Because network traffic was usually characterized by its higher-dimensional features, related detectors and classifiers for identifying traffic anomalies were suffering the increased complexity. Several key observations given by existing studies showed that network anomalies were distributed typically in a sparse way, and each of anomalies was essentially characterized by its lower-dimensional features. Based on this important finding, a novel model for detecting traffic anomalies-multi-resolution low rank (MRLR) was developed. The proposed MRLR allowed us to dynamically filter the "proper" feature sets and then to classify anomalies accurately. The validation shows that MRLR can accurately reduce the dimensions of flow features to lower than 10%, on the other hand, the complexity of MRLR-classifiers is CKn).%现有刻画流量异常检测所需的流特征集通常是高维的,增加了检测和分类的复杂度.通过研究发现网络中异常通常是稀疏性分布的,单个异常仅仅表现在低维流特征中.基于这一现象提出了一种异常流量检测模型—多尺度低秩(MRLR,multi-resolution low rank)模型,该模型能够动态筛选出“合适的”特征集并准确分类异常.基于人工标记的实际网络流量异常和注入异常的数据集验证结果表明:MRLR对特征集的缩减率可达10％以下；并且基于MRLR的分类算法复杂度为0(n).
展开▼
