Methods for network traffic anomaly detection

网络流量异常检测方法

• 批准号: 445342-2012
• 负责人: Lambadaris, Ioannis
• 金额: $ 1.75万
• 依托单位: Carleton University
• 依托单位国家: 加拿大
• 项目类别: Collaborative Research and Development Grants
• 财政年份: 2013
• 资助国家: 加拿大
• 起止时间: 2013-01-01 至 2014-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=535883
• 关键词: Methods; network; traffic; anomaly; detection

Network anomalies are unusual and significant changes in the general characteristics of traffic flows. Such changes can span over multiple links and involve diverse traffic parameters (e.g., changes in traffic volume, suspicious variability of source-destination IP addresses, etc.). Diagnosing anomalies is critical for both network operators and end users. The reason is that such anomalies may point to a variety of forthcoming network failures. Such failures can be categorized into two forms, soft failures and hard failures. A soft failure can be thought of as a performance degradation; whereas, a hard failure would result in network devices/elements ceasing to operate. Depending on the network, these failures can cause mild or severe inconveniences, loss of productivity, loss of economic activity, or even, loss of public well-being.

网络异常是指流量的一般特性发生异常的显著变化。这样的改变可以跨越多个链路并且涉及不同的业务参数（例如，业务量的变化、源-目的地IP地址的可疑变化等）。诊断异常对于网络运营商和最终用户都至关重要。原因是这种异常可能指向各种即将发生的网络故障。这种故障可以分为两种形式，软故障和硬故障。软故障可以被认为是性能下降;而硬故障将导致网络设备/元件停止操作。根据网络的不同，这些故障可能会导致轻微或严重的不便，生产力损失，经济活动损失，甚至公共福利损失。