基于小波的网络流量异常分析与仿真

摘要

网络流量异常检测及分析是网络及安全管理领域的重要研究内容,文章根据网络流量的信号特性和自相似性,利用小波变换局部放大能力及Hurst和李氏指数的变化与网络流量异常的对应关系,提出了一种基于小波分析的网络流量异常检测与定位方法.根据自相似指数的值在大时间尺度上来判定异常发生,并进一步在小时间尺度下基于李氏指数与信号奇异性的对应关系来分析并定位异常点.此方法通过DipSIF平台所采集的数据进行仿真验证,可有效地检测网络流量异常并定位异常发生点,与传统方法相比,异常检测的有效率更高.%Traffic anomaly detection and analysis of network is the important research of the network and security management. The paper introduces a method of based on wavelet analysis of network traffic anomaly detection and localization according to signal characteristic and self-similarity characteristic of the network traffic, which makes use of transform and local amplication of the wavelet and the correspondence between the change of Hurst & Lipschitz index with thenetwork traffic anomaly. It decides that wheather abnormal traffic has happened according to the change of sel-similar Hurst index on large time scales, and further makes use of the correspondence between Lipschitz index with the singularity of signal in small time scales to analyze the anomaly point, and then locates the points that network traffic anomaly occured. It is verified by simulated experiment with the data collected by DipSIF platform, which can effectively detect and locate the abnormal network traffic points that anomaly occurred. Comparing with traditional methods, it is more efficient.