基于超统计理论的网络流量异常检测方法研究
|
摘要
随着科学技术的不断进步,网络技术和网络的规模也随之不断发展和变化,一方面它使得网络的结构变得纷繁复杂,网络的设备和网络上承载的业务种类不断增加,另一方面随着网络的快速发展,网络出现各种故障或性能问题的可能性大大增加,各种威胁网络安全和影响网络正常工作的行为不断产生。通过检测网络流量的异常能够有效的发现网络中可能存在的故障和性能问题,它对于提高网络的可用性和可靠性的有着显著的效果,也能增强对网络安全应急的响应,从而保证网络的服务质量。
基于网络流量的异常检测方法可分为有统计模型参数检测和无统计模型的参数检验。针对有统计模型参数检测这一类方法,在建立统计模型或分布时应首先要考虑序列的平稳性。时间序列的平稳性可分为严平稳和宽平稳,只有时间序列建立在平稳至少宽平稳的基础上才能进行统计模型的研究。大多数时候指的是宽平稳的情况,此时参量保持不变或者是变化很小。而对非平稳的时间序列进行平稳化处理,大多数的非平稳序列可以通过一阶差分或多阶差分处理成平稳序列;而网络流量特别是含有异常的网络流量是一种复杂的非平稳的变化过程,这也体现了网络异常流量突发性的特点,所以传统差分转平稳方法一般是无效的。由于以往的研究往往没有考虑到网络的非平稳性和突发性,及其统计分布参数是随机或者是复杂变化的,由此不可避免的导致异常检测所存在的问题。
从网络流量的非平稳和突发性特点出发,特别考虑到由于攻击流量所引起的流量特性的变化,结合超统计理论,主要研究统计参量的变化。依据超统计的理论,首先应建立分布统计模型,由于网络流量的非平稳特性在建立统计分布模型的同时需对网络流量进行平稳化处理,在此基础上结合网络流量本身具有重尾性长相关的特点,建立广义pareto分布模型。根据微积分分窗处理的思想可以有效降低其在子窗显著性和复杂性,采用非平稳序列划分成平稳子段,再根据流量的本身统计特性确定相应的统计模型的基础之上,由保持统计模型的参数在子窗内的宽平稳性原则进行分窗处理。超统计理论本质是研究统计之统计,考虑分布统计模型的参量变化,络流量的变化。通过对系统结构起决定性作用的形状参数序列研究预测网络流量,在此基础上运用检测方法对网络流量进行异常检测。最后根据形状参数的预测结果进行异常检测。该检测方法大大降低了计算的复杂度,通过大量实验表明该方法具有良好的效果。
从网络流量的复杂性和网络流量具有的混沌特性出发,将一维空间信息重构到多维空间,虽然增加系统的维数,但重构后的序列一方面能让信息分布在不同的维度,能够更加充分的展现系统的细节信息,能够在不同维度上全面的分析系统,另外一方面重构使每一维的计算复杂度大大降低,从而达到降低整个系统复杂度的目的。经过相空间重构后,网络流量仍然是一个非平稳的复杂过程,考虑到网络的非平稳性和突发性,及其统计分布参数是随机或者是复杂变化的,因此采用超统计理论来研究网络流量这类非平稳的复杂过程。另外针对网络流量的异常是从平衡态到另一平衡态过程的暂态过程,该过程是复杂的非平稳的突变过程,提出了一种基于突变理论的综合决策模型,既能有效的处理平衡态之间的暂态过程,又改变依靠单一参数序列的局限性,综合考虑多参数序列融合,提高的系统的准确性和实时性。此外与其他网络流量异常检测模型相比,该方法具有计算复杂度低,检出率高和误检率低等特点。
本研究得到项目编号为No. 60773192的国家自然基金研究计划支持,项目名称为基于相空间突变模型的网络异常流量检测方法研究。
With the fast increase of network connections, the problem of intrusion detection becomes more and more important. Although internet service can provide useful information due to its open property, it should also be noticed that the number of network intrusions increases faster than before, which introduces a lot of inconvenience to the users.
Network traffic anomaly detection is usually divided into two basic categories. The one is based on statistical model (which first predict and then detect on the statistical model or the distribution), the other is based on the characteristic quantity of the network directly. Because of the large randomness and the enormous data quantity of the network traffic, it usually has a higher false reject rate and needs even longer computing time in detecting network traffic directly. The main advantages of network traffic anomaly detection based on the characteristic quantity are as follows: the number of the characteristic quantity is far lower than the original network flow, so it only spends less time to complete the detection. In the fact, the effect of the detection directly depends on the selected characteristic quantity and the result on anomaly detection if selecting the no- ideal characteristic quantity is even worse than that on detecting the original network flow directly. However, network traffic anomaly detection based on statistical model establishes the statistical model first with comprehensive consideration of all of properties of network traffic, and then predicts network flow according to the model, finally detects on the basis of the difference between the prediction results and the actual results. The advantage of this kind method is with the consideration of the network characteristics, but it needs a large amount of data and has very high computational complexity in posterior prediction. This paper mainly focuses on the method with the statistical model, furthermore, before establishing the statistical model or the distribution, and the stationary of the series should be considered first. We must take a wide sense stationary process as a basis to carry on feasibility research at least.
In this paper, the experimental results show that the abnormal traffic flow is a kind of complicated changing process, which is non-stationary, random and abrupt. So it is invalid to process the non-stationary by using the differential transform simply, which has been proved in this paper. Due to the basic characters mentioned above, there are a lot of unavoidable problems in network traffic anomaly detection. Therefore, aiming at these kinds of complicated problems effectively, the superstatistics theory has been put forward to relate with the network flow, which is suitable for the change of the statistical parameters. We propose to use a more complex method which comprise the conception of‘statistics of statistics’(that is‘superstatistics’, SS) to model the network traffic. The‘superstatistics’is the frontier areas of today’s physics region which can conquer the disadvantage of normal statistical methods.‘Superstatistics’means a kind of‘statistics of statistics’, which is used in non-equilibrium systems with complex dynamics in stationary states with large fluctuation of intensive quantities on long time scales.
