基于扩散小波的网络流量模型研究及应用

发布时间：2018-11-03 11:29

【摘要】：传统的网络流量研究主要集中在一个ISP网络下研究单一链路上观察到的数据包的时域特征。目前,研究人员在自相似随机过程、长期相关性、重尾分布等领域的研究上取得了进展,已证明了将基于传统小波变换的多尺度分析方法应用于流量分析是十分有效的,但是这些研究多侧重于单条链路或者网络终端,将流量看作一个一维的时间信号。然而,一个ISP的基础设施通常包括100甚至1000条链路,而互联网大概由20000个这样的ISP组成。对其中的一条或者某几条链路的流量分析不足以说明网络流量的全局特征,时域分析能够提供的信息也非常有限。流量矩阵描述了网络中一段时间内任意OD (Origin-Destination)对之间的流量分布情况,它能够描述整个网络的流量特性,目前已成为网络流量工程研究中至关重要的参数。流量矩阵蕴含着网络中不规则拓扑结构的信息,扩散小波对不规则拓扑及多层结构均可以进行有效的时域和空间域分析,因而,本文采用扩散小波技术对流量矩阵进行多尺度分析,并将研究结果应用于全局网络的DDoS检测中。本文的研究内容主要分为以下三个方面：(1)本文首先研究了传统网络流量模型的特征,分析了它们优缺点,网络流量特性及相关度量参数。(2)基于扩散小波技术对网络流量矩阵进行了多尺度分析。通过对流量矩阵做扩散小波变换后得到的不同尺度系数分析,选取了第四层粗略系数矩阵作为主要研究对象并从中获取了五个重要的特征参数,对原始流量矩阵进行特征分析。(3)基于以上特征参数的分析,给出了两种检测单个节点遭受DDoS攻击的方法：Hurst指数检测方法和动态阈值检测方法。前者将描述自相似最重要的Hurst指数运用于异常检测中,异常检测率达到91%；后者通过结合网络流量中长相关性与短相关性特征来设置动态阈值,异常检测率达到93.9%,同时误报率仅为10.9%。本文对已有的检测方法进行了分析与比较,提出的方法因结合了扩散小波分析结果,选取的特征参数完好地描述了原始流量矩阵的特征,检测DDoS异常攻击的效率得到提升。
[Abstract]:Traditional network traffic studies focus on the temporal characteristics of data packets observed on a single ISP network. At present, researchers have made progress in the fields of self-similar stochastic process, long-term correlation, heavy-tailed distribution and so on. It has been proved that the application of traditional wavelet transform based multi-scale analysis method to traffic analysis is very effective. However, most of these researches focus on single link or network terminal. Traffic is regarded as a one-dimensional time signal. However, an ISP infrastructure usually consists of 100 or even 1000 links, and the Internet consists of about 20, 000 such ISP. The traffic analysis of one or several links is not enough to explain the global characteristics of network traffic, and the information can be provided by time domain analysis is very limited. Traffic matrix describes the traffic distribution between arbitrary OD (Origin-Destination) pairs in a network for a period of time. It can describe the traffic characteristics of the whole network and has become a crucial parameter in network traffic engineering. The traffic matrix contains the information of irregular topology in the network. Diffusion wavelet can effectively analyze the irregular topology and multi-layer structure in time domain and space domain. In this paper, the multiscale analysis of the flow matrix is carried out by using the diffusion wavelet technique, and the results are applied to the DDoS detection of the global network. The main research contents of this paper are as follows: (1) this paper firstly studies the characteristics of traditional network traffic models and analyzes their advantages and disadvantages. Network traffic characteristics and related metrics. (2) Multiscale analysis of network traffic matrix based on diffusion wavelet technology. By analyzing the different scale coefficients obtained by diffusive wavelet transform of flow matrix, the fourth layer rough coefficient matrix is selected as the main research object and five important characteristic parameters are obtained from it. (3) based on the analysis of the above characteristic parameters, two methods to detect a single node being attacked by DDoS are presented: Hurst exponent detection method and dynamic threshold detection method. The former uses the Hurst index which is the most important index to describe self-similarity in anomaly detection, and the anomaly detection rate reaches 91%. The latter sets the dynamic threshold by combining the characteristics of long correlation and short correlation in network traffic. The abnormal detection rate reaches 93.9 and the false alarm rate is only 10.9. In this paper, the existing detection methods are analyzed and compared. Because the proposed method combines the results of diffusion wavelet analysis, the selected characteristic parameters describe the characteristics of the original flow matrix perfectly, and the efficiency of detecting DDoS anomaly attacks is improved.
【学位授予单位】：北京交通大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP393.06

【相似文献】