Network-Wide Anomalous Flow Identification Method based on Traffic Characteristics Distribution
Yekui Qian, Shan De-sheng, Dong Wei, Yuchong Li, Luo Zhao-feng · Procedia Computer Science · 2018
Aiming at the shortcomings of single-link anomalous flows identification on precision, an anomalous flows identification method based on traffic characteristic distribution was proposed. First of all, from the perspective of the whole network, multi-dimensional traffic characteristics entropy matrix was constructed, and OD flows and abnormal flows characteristics related with anomalies were detected and extracted. Secondly, candidate set of abnormal flows were extracted by monitoring the changes of anomaly characteristics distribution and determining the abnormal flows characteristics value on the corresponding OD flow. Thirdly, abnormal flows recognition was finally completed by further filtering and selecting with association rule mining based on relation matrix. Simulation experiment showed that the method exceed the existing methods in identification precision. Real measurement data analysis verified further the effectiveness of the method.