After the non-stationary series transformed into the stationary series, the corresponding statistical model can be determined on the basics of the statistical characteristics. According to the infinitesimal calculus theory, segments can be done under the premise of a wide sense stationary, which can effectively reduce the significance and complexity of the segments. The superstatistics theory mainly describes the parameter variation of the distribution model and according to the parameter characteristics the abnormal changes of the network flow can be found by the changes of the parameters on a certain degree. Therefore, network traffic abnormity detection can be completed effectively through the research on the decisive distribution parameters which are named slow parameters and the adaptive detection method.As a whole, it is more visual then ever before. This method has obtained a very good effect through a lot of experiments. The research of the complex network flow focused on the region of some decisive parameter series. The method not only makes up for those shortcomings, but also avoids the computational complexity of the traditional statistical model.
基于网络流量的异常检测方法可分为有统计模型参数检测和无统计模型的参数检验。针对有统计模型参数检测这一类方法,在建立统计模型或分布时应首先要考虑序列的平稳性。时间序列的平稳性可分为严平稳和宽平稳,只有时间序列建立在平稳至少宽平稳的基础上才能进行统计模型的研究。大多数时候指的是宽平稳的情况,此时参量保持不变或者是变化很小。而对非平稳的时间序列进行平稳化处理,大多数的非平稳序列可以通过一阶差分或多阶差分处理成平稳序列;而网络流量特别是含有异常的网络流量是一种复杂的非平稳的变化过程,这也体现了网络异常流量突发性的特点,所以传统差分转平稳方法一般是无效的。由于以往的研究往往没有考虑到网络的非平稳性和突发性,及其统计分布参数是随机或者是复杂变化的,由此不可避免的导致异常检测所存在的问题。
从网络流量的非平稳和突发性特点出发,特别考虑到由于攻击流量所引起的流量特性的变化,结合超统计理论,主要研究统计参量的变化。依据超统计的理论,首先应建立分布统计模型,由于网络流量的非平稳特性在建立统计分布模型的同时需对网络流量进行平稳化处理,在此基础上结合网络流量本身具有重尾性长相关的特点,建立广义pareto分布模型。根据微积分分窗处理的思想可以有效降低其在子窗显著性和复杂性,采用非平稳序列划分成平稳子段,再根据流量的本身统计特性确定相应的统计模型的基础之上,由保持统计模型的参数在子窗内的宽平稳性原则进行分窗处理。超统计理论本质是研究统计之统计,考虑分布统计模型的参量变化,络流量的变化。通过对系统结构起决定性作用的形状参数序列研究预测网络流量,在此基础上运用检测方法对网络流量进行异常检测。最后根据形状参数的预测结果进行异常检测。该检测方法大大降低了计算的复杂度,通过大量实验表明该方法具有良好的效果。
从网络流量的复杂性和网络流量具有的混沌特性出发,将一维空间信息重构到多维空间,虽然增加系统的维数,但重构后的序列一方面能让信息分布在不同的维度,能够更加充分的展现系统的细节信息,能够在不同维度上全面的分析系统,另外一方面重构使每一维的计算复杂度大大降低,从而达到降低整个系统复杂度的目的。经过相空间重构后,网络流量仍然是一个非平稳的复杂过程,考虑到网络的非平稳性和突发性,及其统计分布参数是随机或者是复杂变化的,因此采用超统计理论来研究网络流量这类非平稳的复杂过程。另外针对网络流量的异常是从平衡态到另一平衡态过程的暂态过程,该过程是复杂的非平稳的突变过程,提出了一种基于突变理论的综合决策模型,既能有效的处理平衡态之间的暂态过程,又改变依靠单一参数序列的局限性,综合考虑多参数序列融合,提高的系统的准确性和实时性。此外与其他网络流量异常检测模型相比,该方法具有计算复杂度低,检出率高和误检率低等特点。
本研究得到项目编号为No. 60773192的国家自然基金研究计划支持,项目名称为基于相空间突变模型的网络异常流量检测方法研究。
With the fast increase of network connections, the problem of intrusion detection becomes more and more important. Although internet service can provide useful information due to its open property, it should also be noticed that the number of network intrusions increases faster than before, which introduces a lot of inconvenience to the users.
Network traffic anomaly detection is usually divided into two basic categories. The one is based on statistical model (which first predict and then detect on the statistical model or the distribution), the other is based on the characteristic quantity of the network directly. Because of the large randomness and the enormous data quantity of the network traffic, it usually has a higher false reject rate and needs even longer computing time in detecting network traffic directly. The main advantages of network traffic anomaly detection based on the characteristic quantity are as follows: the number of the characteristic quantity is far lower than the original network flow, so it only spends less time to complete the detection. In the fact, the effect of the detection directly depends on the selected characteristic quantity and the result on anomaly detection if selecting the no- ideal characteristic quantity is even worse than that on detecting the original network flow directly. However, network traffic anomaly detection based on statistical model establishes the statistical model first with comprehensive consideration of all of properties of network traffic, and then predicts network flow according to the model, finally detects on the basis of the difference between the prediction results and the actual results. The advantage of this kind method is with the consideration of the network characteristics, but it needs a large amount of data and has very high computational complexity in posterior prediction. This paper mainly focuses on the method with the statistical model, furthermore, before establishing the statistical model or the distribution, and the stationary of the series should be considered first. We must take a wide sense stationary process as a basis to carry on feasibility research at least.
In this paper, the experimental results show that the abnormal traffic flow is a kind of complicated changing process, which is non-stationary, random and abrupt. So it is invalid to process the non-stationary by using the differential transform simply, which has been proved in this paper. Due to the basic characters mentioned above, there are a lot of unavoidable problems in network traffic anomaly detection. Therefore, aiming at these kinds of complicated problems effectively, the superstatistics theory has been put forward to relate with the network flow, which is suitable for the change of the statistical parameters. We propose to use a more complex method which comprise the conception of‘statistics of statistics’(that is‘superstatistics’, SS) to model the network traffic. The‘superstatistics’is the frontier areas of today’s physics region which can conquer the disadvantage of normal statistical methods.‘Superstatistics’means a kind of‘statistics of statistics’, which is used in non-equilibrium systems with complex dynamics in stationary states with large fluctuation of intensive quantities on long time scales.
