A new connection degree calculation and measurement method for large scale network monitoring
A new connection degree calculation and measurement method for large scale network monitoring
复制标题
一种新的大规模网络监控连接度计算与测量方法
DOI：
10.1016/j.jnca.2013.10.008
复制
发表时间：
2014-05
影响因子：
8.7
通讯作者：
Zhu Min
中科院分区：
文献类型：
--
作者：
Qin Tao;Guan Xiaohong;Li Wei;Wang Pinghui;Zhu Min
流量模式特征监测对于异常行为检测和网络管理是非常有用的。在本文中，我们开发了一个框架连接度计算和测量在高速网络。采用双向流量模型对流量数据包进行聚合，减少流量记录的数量，同时捕捉用户的交互行为特征。选取一阶连接度和联合相关度作为特征量来提取流量剖面的特征。该框架不仅分析单个流量特征的异常变化，而且分析特征之间的相关性，以实现细致的流量检测和攻击检测。首先，分析了进出连通度的对称性。我们发现不完整流是异常行为检测的一个重要信息源。其次，联合相关度可以表征用户的通信模式和他们的行为动态，这是用来执行异常检测使用测量的基础上Renyi交叉熵。最后，利用可逆度草图查询异常交通模式源，实现实时交通管理。基于中国教育科研网（CERNET）西北区域中心的实际流量轨迹数据的实验结果表明了该方法的有效性。基于Renyi熵的方法能正确检测出异常变化点。该算法的FNR小于4%，时间复杂度小于4 s，是实时交通监控的关键。
Traffic pattern characteristics monitoring is useful for abnormal behavior detection and network management. In this paper, we develop a framework for connection degree calculation and measurement in high-speed networks. The bi-directional traffic flow model is employed to aggregate traffic packets, which can reduce the number of flow records and capture user's alternation behavior characteristics. The first order connection degree and joint correlation degree are selected as the features to capture the characteristics of traffic profiles. To perform careful traffic inspection and attack detection, not only the abnormal changes of a single traffic feature but also the correlations between the features are analyzed in the new framework. First, the symmetry of in and out connection degrees is analyzed. And we found that incomplete flows are an important information source for abnormal behavior detection. Second, joint correlation degree can characterize the user's communication profiles and their behavior dynamics, which are employed to perform abnormal detection using measurements based on Renyi cross entropy. Finally, the reversible degree sketch is employed for querying abnormal traffic pattern sources for real-time traffic management. The experimental results based on actual traffic traces collected from Northwest Regional Center of CERNET (China Education and Research Network) show the efficiency of the proposed method. The method based on Renyi entropy can detect abnormal changing points correctly. FNR of the reversible sketch for locating abnormal sources is below 4% and time complexity is constant and less than 4 s, which is critical for real-time traffic monitoring.
登录
查看更多内容
DOI：
10.1007/bf02999636
发表时间：
1993-12
期刊：
Annales Des Télécommunications
影响因子：
--
作者：
L. Bernaille;R. Teixeira;Ismael Akodkenou;Augustin Soule;Kave Salamatian
通讯作者：
L. Bernaille;R. Teixeira;Ismael Akodkenou;Augustin Soule;Kave Salamatian
DOI：
10.1145/1005686.1005699
发表时间：
2004-06
期刊：
--
影响因子：
--
作者：
N. Duffield;C. Lund;M. Thorup
通讯作者：
N. Duffield;C. Lund;M. Thorup
DOI：
10.1145/1452520.1452539
发表时间：
2008-10
期刊：
--
影响因子：
--
作者：
George Nychis;Vyas Sekar;D. Andersen;Hyong S. Kim;Hui Zhang
通讯作者：
George Nychis;Vyas Sekar;D. Andersen;Hyong S. Kim;Hui Zhang
影响因子：
--
作者：
SHANNON, CE
通讯作者：
SHANNON, CE
DOI：
10.1145/1177080.1177099
发表时间：
2006-10
期刊：
--
影响因子：
--
作者：
Xin Li;Fang Bian;M. Crovella;C. Diot;R. Govindan;G. Iannaccone;Anukool Lakhina
通讯作者：
Xin Li;Fang Bian;M. Crovella;C. Diot;R. Govindan;G. Iannaccone;Anukool Lakhina