Detection Accuracy of Network Anomalies using Sampled Flow Statistics
Detection Accuracy of Network Anomalies using Sampled Flow Statistics
复制标题
使用采样流量统计检测网络异常的准确性
DOI：
10.1002/nem.777
复制
发表时间：
2011
影响因子：
1.5
通讯作者：
S.ASANO
中科院分区：
文献类型：
--
作者：
R.KAWAHARA;K.ISHIBASHI;T.MORI;K.KAMIYAMA;S.HARADA;H.HASEGAWA;S.ASANO
我们研究了网络异常的检测精度时，使用通过数据包采样获得的流量统计。通过基于测量数据的案例研究，我们发现，网络异常产生大量的小流量，如网络扫描或SYN洪水，变得难以检测在数据包采样。然后，我们开发了一个分析模型，使我们能够定量评估数据包采样和交通状况，如异常流量，对检测精度的影响。我们还研究了当数据包采样率降低时，检测精度如何下降。此外，我们表明，即使在低采样率，空间分区监测流量成组，可以提高检测精度。我们还开发了一种方法来确定一个适当的分区组的数量，我们证明了它的有效性。版权所有© 2011约翰威利父子有限公司.
We investigated the detection accuracy of network anomalies when using flow statistics obtained through packet sampling. Through a case study based on measurement data, we showed that network anomalies generating a large number of small flows, such as network scans or SYN flooding, become difficult to detect during packet sampling. We then developed an analytical model that enables us to quantitatively evaluate the effect of packet sampling and traffic conditions, such as anomalous traffic volume, on detection accuracy. We also investigated how the detection accuracy worsens when the packet sampling rate decreases. In addition, we show that, even with a low sampling rate, spatially partitioning monitored traffic into groups makes it possible to increase detection accuracy. We also developed a method of determining an appropriate number of partitioned groups, and we show its effectiveness. Copyright © 2011 John Wiley & Sons, Ltd.