检索结果-南通市图书馆

Diagnosing traffic Anomalies Using a Two-Phase Model

Journal of Computer Science & Technology 2012年第2期27卷 313-327页

作者：张宾杨家海吴建平朱应武 Network Research Center Tsinghua University Tsinghua National Laboratory for Information Science and Technology(TNList) Department of Computer Science and Technology Tsinghua University

Network traffic anomalies are unusual changes in a network,so diagnosing anomalies is important for network ***-based anomaly detection models （ab）normal network traffic behavior by analyzing packet header ***-subspace method （Principal Component Analysis） has been verified as an efficient feature-based way in network-wide anomaly *** the powerful ability of PCA-subspace method for network-wide traffic detection,it cannot be effectively used for detection on a single *** this paper,different from most works focusing on detection on flow-level traffic,based on observations of six traffic features for packet-level traffic,we propose a new approach B6SVM to detect anomalies for packet-level traffic on a single *** basic idea of B6-SVM is to diagnose anomalies in a multi-dimensional view of traffic features using Support Vector Machine （SVM）.Through two-phase classification,B6-SVM can detect anomalies with high detection rate and low false alarm *** test results demonstrate the effectiveness and potential of our technique in diagnosing ***,compared to previous feature-based anomaly detection approaches,B6-SVM provides a framework to automatically identify possible anomalous *** framework of B6-SVM is generic and therefore,we expect the derived insights will be helpful for similar future research efforts.

关键词： anomaly detection entropy support vector machine classification traffic feature

来源：

维普期刊数据库

同方期刊数据库评论

在线全文

学校读者我要写书评

暂无评论

Early-stage Internet traffic identification based on packet payload size

引用

Journal of Southeast University(English Edition) 2014年第3期30卷 289-295页

作者：吴同韩臻王伟彭立志北京交通大学计算机与信息技术学院北京100044 济南大学山东省网络智能计算技术重点实验室济南250022

In order to classify the Intemet traffic of different Internet applications more quickly, two open Internet traffic traces, Auckland I1 and UNIBS traffic traces, are employed as study objects. Eight earliest packets with non-zero flow payload sizes are selected and their payload sizes are used as the early-stage flow features. Such features can be easily and rapidly extracted at the early flow stage, which makes them outstanding. The behavior patterns of different Intemet applications are analyzed by visualizing the early-stage packet size values. Analysis results show that most Internet applications can reflect their own early packet size behavior patterns. Early packet sizes are assumed to carry enough information for effective traffic identification. Three classical machine learning classifiers, classifier, naive Bayesian trees, i. e., the naive Bayesian and the radial basis function neural networks, are used to validate the effectiveness of the proposed assumption. The experimental results show that the early stage packet sizes can be used as features for traffic identification.

关键词： pattern recognition network measurement traffic classification traffic feature

来源：

维普期刊数据库

同方期刊数据库评论

在线全文

学校读者我要写书评

暂无评论

欢迎您,

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

在线全文

在线全文

请选择保存的检索档案：

请选择收藏分类：

通借通还

欢迎您,

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

在线全文

在线全文

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：