Research And Application Of Burst Abnormality Detection Based On Network Traffic

Failure management of network is an essential part of network management. It has relationship with usability and reliability of network that failure management is whether efficient or not and function is whether strong or not. Failure-detection is precondition of failure-management. And the method which detects abnormity by detecting network traffic is base of failure-detection. The reason is we can get failure information by abnormity.At present, failure detection of network is based on SNMP which is a method by using technique of Client/Server. This method gets information of failure by two ways which is polling agents and receiving trap. But this method depends on network, so it can result in losing control when some nodes have failure. In other words, the detetion method by polling has delay when detecting burst of abnormity.So this thesis gives definition to abnormity that burst and drop of traffic and congestion which result from failure of network. Aiming at this failure, the thesis puts out a new method to detect. The method detects nodes and links in the same time and plots grade by detecting results. It can apply gist for self-recover protocol. And the method also forcasts the network traffic in order to get information of state of network.The main contents of this thesis include:(1)Auto-adaptive threshold residual ratio detection method is presented. It is on the research of advantages and disadvantages of time sequence of detecting algorithm and residual ratio detection method separately. This thesis uses auto-adaptive threshold instead of fixed threshold to get detecting sequence. It can be aware failure of network passively. This method has advantage in precision and speed;(2)A traffic abnormal detection method based on congregate function is proposed. It is based on the alterative histogram technique and aggregate-result-query. It can detect failure of network actively. This method detects abnormity by compressed putting data and comparing two same length windows which are near. The detecting precision and speed of the algorithm are proved;(3)The thesis presents forecasting algorithm based on kalman filter. This algorithm combines kalman filter theory with actual network and gives a modeling. The aim of this thesis is that the network can whether work or not after adjusting potential energy. In the same time, we can get the whole traffic situation of network. The thesis does experiment to validate the validity and advance in performance of this algorithm. And the results tell us that the algorithm can forecast the traffic with high precision. At the same time, it can validate the correctness of network after adjusting potential energy; (4)A new network failure detecting system is set up which include both link-detection and node-detection. It also forecast the traffic of all network. It can protect network effectively. Based on the detecting network-traffic in time, this system can find and confirm failure. It combines with method of statistics off line and gives parameter of link-estate and map of relationship. These are useful and meaningful for detecting in future.