After the non-stationary series transformed into the stationary series, the corresponding statistical model can be determined on the basics of the statistical characteristics. According to the infinitesimal calculus theory, segments can be done under the premise of a wide sense stationary, which can effectively reduce the significance and complexity of the segments. The superstatistics theory mainly describes the parameter variation of the distribution model and according to the parameter characteristics the abnormal changes of the network flow can be found by the changes of the parameters on a certain degree. Therefore, network traffic abnormity detection can be completed effectively through the research on the decisive distribution parameters which are named slow parameters and the adaptive detection method.As a whole, it is more visual then ever before. This method has obtained a very good effect through a lot of experiments. The research of the complex network flow focused on the region of some decisive parameter series. The method not only makes up for those shortcomings, but also avoids the computational complexity of the traditional statistical model.
引文
[1]中国互联网络信息中心.第25次中国互联网络发展状况统计报告. http: //www. cnnic. cn, 2010
[2] C. S. Hood and C. Ji. Beyond thresholds: an alternative method for extracting information from network measures. In Proceedings of IEEE Globecom Conference. Phoenix. Arizona. 1997. 187-191
[3] Roy A, Maxion and Frank E. Feather. A Case Study of Ethernet anomalies. In a Distributed Computing Environment. IEEE Transaction on Reliability. 1990. 39(4): 433-443
[4]国家计算网络应急技术处理协调中心. 2010年中国互联网网络安全报告
[5] Laura Feinstein, Dan Schnackenberg, Ravindra Balupari, et al. Statistical Approaches to DDoS Attack Detection and Response. DARPA Information Survivability Conference and Exposition IEEE. 2003, 17(14): 543-560
[6]田雪峰,钟求喜,苏金树.蠕虫早期检测系统研究.信息安全与通信保密, 2005, 7: 238-242
[7]徐晓东. NetFlow的网络异常流量的分离及分类: [硕士论文]江苏大学, 2009
[8] Subhabrata. Sen, Oliver. Spatscheck. Scalable In Network Identification of P2P Traffic Using Application Signatures. ACM. 2004. 5
[9] Glenn Carl, George Kesidis, Richard R. Brooks, et al. Denial-of-Service Attack-Detection Techniques. IEEE Internet Computing. 2006, 29(14): 179-20
[10] Thomas Karagiannis, Andre Broido, Michatis Faloutsos, et al.Transport Layer Identification of P2P Traffic. International Measurement Conference, Taormina. Italy. 2004
[11]马媛.基于异常流量的蠕虫检测系统研究与实现: [硕士论文]武汉:华中科技大学硕士论文, 2007: 15-20
[12]陈鸣,徐博.一种基于NetFlow的网络蠕虫检测算法.解放军理工大学学报, 2006, 7 (4): 336-340
[13] M. Thottan and C. Ji. Proactive anomaly Detection Using Distributed Intelligentagents. IEEE Network, 1998, 12(5): 21-27
[14]山秀明,王磊,任勇等.互联网复杂性研究进展.北京邮电大学学报. 2006, 29(1): 1-8
[15] Roy A Maxion. Anomaly detection for diagnosis. In: 20th Int'1 Symp Fault-Tolerant Computing(FTCS-20). Newcastle upon Tyne England. 1990, 20-27
[16] L. Lawrence, Ho. David. Adaptiwe and automated detection of senvice anomalies in transaction-oriented WAN's: network analysis, algorithms, implementation and deployment. IEEE Journal of Seletected areas in Communications, 2000, 18(5): 744-757
[17] VFrost, B. Melamed. Traffic Modeling for Telecommunications Networks IEEE Communication Magazine. 1994, 32(3): 70-81
[18] J. Brutlag. Aberrant Behavior Detection in Time Series For Network Monitoring. Proceedings of the USENLX Fourteenth System Administration Conference, New Orleans, LA. 2000, 12
[19]王振龙.时间序列分析.北京:中国统计出版社, 1999
[20] Amy Ward, Peter Glynn and Katlzy Richardson. Internet Service Performance Failure Detection. In Proceedings of the 1998 Internet Server Performance Workshop, Madison, 103-109
[21] Failure Detection. Performance Evaluation Review, 1998. 26(3): 38-44
[22] Marina Thottan, C. Ji. Adaptive Thresholding for Proactive Network Problem Detection. IEEE Intemational workshop on Systems Management, Newport Rhode Island, 1998. 108-116
[23] M. Thottan and C. Ji. Statistical Detection of Enterprise Network Problem. Journal of Network and System Management. 1999, 7(1)27-45
[24]王彦、王玥、胡铭曾,基于小波的异常检测方法研究,哈尔滨商业大学学报:自然科学版, 2006, 22(6): 58-61
[25]高军,网络流量异常检测的小波分析方法: [硕士学位论文]成都:电子科技大学, 2006
[26] Seong Soo Kim statistical techniques for detecting traffic anomalies through packet header data IEEE/ACM Transactions on Networking, 2008, 16(3): 562-75
[27] Paul Barford, Jeffery Kline, David Plonka and Amos Ron. A Signal Analysis of Network Traffic Anomalies. Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurement, 2002: 71-82
[28]李宗林,胡光岷,周汝强.基于层叠模型的网络流量异常检测方法.计算机应用研究, 2008, 9: 2839-2842
[29] Akujuobi, C. M. Application of wavelets and self-similarity to enterprise network intrusion detection and prevention systems. IEEE 11th International Symposium on Consumer Electronics, 2007: 1-6
[30] Li, Zonglin, Hu, Guangmin, Zhou, Ruqiang. Traffic model analysis for anomaly detection, Proceedings of the International Conferrence information computing and automation. 2008, 3: 1434-1437
