基于通联累积量的动态网络异常检测算法

摘要

In network operation and maintenance fields, one of the biggest concerns is how to detect the network anomaly without delay. Aiming at the problem that the existing methods could hardly detect the a-nomaly in case of high-frequency communication, an anomaly detection method based on statistic model for high-frequency communication is proposed. In this method,the power-law distribution model is used to describe the relation of between the number of nodes and frequency communicating cumulant,this model is matched via linear regression,and the network state with regression error beyond the confidence coefficient is predicated as abnormal. In addition,for the heavy-concerned node pair in the network,a predistribution scheme of its weight assignment is given. However, in light of small-scale network status, which could not completely follow power-law distribution, a sample pre-selection strategy is suggested,so as to reduce the false alarm of abnormal behavior. Finally, experiment results indicate that the proposed method is of fairly high detection rate both in abnormal high-frequency and low-frequency communication.%在网络运维管理领域，最受关注的问题之一是如何及时发现网络异常。针对现有方法难以发现异常的高频次通联行为的问题，提出一种基于统计模型的高频通联异常检测方法，以幂律分布模型来描述网络中节点数与频繁通信次数之间的关系，通过线性回归方法进行拟合，并将回归误差超出置信度范围的网络状态判定为异常。此外，针对网络中存在重点关注节点对的情况，给出其权重预分配方案；针对规模较小的网络状态，考虑其不完全服从幂律分布，给出样本预筛选策略，用于降低对异常网络状态的虚警率。最终实验结果表明，该方法在低频次通联异常与高频次通联异常条件下，均表现出较高的检测率。