A Hough-transform-based Anomaly Detector with an Adaptive Time Interval
A Hough-transform-based Anomaly Detector with an Adaptive Time Interval
复制标题
一种基于霍夫变换的自适应时间间隔异常检测器
DOI：
10.1145/2034594.2034598
复制
发表时间：
2011
期刊：
影响因子：
--
通讯作者：
Kensuke Fukuda
中科院分区：
文献类型：
--
作者：
Romain Fontugne;Kensuke Fukuda
互联网流量异常是一个严重的问题，会影响最佳网络资源的可用性。最近提出了许多异常检测器，但保持其参数的最佳调谐是一项困难的任务，损害了它们在日常使用中的有效性。提出了一种新的基于模式识别的异常检测方法，并研究了其参数集与流量特征之间的关系。这一分析强调，要想不断获得高的检测率，需要根据流量的波动不断调整参数。为此，提出了一种自适应时间间隔机制，以增强检测方法对流量变化的鲁棒性。该自适应异常检测方法通过与其他三种异常检测方法的比较，使用四年的真实主干流量对其进行评估。评估结果表明，自适应检测方法在真阳性率和假阳性率方面均优于其他方法。
Internet traffic anomalies are a serious problem that compromises the availability of optimal network resources. Numerous anomaly detectors have recently been proposed, but maintaining their parameters optimally tuned is a difficult task that discredits their effectiveness for daily usage. This article proposes a new anomaly detection method based on pattern recognition and investigates the relationship between its parameter set and the traffic characteristics. This analysis highlights that constantly achieving a high detection rate requires continuous adjustments to the parameters according to the traffic fluctuations. Therefore, an adaptive time interval mechanism is proposed to enhance the robustness of the detection method to traffic variations. This adaptive anomaly detection method is evaluated by comparing it to three other anomaly detectors using four years of real backbone traffic. The evaluation reveals that the proposed adaptive detection method outperforms the other methods in terms of the true positive and false positive rate.