摘要
在NetFlow的基础上定义了2种新的网络流:主机层网络流和区域层网络流,并提出了相应的流量特征刻画方法.该定义从主机层和网络层对网络流量进行抽象,实现了底层网络流信息的合并,在不损失关键流量特征的前提下,可大大缩减网络流记录的数量.采用指数加权移动平均控制图模型对所提取的网络流特征进行预测和估计,并结合网络蠕虫的传播特征给出了一种网络蠕虫的早期检测方法.实验结果表明,所提检测方法可以准确地检测到蠕虫在局域网内的早期传播,进而为控制蠕虫传播赢得了宝贵的时间.
Based on NetFlow, the definition of two net-flows, Host-Net-Flow and Region-Net-Flow, as well as a depictive method for corresponding network traffic characteristics are proposed. The netflows are abstracted from the host level and network level by the definition. The incorporation of netflow information in bottom level is implemented, and the number of netflow records can significantly be reduced without losing key network traffic characteristics. EWMA （exponential weighted moving average） control chart models are employed to forecast and estimate the distilled network traffic features, then an early net-worm propagation detection method is presented considering the features of network worm propagation. The experimental results show that the early worm propagation in local networks can be detected both quickly and accurately by the proposed method, thereby worm propagation can be controlled as soon as possible.
出处
《西安交通大学学报》
EI
CAS
CSCD
北大核心
2007年第4期393-397,共5页
Journal of Xi'an Jiaotong University
基金
国家高技术研究发展计划资助项目(2001AA142060)
国家自然科学基金资助项目(60243001)
关键词
网络安全
网络流
指数加权移动平均
网络蠕虫
network security
net flow
exponential weighted moving average
net-worm