[31]李宗林,胡光岷,周汝强.基于层叠模型的网络流量异常检测方法.计算机应用研究, 2008, 9: 2839-2844
[32]王欣,方滨兴. Hurst参数变化在网络流量异常检测中的应用.哈尔滨工业大学学报. 2005, 37(8): 1046-1049
[33]任勋益,王汝传,王海艳.基于自相似检测DDoS攻击的小波分析方法.通信学报. 2006, 27(5): 6-11
[34]吴冰,云晓春,陈海永.基于统计的网络流量模型及异常流量发现.高技术通讯, 2007, 17(10): 1007-1012
[35] M. V. Mahoney, P. K. Chan. Learning Nonstationary Models of Normal Network Traffic for Detecting Novel Attacks. Proceedings of the 8th International Conference on Knowledge Discovery and Data Mining, 376-385, 2002
[36] Leland W, Taqqu M, Willinger W, et al. On the selfsimilar nature of Eethernet traffic. IEEE/ ACM Transactions on Networking, 1994, 2 (1): 1210-1215
[37] W. Willinger, M. S. Taqqu, W. E. Leland, et al. Self-Similarity in High-Speed Packet Traffic: Analysis and Modeling of Ethernet Traffic Measurements. Statistical Science, 1995, 10: 67-85
[38]孙知信.焦琳,姜举良.基于流量状态特性的网络异常流量检测模型研究.南京邮电大学学报(自然科学版), 2007, 27(2): 44-50
[39]阎勇,朱光喜.具有重尾特性自相似网络通信量的预测.华中科技大学学报(自然科学版, 2006, 9: 29-31
[40] Qingtao Wu, Zhiqing Shao. Network Anomaly Detection Using Time Series Analysis. Autonomic and Autonomous Systems and International Conference on Networking and Services, 2005, 10: 42-43
[41] Robin Sommer, Vern Paxson. Enhancing byte-level network intrusion detection signatures with context. In CCS '03: Proceedings of the 10th ACM conference on Computer and communications security, 2003: 262-271
[42]杨家海,吴建平.基于非平稳型流量队列模型的Internet流量测量研究.电子学报, 2004, 32(5): 727-730
[43]王欣,方滨兴. Hurst参数变化在网络流量异常检测中的应用.哈尔滨工业大学学报, 2005, 37(8): 1046-1049
[44] Xiang, Y Lin, Y Lei, W L Huang. Detecting DDOS attack based on network self-similarity. IEEE Proceeding Communications, 2004, 151(3): 292-295
[45]任勋益,王汝传,王海艳.基于自相似检测DDoS攻击的小波分析方法.通信学报, 2006, 27(5): 6-11
[46] J. Beran, R. Sherman, M. S. Taqqu, and W. Willinger. Long-Range Dependence in Variable-Bit-Rate Video Traffic. IEEE Transactions on Communications, 2002, 6: 1566-1579
[47] Mark E. Crovella, Murad S. Taqqu and Azer Bestavros. Heavy-Tailed Probability Distributions in the World Wide Web. In A Practical Guide To Heavy Tails, 1998, 1: 3-26
[48] R. H. Riedi, W. Willinger. Towards an improved understanding of network traffic dynamics. In Self-similar Network Traffic and Performance Evaluation, Wiley, 2000, 20: 507-530.
[49] V. Paxson and S. Floyd. Wide area traffic: The failure of Poisson modeling. IEEE/ACM Trans. Networking, 1995, 3(3): 226-244
[50] A. K. Erlang. Solution of some problems in the theory of probabilities of signicance in automatic telephone exchanges. The life and works of A. K. Erlang, Eds: E.Brockmeyer, H. L. Halstrom, A. Jensen, 1948: 138-155
[51] S. Rajaram, T. Graepel, and R. Herbrich. Poisson networks: A model for structured point processes. In AI and Statistics, 2005, 10
[52] Mandelbrot B. Long-run linearity locally Gaussian Processes, h-specta and infinite variance. Int. Econom. Rev, 1969, 10(1): 82-113
[53] Hlavacs H, Kotsis G, Steinkeller C. Traffic Source Modeling University of Vienna: Technical Report No. TR-99101, Institute for Appl Comp Science and Inf Systems
[54]张波,商豪.应用随机过程.中国人民大学出版社, 2009
[55]付立政,肖波,侯东.基于独立MMPP业务输入模型的输入/输出排队.小型微型计算机系统, 2001, 1: 33-36
[56]石江涛,王永纲,戴雪龙.自相似网络业务流量的研究与实现.通信学报, 2005(6): 112-117
[57] Gooijer De, Abraham B, Ann Gould, et al. Methods for Determining the Order of an Autoregressive-Moving Average Process. International Statistical Review, 1985(3): 301-329
[58] Wayne A, Woodward H L G. On the relationship between the S Array and the Box-Jenkins Method of ARMA Model identification. Journal of the American statistical Association, 1981(76): 579-587
[59] Karagiannis T, Molle M, Faloutsos M. Long-range Dependence: Ten Years of Internet Traffic Modeling. IEEE Internet Computing. 2004, 8(5): 57-64
[60] Ulanovs P, Peterssons E. Modeling methods of self-similar traffic for network performance evaluation. Scientific Proceedings of Riga Technical University, Telecommunications and Electronics 2002. 86-96
[61] Willinger W, Taqqu M S, Sherman R, et al. Self-similarity through high-variability: statistical analysis of ethernet LAN traffic atthe source level. IEEE/ACM Transactions on Networking, 1997, 5(1): 71-86
[62] Geriner M, Jobmann M, Lipsky L. The importance of power-tail distributions for modeling queuing systems. Operations Research. 1999, 47(2): 313-326
[63] Chen Borsen, Yang Yusuarg, Lee Botekuen, et al. Fuzzy adaptive predictive flow control of ATM network traffic. IEEE Transactions on Fuzzy System. 2003, 11(4):568-581
[64]刘嘉,金志刚,薛飞等.基于FARIMA过程的网络业务预报与应用.电子与信息学报. 2001, 23(4): 403-407
[65] K. Nagarajan and G. T. Zhou. Modeling the Short and Long Memories of VBR Video Streams. Proc. Intl. Workshop on Applications of Heavy Tailed Distributions in Economics, Engineering and Statistics, Washington, DC, 1999, 6
[66] Ilow J. Forecasting network traffic using FARIMA models with heavy tailed innovations. Acoustics, Speech, and Signal Processing. 2000, 3814-3817
