Research On Distributed Traffic Anomaly Detection Based On Statistical Analysis

In the past years, with the rapid development of science and technology, computer communication network was growing to a larger scale and more complex structure. In the same time, anomalies in the backbone computer communication network was getting complicated. In order to improve the network anomaly defending ability, we need to analyze the backbone computer network anomaly when it happens. Also, we could take some precaution methods in advance, using the existing anomaly features, to reduce the harm to the network.This thesis based on the analysis of features of the backbone network anomaly, utilized the feature information of distributed network anomaly, built analyzing model by the methodology of statistics, analyzed the traffic anomaly in backbone communication network, detected the distributed network traffic anomaly. The results from the research are following:1. Proposed a method to analyze the distributed network traffic anomaly, using the sequential probability ratio test.By using the sequential probability ratio test, noted that the distributed network anomaly from different links had some relevance on the feature, we analyze the statistics feature of the multivariate, build the analysis model, and detect the distributed network anomaly by the relevance of the changing signal. Compared with the traditional sequential probability ratio test method, we could effective avoid the poor real-time feature in traditional ways, and therefore improve the detecting time and accuracy.2. Proposed a method to analyze the network traffic anomaly, using the extensive entropy.Noted that the concept of entropy in thermodynamics, it compared with characteristic parameters of the network traffic, find out there is one-to-one relationship, the introduction of the concept of information entropy to finish using the entropy to analyze the network traffic characteristic parameters. Finally, combining with the problems of traditional information entropy in the network traffic anomaly detection, we use the entropy to carry out extensive research and analysis of network traffic anomaly detection, at the same time using real data of network to carry on the simulation and analysis, the final analysis conclusions.