Anomaly Detection based on Feature Correlation and Influence Degree in SDN

摘要

Although SDN realizes flexible control of traffic, the numerical control separation characteristics of SDN and the large-scale and high-dimensional characteristics of the SDN network environment severely limit the accuracy and efficiency of abnormal traffic detection in the SDN environment. In this paper, feature selection is used to reduce the data dimension and improve the efficiency of anomaly detection, and then an anomaly detection model is proposed based on feature correlation and influence. Firstly, the irrelevant features is removed according to T-Rele, the selection of redundant features is simplified by the minimum spanning tree, and then an optimized feature subset is obtained by removing irrelevant and redundant features based on F-Rele. Secondly, based on the optimized feature subset, the influence degree is used as the metric for secondary feature selection. The detection vector is constructed based on the optimal feature subset, and then anomaly detection is performed based on the decision tree algorithm. Experiments show that the algorithm proposed in this paper can accurately identify abnormal traffic while choosing fewer features to characterize network traffic.