[67] Zhigang Jin, Yantai Shu, Jiakun Liu, et al. Non-Gaussian Characteristic and FARIMA(p, d, q) Traffic Models. In Proceedings of the IEEE Canadian Conference on Electrical and Computer Engineering. Toronto, Canada. 2002, 5: 691-696
[68]杨位钦,顾岚.时间序列分析与动态数据建模.北京理工大学出版. 1988
[69] Christian Beck, Ezechiel G. D. Cohen, Harry L. Swinney. From time series to superstatistics. Phys. Rev. 2005, 72: 056133
[70] C. Beck, E. G. D. Cohen. Superstatistics. Physica A, 2003 (322): 267-275
[71] E. G. D. Cohen. Superstatistics. Physica D, 2004 (193): 35–52
[72]王少杰,顾牡.大学物理(第三版).同济大学出版社. 2006. 12
[73] M. Mahoney and P. Chan. An analysis of the 1999 darpa/lincoln laboratory evaluation data for network anomaly detection. In Proceeding of Recent Advances in Intrusion Detection, Lecture Notes in Computer Science. 2003. 2820: 220-237
[74] DARPA 99 Intrusion Detection Data Set Attack Documentation,
[75] http: //www. ll. mit. edu/IST/ideval/docs/1999/attackDB. html
[76]李海芬. Pareto分布的统计分析.华东师范大学, 2004
[77]南新艳.广义Pareto分布.华东师范大学, 2005
[78] Malik H. j. Estimation of the Paremeter of the Pareto Distribution. Metrika, 1970, l5: 126-132
[79] Rasmussen, P. F. Generalized probability weighted moments: Application to the generalized Pareto distribution. Water Resources Research, 2001, 6(1): 1745-1751
[80] Tekin ?ZTEK. Comparison of Parameter Estimation Methods for the Three-Parameter Generalized Pareto Distribution, Turk J Agric, 2005(9): 419-428
[81] Arriod B C. Pareto Distribution. Fairland. Maryland: International Co- operative Publishing House, 1983
[82]茆诗松,王静龙.数理统计.华东师范大学出版社, 1990: 299 -303
[83]封国林,龚志强,董文杰等.基于启发式分割算法的气候突变检测研究.物理学报. 2005, 54(11): 5494-5499
[84]万仕全,封国林,董文杰等.气候代用资料动力学结构的区域与全球特征.物理学报. 2005, 54(11): 5487-5493
[85] R. A. Kemmerer and G. Vigna, Intrusion detection: A brief history and review, Computer, 2002, 35(4): 27-30
[86] Box G E P, Jenkins G M. Time Series Analysis. Forcasting and Control. 1976
[87] Davison, A. C., Modeling excesses over high thresholds, with an application. In: Statistical Extremes and Applications, ed. J. Tiago de Oliveira, Dordrecht: D. Reidel. 1984: 461–482
[88] Tsay R S, Tiao G C. Consistent estimates of autoregressive parameters and extended sample autocorrelation function for stationary and non-stationary ARMA models. 1984, 79: 84-96
[89]杨位钦,顾岚.时间序列分析与动态数据建模.北京理工大学出版. 1988
[90] Box G E, Jenkins G M. Time Series Analysis: Forecasting and Control. San Francisco: Holden-Day, 1976
[91] Di He Leung, H. Network Intrusion Detection Using CFAR Abrupt-Change Detectors, Instrumentation and Measurement, IEEE Transactions on, Volume: 2008, 57: 490-497
[92] Ye. N. and Chen, Q. An Anomaly Detection Technique Based on A ChiSquare Statistic for Detecting Intrusion Into Information System, Quality and Reliability Engineering International, 2001, 17. 105-112
[93] Ye, N., Chen, Q. and Borror, C. M. EWMA Forecast of Normal System Activity for Computer Intrusion Detection. IEEE Transaction on Reliability, 2004, 53(4), 557-566
[94] Yang Yue, Hu Hanping, Xiong Wei, et al. A Novel Network Traffic Model Based On Superstatistics Theory. The 2nd IEEE International Workshop of IntelligentSystem and Applications. 2010: 219-221
[95] N. H. Packard, J. P. Crutchfield, J. D. Farmer, et al. Geometry from a Time Series. Phys. Rev. Lett. 1980, (45): 712-716
[96]吴晓江,帅典勋,刘东林等.网络行为建模环境的实现及网络混沌性状分析.通信学报. 2002, 23(9): 29-35
[97] Yang Yue, Hu Hanping, Xiong Wei, Ding Fan. Network Traffic Anomaly Detection Method Based on a Feature of Catastrophe Theory, Chinese Physics Letters, 2010 27(6): 060501
[98] Hanping Hu, Xiaogang Wu, Zuxi Wang. Synchronizing chaotic map from two-valued symbolic sequences. Chaos, Solitons & Fractals, 2005, 24, 1059-1064
[99] Veres A, Boda M. The chaotic nature of TCP congestion control. in: Joseph D. Proc IEEE INFOCOM2000. IEEE Computer Society. Canada. 2000: 1715-1723
[100] Takens F. Rand D., On the numerical determination of the dimension of an attractor. In: Dynamical Systems and Turbulence., Lecture Notes in Mathematics, Springer-Verlag. 1981, 898: 366~381
[101] CaoL. Y. Practical method for determining the minimum embedding dimension of a scalar time series. Physica D, 1997, 110(5): 43~50
[102]吕金虎,陆君安,陈士华.混沌时间序列分析及其应用. (第一版).武汉:武汉大学出版社, 2002
[103] Grassberger P, Procaccia I. Measuring the strangeness of strange attractors. Physica D, 1983, 9: 189~208
[104] Abarbanel H. D. I., Brown R., Sidorowich J. J. et al. The analysis of observed data in physical systems. Reviews of Modern Physics, 1993, 65(5): 1331~1392
[105] Fraser A. M. Information and entroy in strange attractors. IEEE Trans. Inf. Theory, 1989, 35: 245-262
[106] Fraser A. M., Swinney H. Independent coordinates for strange attractors from mutual information. Physical Review A, 1986, 33(2): 1134-1140
[107] Gilmore. R.. Catastrophe theory for science and engineers. New York, John Wiley & Sons, 1981
