Detecting network anomalies based on NetFlow time series

doi:10.3778/j.issn.1002-8331.2008.24.038

Computer Engineering and Applications ›› 2008, Vol. 44 ›› Issue (24): 128-131.DOI: 10.3778/j.issn.1002-8331.2008.24.038

• 网络、通信、安全 • Previous Articles Next Articles

Detecting network anomalies based on NetFlow time series

JIA Guan-xin¹,YANG Bo²,CHEN Zhen-xiang²,PENG Li-zhi²

1.Library，University of Jinan，Jinan 250022，China
2.School of Information Science and Engineering，University of Jinan，Jinan 250022，China

Received:2007-10-31 Revised:2008-01-21 Online:2008-08-21 Published:2008-08-21
Contact: JIA Guan-xin

基于NetFlow时间序列的网络异常检测

贾冠昕¹,杨波²,陈贞翔²,彭立志²

1.济南大学图书馆，济南 250022
2.济南大学信息科学与工程学院网络中心，济南 250022

通讯作者: 贾冠昕

Abstract

Abstract: Network traffic shows periodicity and stability when network works normally，but network anomaly would break this rule.This paper presents a novel method which can find out network anomalies based on NetFlow time series sliding window.Using the time-series-based anomaly finding theory，the method realizes real-time finding network anomalies and making announcement of anomalies.To prevent an anomaly from persistent announcement and disturbing following detection，this paper also presents two ways to ignore announced anomalies.The results show that the method differentiates anomalies efficiently.

Key words: NetFlow, time series, network anomaly

摘要： 网络流量在正常运行的情况下是具有一定的周期性、稳定性的，异常流量会打破这种规律使流量产生异常波动。提出了一种基于NetFlow时间序列滑动窗口检测网络异常的方法，利用时间序列异常发现算法发现网络流量的异常波动从而实现了实时高效的异常流量发现及预警。已经被检测到的网络异常会持续产生预警信息并影响后续的异常检测，为此还提出了两种平抑异常的方法。实验结果表明该方法能够有效地发现网络异常。

关键词: NetFlow, 时间序列, 网络异常

JIA Guan-xin¹,YANG Bo²,CHEN Zhen-xiang²,PENG Li-zhi². Detecting network anomalies based on NetFlow time series[J]. Computer Engineering and Applications, 2008, 44(24): 128-131.

贾冠昕¹,杨波²,陈贞翔²,彭立志². 基于NetFlow时间序列的网络异常检测[J]. 计算机工程与应用, 2008, 44(24): 128-131.

[1]	LU Manjiao, ZHANG Wei, XU Tao. Optimal Replenishment Strategy Based on Dynamic Matrix Model [J]. Computer Engineering and Applications, 2021, 57(7): 263-268.
[2]	YAO Honggang, MU Nianguo. Prediction of Financial Time Series by EMD-LSTM Model [J]. Computer Engineering and Applications, 2021, 57(5): 239-244.
[3]	DING Zhihui, QIAO Gangzhu, CHENG Tan, SU Rong. Shapelets Transform Method Based on LSH [J]. Computer Engineering and Applications, 2021, 57(3): 112-119.
[4]	WU Minghui, HOU Lingyan, WANG Chao. Improved Mechanism of Prediction-Oriented Long Short-Term Memory Neural Network [J]. Computer Engineering and Applications, 2021, 57(21): 109-115.
[5]	CAO Wenchao, GAN Hongcheng. Early-Warning Model of Metro Station Passenger Flow Based on WiFi Data [J]. Computer Engineering and Applications, 2021, 57(13): 233-238.
[6]	MA Chenbin, ZHANG Zhengbo, WANG Jing. Review of Deep Learning Based Physiological Abnormality Detection Research [J]. Computer Engineering and Applications, 2021, 57(10): 10-25.
[7]	ZHAN Peng, CHEN Lin, CAO Luhui, XU Haoran, LI Xueqing. Time Series Anomaly Detection Based on Kernel Turning Points Clipped Representation [J]. Computer Engineering and Applications, 2020, 56(23): 130-138.
[8]	WANG Jian, MAO Liming, YIN Aijun. Multi-dimensional DTW Combined with Shape Feature and Context Information [J]. Computer Engineering and Applications, 2020, 56(22): 42-47.
[9]	JIN Nansen, LIU Meiling, GU Xinran, HAN Yutong. Double Parameter Convolution Theory Model for Traffic Time Prediction [J]. Computer Engineering and Applications, 2020, 56(20): 258-263.
[10]	YUAN Yaoyao, KANG Yan, LI Hao, NIU Ruicheng, LIANG Wentao, LI Jinyuan. Timing Traffic Flow Data Completion Based on ST-DCGAN [J]. Computer Engineering and Applications, 2020, 56(15): 140-146.
[11]	LI Chun, GAO Fei, WANG Huiqing. Improved Fruit Fly Optimization Algorithm for Optimizing Time Series Prediction Model of CIAO-LSTM Network [J]. Computer Engineering and Applications, 2020, 56(11): 129-134.
[12]	TAN Zhanglu, WANG Zhaogang, HU Han. Research on Trend Similarity Measurement Method of Time Series [J]. Computer Engineering and Applications, 2020, 56(10): 94-99.
[13]	ZOU Yan, CHEN Weijie. Decision-Making Model of Time Series Generalized Fuzzy Soft Sets Based on Extended GBM Operator [J]. Computer Engineering and Applications, 2019, 55(7): 53-57.
[14]	SANG Haifeng, TIAN Qiuyang. Rapid Action Recognition System for Human-Computer Interaction [J]. Computer Engineering and Applications, 2019, 55(6): 101-107.
[15]	WANG Kai, CHEN Danwei. Research on Algorithm of Dynamic Graph Anomaly Detection Based on LSTM [J]. Computer Engineering and Applications, 2019, 55(5): 76-82.

Detecting network anomalies based on NetFlow time series

基于NetFlow时间序列的网络异常检测

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics