Network-wide Anomaly Detection and Localization Method Based on Robust Multivariate Probability Calibration Model

Abstract

The present invention relates to a full network anomaly detection positioning method based on a robust multivariate probability calibration model. The full network anomaly detection positioning method comprises a normal flow modeling step 1 of using the acquired flow data to establish a normal state model, wherein the normal flow modeling comprises the normal model construction containing the abnormal noise data and the normal model construction on the condition of missing the flow data; a flow anomaly detection step 2 of utilizing a mahalanobis distance of a sample and the normal state model to measure whether the sample is abnormal; an abnormal OD positioning step 3 of positioning the anomaly position by the contribution analysis on an abnormal sample OD flow. The full network anomaly detection positioning method based on the robust multivariate probability calibration model can process the complete data, also can process the data missing condition, and is stronger in abnormal noise interference resistance, lower in model parameter sensitivity and stable in performance.

Description

(1) Technical field [0001] The invention relates to a network anomaly detection method, in particular to a network-wide anomaly detection and positioning method based on a robust multivariate probability calibration model. (two), background technology [0002] In the current Internet environment, various network abnormal events emerge in endlessly. Large-scale network intrusions such as DDos attacks and botnets pose serious threats to the safe operation of the Internet, and network congestion and network failures will also seriously affect the quality of Internet services. Therefore, , the detection and location of network abnormal behavior is very necessary. At the same time, there are many types of network anomalies, which change rapidly, and are often hidden in complex and huge background traffic, which brings great difficulties to the detection and location of network anomalies. [0003] There are also many studies on network anomaly detection. Some use host system logs...

AI Technical Summary

Problems solved by technology

The network-wide anomaly detection method based on traffic statistics improves detection performance by introducing network information with a wider range and more dimensions. The increase of collection equipment and the acceleration of network speed make it necessary to consider the lack of collection data caused by some equipment failures, or the lack of flow data during transmission, which will make the above abnormal detection method fail due to incomplete data. The second is that the actual backbone network traffic is not only huge in data volume, but also very complex. The hidden abnormal traffic will affect the accuracy of normal model construction, making it difficult to select model parameters and the stability of anomaly detection methods is extremely difficult. guarantee, and some deliberate attack traffic can seriously poison the detector; third, the above method can find anomalies, but there are still deficiencies in anomaly location

Ringberg et al. researched and analyzed the shortcomings of PCA-based network-wide anomaly detection methods in anomaly location; Eriksson et al. proposed a network-wide anomaly detection and location method based on basis detect, but this method can only locate To the border router, more detailed abnormal location information cannot be provided

Images