[108] Kennel M, Brown R, Abarbanel H. Determining embedding dimension forphase-space reconstruction using a geometrical construction. Physical Review A, 1992, 45(6): 3403~3411
[109] Saunders P. T., An Introduction to Catastrophe Theory. Cambridge University Press, Cambridge, 1980
[110]桑博德.突变理论入门(第二版).上海:上海科学技术文献出版社, 1983
[111]勒内.托姆,周仲良.突变论:思想和应用(第一版).上海.上海译文出版社, 1989: 256～260
[112]凌复华.突变理论及其应用(第一版).上海:上海交通大学出版社, 1987. 112-116
[113]张亚平,张起森.尖点突变理论在交通流预测中的应用.系统工程学报, 2000, 15(3): 272～276
[114] Cobb, L. Parameter estimation for the cusp catastrophe model. Behavioral Science, 1981, 26: 75-78
[115]都兴富.突变理论在经济领域的应用(第一版).成都:电子科技大学出版社, 1994
[2] C. S. Hood and C. Ji. Beyond thresholds: an alternative method for extracting information from network measures. In Proceedings of IEEE Globecom Conference. Phoenix. Arizona. 1997. 187-191
[3] Roy A, Maxion and Frank E. Feather. A Case Study of Ethernet anomalies. In a Distributed Computing Environment. IEEE Transaction on Reliability. 1990. 39(4): 433-443
[4]国家计算网络应急技术处理协调中心. 2010年中国互联网网络安全报告
[5] Laura Feinstein, Dan Schnackenberg, Ravindra Balupari, et al. Statistical Approaches to DDoS Attack Detection and Response. DARPA Information Survivability Conference and Exposition IEEE. 2003, 17(14): 543-560
[6]田雪峰,钟求喜,苏金树.蠕虫早期检测系统研究.信息安全与通信保密, 2005, 7: 238-242
[7]徐晓东. NetFlow的网络异常流量的分离及分类: [硕士论文]江苏大学, 2009
[8] Subhabrata. Sen, Oliver. Spatscheck. Scalable In Network Identification of P2P Traffic Using Application Signatures. ACM. 2004. 5
[9] Glenn Carl, George Kesidis, Richard R. Brooks, et al. Denial-of-Service Attack-Detection Techniques. IEEE Internet Computing. 2006, 29(14): 179-20
[10] Thomas Karagiannis, Andre Broido, Michatis Faloutsos, et al.Transport Layer Identification of P2P Traffic. International Measurement Conference, Taormina. Italy. 2004
[11]马媛.基于异常流量的蠕虫检测系统研究与实现: [硕士论文]武汉:华中科技大学硕士论文, 2007: 15-20
[12]陈鸣,徐博.一种基于NetFlow的网络蠕虫检测算法.解放军理工大学学报, 2006, 7 (4): 336-340
[13] M. Thottan and C. Ji. Proactive anomaly Detection Using Distributed Intelligentagents. IEEE Network, 1998, 12(5): 21-27
[14]山秀明,王磊,任勇等.互联网复杂性研究进展.北京邮电大学学报. 2006, 29(1): 1-8
[15] Roy A Maxion. Anomaly detection for diagnosis. In: 20th Int'1 Symp Fault-Tolerant Computing(FTCS-20). Newcastle upon Tyne England. 1990, 20-27
[16] L. Lawrence, Ho. David. Adaptiwe and automated detection of senvice anomalies in transaction-oriented WAN's: network analysis, algorithms, implementation and deployment. IEEE Journal of Seletected areas in Communications, 2000, 18(5): 744-757
[17] VFrost, B. Melamed. Traffic Modeling for Telecommunications Networks IEEE Communication Magazine. 1994, 32(3): 70-81
[18] J. Brutlag. Aberrant Behavior Detection in Time Series For Network Monitoring. Proceedings of the USENLX Fourteenth System Administration Conference, New Orleans, LA. 2000, 12
[19]王振龙.时间序列分析.北京:中国统计出版社, 1999
[20] Amy Ward, Peter Glynn and Katlzy Richardson. Internet Service Performance Failure Detection. In Proceedings of the 1998 Internet Server Performance Workshop, Madison, 103-109
[21] Failure Detection. Performance Evaluation Review, 1998. 26(3): 38-44
[22] Marina Thottan, C. Ji. Adaptive Thresholding for Proactive Network Problem Detection. IEEE Intemational workshop on Systems Management, Newport Rhode Island, 1998. 108-116
[23] M. Thottan and C. Ji. Statistical Detection of Enterprise Network Problem. Journal of Network and System Management. 1999, 7(1)27-45
[24]王彦、王玥、胡铭曾,基于小波的异常检测方法研究,哈尔滨商业大学学报:自然科学版, 2006, 22(6): 58-61
[25]高军,网络流量异常检测的小波分析方法: [硕士学位论文]成都:电子科技大学, 2006
[26] Seong Soo Kim statistical techniques for detecting traffic anomalies through packet header data IEEE/ACM Transactions on Networking, 2008, 16(3): 562-75
[27] Paul Barford, Jeffery Kline, David Plonka and Amos Ron. A Signal Analysis of Network Traffic Anomalies. Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurement, 2002: 71-82
[28]李宗林,胡光岷,周汝强.基于层叠模型的网络流量异常检测方法.计算机应用研究, 2008, 9: 2839-2842
[29] Akujuobi, C. M. Application of wavelets and self-similarity to enterprise network intrusion detection and prevention systems. IEEE 11th International Symposium on Consumer Electronics, 2007: 1-6
[30] Li, Zonglin, Hu, Guangmin, Zhou, Ruqiang. Traffic model analysis for anomaly detection, Proceedings of the International Conferrence information computing and automation. 2008, 3: 1434-1437
[31]李宗林,胡光岷,周汝强.基于层叠模型的网络流量异常检测方法.计算机应用研究, 2008, 9: 2839-2844
[32]王欣,方滨兴. Hurst参数变化在网络流量异常检测中的应用.哈尔滨工业大学学报. 2005, 37(8): 1046-1049
[33]任勋益,王汝传,王海艳.基于自相似检测DDoS攻击的小波分析方法.通信学报. 2006, 27(5): 6-11
[34]吴冰,云晓春,陈海永.基于统计的网络流量模型及异常流量发现.高技术通讯, 2007, 17(10): 1007-1012
[35] M. V. Mahoney, P. K. Chan. Learning Nonstationary Models of Normal Network Traffic for Detecting Novel Attacks. Proceedings of the 8th International Conference on Knowledge Discovery and Data Mining, 376-385, 2002
[36] Leland W, Taqqu M, Willinger W, et al. On the selfsimilar nature of Eethernet traffic. IEEE/ ACM Transactions on Networking, 1994, 2 (1): 1210-1215
