| 引用本文: | 柏骏,夏靖波,吴吉祥,鹿传国.ODA-IPNMF: 一种在线全网络流量异常检测方法[J].哈尔滨工业大学学报,2015,47(5):104.DOI:10.11918/j.issn.0367-6234.2015.05.018 |
| BAI Jun,XIA Jingbo,WU Jixiang,LU Chuanguo.ODA-IPNMF: An Online Anomaly Detection Algorithm[J].Journal of Harbin Institute of Technology,2015,47(5):104.DOI:10.11918/j.issn.0367-6234.2015.05.018 |
|
| 本文已被：浏览 2217次 下载 1353次 |
码上扫一扫！ |
|
|
| ODA-IPNMF: 一种在线全网络流量异常检测方法 |
|
柏骏1,2, 夏靖波1, 吴吉祥3, 鹿传国4
|
|
(1.空军工程大学 信息与导航学院,710077 西安;2. 95852部队,572600海南 东方; 3.空军大连通信士官学校,116600辽宁 大连;4. 95806部队,100076 北京)
|
|
| 摘要: |
| 为实时、高效地检测网络流量异常,提出一种基于增量投影非负矩阵分解(IPNMF)的全网络流量异常检测方法(ODA-IPNMF)．提出一种增量投影非负矩阵算法,该算法不仅具有与PCA相同的表达形式,还能以增量的方式构建正常子空间和异常子空间,进而利用Shewhart控制图实现全网络流量异常的在线检测．理论分析表明,该方法计算开销远小于NMF-NAD,具有更高的实用价值;模拟网络数据以及实测网络数据实验表明,基于NMF异常检测方法(NMF-NAD和ODA-IPNMF)的检测性能优于PCA方法;本文所提ODA-IPNMF与NMF-NAD网络异常检测效果相当,且可在线检测网络异常． |
| 关键词: 网络异常检测 流量矩阵 增量投影非负矩阵分解 在线检测 |
| DOI：10.11918/j.issn.0367-6234.2015.05.018 |
| 分类号:TP393 |
| 基金项目:国家自然科学基金(61272486)；陕西省科技计划自然基金重点项目(2012JZ8005). |
|
| ODA-IPNMF: An Online Anomaly Detection Algorithm |
|
BAI Jun1,2, XIA Jingbo1, WU Jixiang3, LU Chuanguo4
|
|
(1. Institute of Information and Navigation, AFEU, 710077 Xi’an, Shanxi, China; 2. Unit 2,0, Dongfang, Hainan, China; 3. Air Force Dalian Communications Noncommissioned Officers School, 116600, Dalian, Liaoning, China; 4. Unit 6,6 Beijing, China)
|
| Abstract: |
| An online anomaly detection algorithm based on incremental projective non-negative matrix factorization is proposed to detect the network anomaly real-timely and efficiently. Firstly, an incremental projective non-negative matrix factorization is given, which has the same expression with PCA, and is able to construct normal and abnormal subspace to detect network-wide anomalies online by Shewhart control chart. Theoretic analysis indicates that, the proposed algorithm computation is far smaller than NMF-NAD. In addition, traffic matrix datasets analyzing for internet and simulation results show that the network anomalies detection algorithms based on NMF(such as NMF-NAD and ODA-IPNMF) performs better than that based on PCA, and the proposed ODA-IPNMF has comparable network anomaly detection by NMF-NAD, which the ability to detect the network anomaly online. |
| Key words: network anomalies detection traffic matrix incremental projective non-negative matrix factorization online detection |
