MODELING NORMAL BEHAVIOR OF NETWORK TRAFFIC
Bo Zou · Jisuanji gongcheng · 2002
With the rapid development of the network, it now has a large size and complexity, increasing various applications based on it, consequently the network management is increasingly difficult. Generally the traditional network management systems alarm in terms of a fixed threshold, however, it has a shortcoming that it cannot adapt the changes of the network, moreover, it is not an easy thing to find the appropriate threshold, so the techniques of proactive network management occurred. Therefore, a normal behavior model is founded with the numbers of the non-unicasting packet collected from a real network, with the Analysis of Variance (ANOVA), stabilize the normal behavior serial and estimate the coefficients of the ARMA model. So network anomaly behavior may be detected with this model, the traffic of the network may be predicted, and the trend of network can be seen.