[37] W. Willinger, M. S. Taqqu, W. E. Leland, et al. Self-Similarity in High-Speed Packet Traffic: Analysis and Modeling of Ethernet Traffic Measurements. Statistical Science, 1995, 10: 67-85
[38]孙知信.焦琳,姜举良.基于流量状态特性的网络异常流量检测模型研究.南京邮电大学学报(自然科学版), 2007, 27(2): 44-50
[39]阎勇,朱光喜.具有重尾特性自相似网络通信量的预测.华中科技大学学报(自然科学版, 2006, 9: 29-31
[40] Qingtao Wu, Zhiqing Shao. Network Anomaly Detection Using Time Series Analysis. Autonomic and Autonomous Systems and International Conference on Networking and Services, 2005, 10: 42-43
[41] Robin Sommer, Vern Paxson. Enhancing byte-level network intrusion detection signatures with context. In CCS '03: Proceedings of the 10th ACM conference on Computer and communications security, 2003: 262-271
[42]杨家海,吴建平.基于非平稳型流量队列模型的Internet流量测量研究.电子学报, 2004, 32(5): 727-730
[43]王欣,方滨兴. Hurst参数变化在网络流量异常检测中的应用.哈尔滨工业大学学报, 2005, 37(8): 1046-1049
[44] Xiang, Y Lin, Y Lei, W L Huang. Detecting DDOS attack based on network self-similarity. IEEE Proceeding Communications, 2004, 151(3): 292-295
[45]任勋益,王汝传,王海艳.基于自相似检测DDoS攻击的小波分析方法.通信学报, 2006, 27(5): 6-11
[46] J. Beran, R. Sherman, M. S. Taqqu, and W. Willinger. Long-Range Dependence in Variable-Bit-Rate Video Traffic. IEEE Transactions on Communications, 2002, 6: 1566-1579
[47] Mark E. Crovella, Murad S. Taqqu and Azer Bestavros. Heavy-Tailed Probability Distributions in the World Wide Web. In A Practical Guide To Heavy Tails, 1998, 1: 3-26
[48] R. H. Riedi, W. Willinger. Towards an improved understanding of network traffic dynamics. In Self-similar Network Traffic and Performance Evaluation, Wiley, 2000, 20: 507-530.
[49] V. Paxson and S. Floyd. Wide area traffic: The failure of Poisson modeling. IEEE/ACM Trans. Networking, 1995, 3(3): 226-244
[50] A. K. Erlang. Solution of some problems in the theory of probabilities of signicance in automatic telephone exchanges. The life and works of A. K. Erlang, Eds: E.Brockmeyer, H. L. Halstrom, A. Jensen, 1948: 138-155
[51] S. Rajaram, T. Graepel, and R. Herbrich. Poisson networks: A model for structured point processes. In AI and Statistics, 2005, 10
[52] Mandelbrot B. Long-run linearity locally Gaussian Processes, h-specta and infinite variance. Int. Econom. Rev, 1969, 10(1): 82-113
[53] Hlavacs H, Kotsis G, Steinkeller C. Traffic Source Modeling University of Vienna: Technical Report No. TR-99101, Institute for Appl Comp Science and Inf Systems
[54]张波,商豪.应用随机过程.中国人民大学出版社, 2009
[55]付立政,肖波,侯东.基于独立MMPP业务输入模型的输入/输出排队.小型微型计算机系统, 2001, 1: 33-36
[56]石江涛,王永纲,戴雪龙.自相似网络业务流量的研究与实现.通信学报, 2005(6): 112-117
[57] Gooijer De, Abraham B, Ann Gould, et al. Methods for Determining the Order of an Autoregressive-Moving Average Process. International Statistical Review, 1985(3): 301-329
[58] Wayne A, Woodward H L G. On the relationship between the S Array and the Box-Jenkins Method of ARMA Model identification. Journal of the American statistical Association, 1981(76): 579-587
[59] Karagiannis T, Molle M, Faloutsos M. Long-range Dependence: Ten Years of Internet Traffic Modeling. IEEE Internet Computing. 2004, 8(5): 57-64
[60] Ulanovs P, Peterssons E. Modeling methods of self-similar traffic for network performance evaluation. Scientific Proceedings of Riga Technical University, Telecommunications and Electronics 2002. 86-96
[61] Willinger W, Taqqu M S, Sherman R, et al. Self-similarity through high-variability: statistical analysis of ethernet LAN traffic atthe source level. IEEE/ACM Transactions on Networking, 1997, 5(1): 71-86
[62] Geriner M, Jobmann M, Lipsky L. The importance of power-tail distributions for modeling queuing systems. Operations Research. 1999, 47(2): 313-326
[63] Chen Borsen, Yang Yusuarg, Lee Botekuen, et al. Fuzzy adaptive predictive flow control of ATM network traffic. IEEE Transactions on Fuzzy System. 2003, 11(4):568-581
[64]刘嘉,金志刚,薛飞等.基于FARIMA过程的网络业务预报与应用.电子与信息学报. 2001, 23(4): 403-407
[65] K. Nagarajan and G. T. Zhou. Modeling the Short and Long Memories of VBR Video Streams. Proc. Intl. Workshop on Applications of Heavy Tailed Distributions in Economics, Engineering and Statistics, Washington, DC, 1999, 6
[66] Ilow J. Forecasting network traffic using FARIMA models with heavy tailed innovations. Acoustics, Speech, and Signal Processing. 2000, 3814-3817
[67] Zhigang Jin, Yantai Shu, Jiakun Liu, et al. Non-Gaussian Characteristic and FARIMA(p, d, q) Traffic Models. In Proceedings of the IEEE Canadian Conference on Electrical and Computer Engineering. Toronto, Canada. 2002, 5: 691-696
[68]杨位钦,顾岚.时间序列分析与动态数据建模.北京理工大学出版. 1988
[69] Christian Beck, Ezechiel G. D. Cohen, Harry L. Swinney. From time series to superstatistics. Phys. Rev. 2005, 72: 056133
[70] C. Beck, E. G. D. Cohen. Superstatistics. Physica A, 2003 (322): 267-275
[71] E. G. D. Cohen. Superstatistics. Physica D, 2004 (193): 35–52
[72]王少杰,顾牡.大学物理(第三版).同济大学出版社. 2006. 12
