Network Anomaly Traffic Detection Algorithm Based on SVM

摘要

In order to guarantee the high level of network security and improve the user experience of the network, in this paper, we propose an effective network anomaly traffic detection algorithm. Firstly, six types of network features are used in our work, such as 1) Number of source IP address, 2) Number of source port number, 3) Number of destination IP address, 4) Number of destination port number, 5) Number of packet type, 6) Number of distinct packets with same packet size. Afterwards, we discuss how to generate normalized entropy for the features which are exploited in the network anomaly traffic detection. Secondly, we convert the network traffic anomaly detection problem to a classification problem, and proposed a hybrid PSO-SVM model to solve it. Finally, experimental results demonstrate that the proposed method can detect different network traffic anomaly behaviors with high accuracy.