摘要

Network anomaly is detected by identifying possible abnormal behaviors in network traffic. Due to the applications of High-speed Networks, sampling data of network traffic have been adopted extensively as the data source of anomaly detection. Sampling is an approximate method of measurement, and the sampling data must have certain deviation on distribution of total traffic, which can definitely affect the anomaly detection. Based on an analysis of the impact of random packet sampling data on anomaly detection, an IP flow-based sampling measurement method with a variable sampling rate on network traffic is proposed in this paper. The method reduces the impact of sampling data on anomaly detection and improves the accuracy of such data applied for anomaly detection.