关键词: 异常检测, 采样技术, 特征感知, NetFlow协议, 采样模型, 采样算法

Abstract: Sampling is a major method in data acquisition in network anomaly detection. But different duration of flow, different sizes of the packet and different frequency of abnormal flow have brought about measurable negative impact on the accurate sampling. For this, this paper presents a feature perception adaptive sampling technique which can adjust the sampling rate when context is changing. Compared the adaptive sampling with the random sampling and the choice sampling, it studies the technology on retaining network feature in network behavior analysis system. The experimental result shows that the method is superior to others in retained network feature and quality assessment of anomaly detection.

Key words: anomaly detection, sampling technology, feature perception, NetFlow protocol, sampling model, sampling algorithm