• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文学位 >Network traffic characterization and network anomaly detection.
【24h】

Network traffic characterization and network anomaly detection.

机译：网络流量表征和网络异常检测。

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

The growing number of exploits and malicious activities impose serious threats on network stability. To avoid network service outage and economic loss, various methods have been proposed for network anomaly detection. Network traffic characterization concentrates on network traffic analysis for profiling traffic properties so that network anomaly can be detected through the deviation from normal traffic.;This thesis work pursues a systematic method through which abrupt changes of traffic behavior can be captured as a part of traffic characterization. Since aggregated traffic possesses a strong temporal correlation with local stationarity across time scales, energy distribution as a representation of autocorrelation function can be a good guidance for network traffic characterization. Due to the localization in time and frequency space, wavelet analysis is a natural choice for analyzing traffic time series extracted from real traffic traces. Through the wavelet analysis, energy distributed over scales can be constructed via the variance of wavelet coefficients with low computational complexity. With the energy distribution based on wavelet analysis, we characterize the network traffic on the Internet. Energy distribution changes with limited variation over time if the traffic keeps its characteristics. In other words, energy distribution variation between two consecutive observation points can tell changes in the characteristics (behavior) of the observed traffic.;As a practical application of the energy distribution variation analysis, we have considered cases of DDoS attacks and worm propagation. Our experimental results show that energy distribution variation markedly changes, causing a "spike" when traffic behaviors are affected by those attacks. In contrast, normal traffic exhibits a remarkably stationary energy distribution. This spike in energy distribution variance can be captured in the early stages of an attack, far ahead of congestion build-up, making it an effective detection of the attack.;This thesis work also includes an extensive discussion of implementation issues. Parameter selection, wavelet transform implementation, and attack response methods have been studied under designed experiments. An attack defense system with both detection and response units has been delivered as an add-on module of NS-2 platform.
机译：越来越多的漏洞利用和恶意活动对网络稳定性构成了严重威胁。为了避免网络服务中断和经济损失，已经提出了各种用于网络异常检测的方法。网络流量表征主要针对网络流量分析进行流量属性分析，以便通过与正常流量的偏差来检测网络异常。;本文工作寻求一种系统的方法，通过该方法可以捕获流量行为的突然变化作为流量表征的一部分。由于聚合的流量在整个时间范围内与本地平稳性具有很强的时间相关性，因此作为自相关函数表示形式的能量分配可以很好地指导网络流量表征。由于时间和频率空间的局限性，小波分析是分析从实际交通轨迹提取的交通时间序列的自然选择。通过小波分析，可以通过小波系数的方差构造尺度上分布的能量，并且计算复杂度低。通过基于小波分析的能量分配，我们可以表征Internet上的网络流量。如果交通保持其特征，则能量分布随时间变化有限。换句话说，两个连续观察点之间的能量分布变化可以说明所观察到的流量的特征（行为）的变化。作为能量分布变化分析的实际应用，我们考虑了DDoS攻击和蠕虫传播的情况。我们的实验结果表明，能量分布变化明显变化，当交通行为受到这些攻击的影响时，会导致“尖峰”。相反，正常交通表现出明显的静态能量分布。这种能量分布方差的峰值可以在攻击的早期阶段被捕获，远远超过拥塞的形成，从而可以有效地检测到攻击。本论文的工作还包括对实现问题的广泛讨论。在设计实验下，已经研究了参数选择，小波变换实现和攻击响应方法。带有检测和响应单元的攻击防御系统已作为NS-2平台的附加模块提供。

著录项

  • 作者

    Li, Lan.;

  • 作者单位

    University of Illinois at Chicago.;

  • 授予单位 University of Illinois at Chicago.;
  • 学科 Engineering Electronics and Electrical.;Computer Science.
  • 学位 Ph.D.
  • 年度 2006
  • 页码 111 p.
  • 总页数 111
  • 原文格式 PDF
  • 正文语种 eng
  • 中图分类 遥感技术;
  • 关键词

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号