关键词: 异常检测, 网络流量, 协同学, 小波, 序参量

Abstract: According to the nonlinear and non-stationary dynamic characteristics of the network traffic, the technique based on synergetic phase transition theory was proposed for detecting network traffic anomalies. By using the nonlinear dynamic equation of the order parameter, the paper described the complex behaviors of the network traffic system in discrete wavelet domain of the network traffic time series and the potential function was used to characterize non-stationary phase transition process of the network traffic system. The relationship between network traffic status and the various attack patterns was analyzed, and the synergetic model was used to calculate the network traffic order parameter. When the corresponding order parameter converged, the corresponding attack pattern or the normal traffic pattern could be detected. Finally, the DARPA 1999 data set was used to evaluate the proposed method. The average detection rate is 90.00% and the average false alarm rate is 15.03%. The experimental results show that the proposed method is effective for the network traffic anomaly detection.

Key words: anomaly detection, network traffic, synergetics, wavelet, order parameter