نوع مقاله : مقاله پژوهشی
نویسنده
گروه مهندسی برق، واحد بیضا، دانشگاه آزاد اسلامی، بیضا، ایران
کلیدواژهها
موضوعات
عنوان مقاله English
نویسنده English
In the field of network anomaly detection in the Internet Protocol (IP) architecture, a variety of methods have been proposed. Since the network behavior is reflected in the communication traffic, anomaly detection should be possible by analyzing the communication traffic flows correctly. In large-scale IP networks, traffic flows are allocated and encapsulated by headers along with the communication operator, and it is difficult to observe and accurately detect the occurrence of anomalies in individual communication flows in the form of coarser information, and the flow obtained by flow measurement protocols (IP Information Export) is the result of combining different communication flows with different characteristics.
In this study, an anomaly detection method based on time series traffic flows is proposed. First, the composite traffic flows are implemented using a system called Fast Proxy, which can decompose traffic flows into individual flows with very fine granularity and detect anomalies in the decomposed flows based on a simple correlation analysis and dynamic threshold configuration. The proposed method detects anomalies caused by service failures with almost 100% accuracy and even achieves an accuracy of about 80% to 90% in more difficult detection cases, such as small traffic fluctuations or noisy conditions.
کلیدواژهها English