[73] M. Mahoney and P. Chan. An analysis of the 1999 darpa/lincoln laboratory evaluation data for network anomaly detection. In Proceeding of Recent Advances in Intrusion Detection, Lecture Notes in Computer Science. 2003. 2820: 220-237
[74] DARPA 99 Intrusion Detection Data Set Attack Documentation,
[75] http: //www. ll. mit. edu/IST/ideval/docs/1999/attackDB. html
[76]李海芬. Pareto分布的统计分析.华东师范大学, 2004
[77]南新艳.广义Pareto分布.华东师范大学, 2005
[78] Malik H. j. Estimation of the Paremeter of the Pareto Distribution. Metrika, 1970, l5: 126-132
[79] Rasmussen, P. F. Generalized probability weighted moments: Application to the generalized Pareto distribution. Water Resources Research, 2001, 6(1): 1745-1751
[80] Tekin ?ZTEK. Comparison of Parameter Estimation Methods for the Three-Parameter Generalized Pareto Distribution, Turk J Agric, 2005(9): 419-428
[81] Arriod B C. Pareto Distribution. Fairland. Maryland: International Co- operative Publishing House, 1983
[82]茆诗松,王静龙.数理统计.华东师范大学出版社, 1990: 299 -303
[83]封国林,龚志强,董文杰等.基于启发式分割算法的气候突变检测研究.物理学报. 2005, 54(11): 5494-5499
[84]万仕全,封国林,董文杰等.气候代用资料动力学结构的区域与全球特征.物理学报. 2005, 54(11): 5487-5493
[85] R. A. Kemmerer and G. Vigna, Intrusion detection: A brief history and review, Computer, 2002, 35(4): 27-30
[86] Box G E P, Jenkins G M. Time Series Analysis. Forcasting and Control. 1976
[87] Davison, A. C., Modeling excesses over high thresholds, with an application. In: Statistical Extremes and Applications, ed. J. Tiago de Oliveira, Dordrecht: D. Reidel. 1984: 461–482
[88] Tsay R S, Tiao G C. Consistent estimates of autoregressive parameters and extended sample autocorrelation function for stationary and non-stationary ARMA models. 1984, 79: 84-96
[89]杨位钦,顾岚.时间序列分析与动态数据建模.北京理工大学出版. 1988
[90] Box G E, Jenkins G M. Time Series Analysis: Forecasting and Control. San Francisco: Holden-Day, 1976
[91] Di He Leung, H. Network Intrusion Detection Using CFAR Abrupt-Change Detectors, Instrumentation and Measurement, IEEE Transactions on, Volume: 2008, 57: 490-497
[92] Ye. N. and Chen, Q. An Anomaly Detection Technique Based on A ChiSquare Statistic for Detecting Intrusion Into Information System, Quality and Reliability Engineering International, 2001, 17. 105-112
[93] Ye, N., Chen, Q. and Borror, C. M. EWMA Forecast of Normal System Activity for Computer Intrusion Detection. IEEE Transaction on Reliability, 2004, 53(4), 557-566
[94] Yang Yue, Hu Hanping, Xiong Wei, et al. A Novel Network Traffic Model Based On Superstatistics Theory. The 2nd IEEE International Workshop of IntelligentSystem and Applications. 2010: 219-221
[95] N. H. Packard, J. P. Crutchfield, J. D. Farmer, et al. Geometry from a Time Series. Phys. Rev. Lett. 1980, (45): 712-716
[96]吴晓江,帅典勋,刘东林等.网络行为建模环境的实现及网络混沌性状分析.通信学报. 2002, 23(9): 29-35
[97] Yang Yue, Hu Hanping, Xiong Wei, Ding Fan. Network Traffic Anomaly Detection Method Based on a Feature of Catastrophe Theory, Chinese Physics Letters, 2010 27(6): 060501
[98] Hanping Hu, Xiaogang Wu, Zuxi Wang. Synchronizing chaotic map from two-valued symbolic sequences. Chaos, Solitons & Fractals, 2005, 24, 1059-1064
[99] Veres A, Boda M. The chaotic nature of TCP congestion control. in: Joseph D. Proc IEEE INFOCOM2000. IEEE Computer Society. Canada. 2000: 1715-1723
[100] Takens F. Rand D., On the numerical determination of the dimension of an attractor. In: Dynamical Systems and Turbulence., Lecture Notes in Mathematics, Springer-Verlag. 1981, 898: 366~381
[101] CaoL. Y. Practical method for determining the minimum embedding dimension of a scalar time series. Physica D, 1997, 110(5): 43~50
[102]吕金虎,陆君安,陈士华.混沌时间序列分析及其应用. (第一版).武汉:武汉大学出版社, 2002
[103] Grassberger P, Procaccia I. Measuring the strangeness of strange attractors. Physica D, 1983, 9: 189~208
[104] Abarbanel H. D. I., Brown R., Sidorowich J. J. et al. The analysis of observed data in physical systems. Reviews of Modern Physics, 1993, 65(5): 1331~1392
[105] Fraser A. M. Information and entroy in strange attractors. IEEE Trans. Inf. Theory, 1989, 35: 245-262
[106] Fraser A. M., Swinney H. Independent coordinates for strange attractors from mutual information. Physical Review A, 1986, 33(2): 1134-1140
[107] Gilmore. R.. Catastrophe theory for science and engineers. New York, John Wiley & Sons, 1981
[108] Kennel M, Brown R, Abarbanel H. Determining embedding dimension forphase-space reconstruction using a geometrical construction. Physical Review A, 1992, 45(6): 3403~3411
[109] Saunders P. T., An Introduction to Catastrophe Theory. Cambridge University Press, Cambridge, 1980
[110]桑博德.突变理论入门(第二版).上海:上海科学技术文献出版社, 1983
[111]勒内.托姆,周仲良.突变论:思想和应用(第一版).上海.上海译文出版社, 1989: 256～260
[112]凌复华.突变理论及其应用(第一版).上海:上海交通大学出版社, 1987. 112-116
[113]张亚平,张起森.尖点突变理论在交通流预测中的应用.系统工程学报, 2000, 15(3): 272～276
[114] Cobb, L. Parameter estimation for the cusp catastrophe model. Behavioral Science, 1981, 26: 75-78
[115]都兴富.突变理论在经济领域的应用(第一版).成都:电子科技大学出版社, 1994