Anomaly detection in backbone networks using Filter-ary-Sketch

ZHENG Li-ming1; ZOU Peng2; HAN Wei-hong1; LI Ai-ping1; JIA Yan1

您当前的位置：

首页 >

文章列表页 >

Anomaly detection in backbone networks using Filter-ary-Sketch

更新时间：2024-10-14

- Anomaly detection in backbone networks using Filter-ary-Sketch
- Vol. 32, Issue 12, Pages: 151-160(2011)
- 作者机构：
  
  1. 国防科学技术大学计算机学院
  2. 装备指挥技术学院
- 作者简介：
- 基金信息：
- DOI：
  CLC： TP393.08
- Published：2011
- 稿件说明：
移动端阅览
ZHENG Li-ming1, ZOU Peng2, HAN Wei-hong1, et al. Anomaly detection in backbone networks using Filter-ary-Sketch[J]. 2011, 32(12): 151-160.
DOI：

ZHENG Li-ming1, ZOU Peng2, HAN Wei-hong1, et al. Anomaly detection in backbone networks using Filter-ary-Sketch[J]. 2011, 32(12): 151-160. DOI：

摘要

针对骨干网上异常检测的特殊要求

提出了一种基于Filter-ary-Sketch数据结构的异常检测方法。该方法通过Filter-ary-Sketch实时记录网络流量信息

然后每隔一定周期进行基于多维熵值的异常检测。如果出现异常则根据Filter-ary-Sketch记录的流量信息进行异常点定位

最后利用Bloom Filter中记录的源IP信息进行恶意流量阻断。该方法能够检测多种类型的网络攻击

且能有效地进行恶意流量阻断。利用实际骨干网流量数据

分别从效率和精度2个方法进行对比实验

取得了较好的效果。

Abstract

For the special requirements of anomaly detection in backbone networks

an anomaly detection method was proposed based in the summary data structure: Filter-ary-Sketch.It recorded the network traffic information in Fil-ter-are-Sketch online and detected anomalies based on multi-dimensional entropy at every circle.If an anomaly was detected

the anomaly point located according to data stream recorded in Filter-ary-Sketch.Finally

malicious traffic blocked using the source IPs recorded in Bloom filter.The method was effective in detecting a variety of network at-tacks;especially it could block the malicious traffic.Evaluated by the experiment

the method can detect anomaly in the backbone network with small computing and memory resource and block the IP flows that are responsible for the anomaly.

关键词

Keywords

references

Views

825

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on a dynamic self-learning efficient intrusion detection model

Network anomaly detection based on TCM-KNN and genetic algorithm

Research on performance optimizations for TCM-KNN network anomaly detection algorithm

Review of unsupervised anomaly detection techniques for medical imaging

Multi-type honeypot deployment scheme based on Stackelberg game and DQN

Related Author

YANG Wu1

ZHANG Bing2

ZHOU Yuan2

WANG Wei1

LI Yang1

FANG Bin-xing1

GUO Li1

TIAN Zhi-hong1

Related Institution

Information Security Research Center, Harbin Engineering University

National Computer Network Emergency Response Technical Team/Coordination Center of China

Institute of Computing Technology, Chinese Academy of Sciences

Graduate School of Chinese Academy of Sciences

中国科学院研究生院

AI问答

⁰