CN104618175A - Network abnormity detection method - Google Patents

Abstract

The invention provides a network abnormity detection method. The method comprises the following steps: 1, determining attribute of clustered MIB (Management Information Base) data according to a to-be-detected network to generate an attribute vector X; 2, sampling the MIB data in a predetermined time; 3, executing clustering analysis treatment on the acquired MIB data; IV, executing outlier detection on a clustering analysis treatment result, wherein the cluster of which the number of members in the clustering analysis treatment result is smaller than a specified threshold value is judged to be an isolated event in the step IV, and occurrence of network abnormity in the time corresponding to the isolated event is judged.

Description

Network anomaly detection method

Technical field

The present invention relates to network communication field, more particularly, the present invention relates to a kind of network anomaly detection method based on cluster and Outlier Detection, wherein utilize the management information bank that router produces, find Network Abnormal point, network failure discovery and intrusion detection etc. can be widely used in.。

Background technology

1980, James P.Anderson classified to Cyberthreat, illustrated the concept of Network anomaly detection for the first time.1984 to 1985, the people such as the Denning of George London University have developed first system for real-time intrusion detection model IDES (Intrusion Detection Expert System), this is the system of first applied statistics and rule-based two kinds of technology, is also the most influential system in intrusion detection.Nineteen ninety, the MIDAS (Multics Intrusion Detection and Alerting Syetem) of development was a real-time abnormality detection system being supplied to national security computer center network host, though it mainly adopts P-BEST development, wherein also utilize the thought of the abnormality detection of Corpus--based Method.

The method mainly Statistics-Based Method of current abnormality detection, wherein mainly comprises following four kinds: 1) threshold detection technique.Such as, the number of times of password mistake is at short notice detected.2) average and standard deviation modelling technique.By average and the standard deviation of calculating parameter, setting confidential interval, shows there is exception when measured value exceedes the scope of confidential interval.3) multivariate model is set up.Its detection notes abnormalities based on carrying out correlation analysis to two or more parameter.4) Markov model.Each dissimilar as a state variable using audit event, uses a state-transition matrix to describe state variation, and the state matrix transfer that probability is less may be abnormal generation a little.5) time series models.Consider that the order of a series of observation generation, the time of advent and value note abnormalities.

But for said method, wherein the model of first method is comparatively simple, more abnormal behaviour type cannot be detected; For second method, because confidential interval needs artificially to be arranged by experience, therefore need the failure of more number of times and experience to generate believable confidential interval; In 3rd, method model is complicated, and result can tool has a greater change along with parameter is different; Send out method for 4th kind and be applicable to the situation that variable is continuous parameter, obtain situation cannot obtain effective result for being sampled as centrifugal pump; The result of Lung biopsy depends on the size of time window setting.

Summary of the invention

Technical problem to be solved by this invention is for there is above-mentioned defect in prior art, provides a kind of and MIB data analysis is introduced in cluster analysis and Outlier Detection thus can find the network anomaly detection method of Network Abnormal quickly.This network anomaly detection method simplifies model to a certain extent and can find Network Abnormal fast.

In order to realize above-mentioned technical purpose, according to the present invention, providing a kind of network anomaly detection method, comprising: first step, by by the attribute of the MIB data of cluster, generating attribute vector X for determining according to network to be detected; Second step, for sampling to the MIB data in the scheduled time; Third step, for performing cluster analysis process to the MIB data collected; 4th step, carries out Outlier Detection for performing cluster analysis result.

Preferably, in the 4th step, the cluster that number of members in cluster analysis result is less than assign thresholds is judged as isolated cases, and judges to there occurs Network Abnormal in the time corresponding to isolated cases.

Preferably, described MIB data are MIB data that router produces.

Preferably, described assign thresholds is 3-10.

Preferably, described assign thresholds is 5.

Preferably, K-MEANS algorithm is adopted to perform cluster analysis process to the MIB data collected in third step.

Preferably, perform cluster analysis process to the MIB data collected in third step to comprise the steps:

First sub-step: the cluster centre X of random setting n cluster and each cluster _i(i=1,2 ..., n);

Second sub-step: the normal form distance of attribute vector value to each cluster centre calculating each time point, and attribute vector is ranged the minimum cluster of distance cluster centre, obtain the cluster belonging to each time point.

3rd sub-step: recalculate each cluster centre and calculate predetermined instant attribute variable X relative to change $p\left(X\right)=\frac{|X-\stackrel{\‾}{X}|}{\stackrel{\‾}{X}}$

4th sub-step: judge whether p (X) is greater than assign thresholds;

If rate of change p (X) is greater than assign thresholds, then again attribute variable X is classified, return the second sub-step.

Preferably, each component of attribute vector is each attribute variable in MIB.

Cluster analysis and Outlier Detection theory are introduced Network anomaly detection problem by the present invention, have played the superiority of cluster analysis in detection system is regular, have solved the problem of Network Abnormal in the time period of detection.And, the present invention is directed to the management information bank (MIB) that router produces, model can be easily passed and calculate, try to achieve possible abnormity point, saved the time, improve detection efficiency.Application surface of the present invention is comparatively wide, can be applied in network invasion monitoring, network failure discovery equals Network Abnormal related aspect.

Accompanying drawing explanation

By reference to the accompanying drawings, and by reference to detailed description below, will more easily there is more complete understanding to the present invention and more easily understand its adjoint advantage and feature, wherein:

Fig. 1 schematically shows the network anomaly detection method according to the preferred embodiment of the invention based on cluster and Outlier Detection.

Fig. 2 schematically shows according to the preferred embodiment of the invention based on the cluster analysis process of the network anomaly detection method of cluster and Outlier Detection.

Fig. 3 schematically shows the three-dimensional result that the intrusion detection based on ant group algorithm realizes.

It should be noted that, accompanying drawing is for illustration of the present invention, and unrestricted the present invention.Note, represent that the accompanying drawing of structure may not be draw in proportion.Further, in accompanying drawing, identical or similar element indicates identical or similar label.

Embodiment

In order to make content of the present invention clearly with understandable, below in conjunction with specific embodiments and the drawings, content of the present invention is described in detail.

Fig. 1 schematically shows the network anomaly detection method according to the preferred embodiment of the invention based on cluster and Outlier Detection.

Specifically, as described in Figure 1, comprise based on the network anomaly detection method of cluster and Outlier Detection according to the preferred embodiment of the invention:

First step S1, by by the attribute of the MIB of cluster (Management Information Base, management information bank) data, generates attribute vector X for determining according to network to be detected; Wherein, such as, each component of attribute vector is each attribute variable in MIB.

Second step S2, for sampling to the MIB data in the scheduled time; Particularly, such as described MIB data are MIB data that router produces.

Third step S3, for performing cluster analysis process to the MIB data collected;

4th step S4, Outlier Detection is carried out for performing cluster analysis result, wherein number of members in cluster analysis result is less than assign thresholds (such as, described assign thresholds is 3-10, such as described assign thresholds is 5) cluster be judged as isolated cases, and judge to there occurs Network Abnormal in the time corresponding to isolated cases.

In a particular embodiment, in third step S3, cluster analysis process is performed to the MIB data collected and can adopt K-MEANS algorithm, such as, can comprise the steps:

First sub-step S10: the cluster centre X of random setting n cluster and each cluster _i(i=1,2 ..., n);

Second sub-step S20: the normal form distance of attribute vector value to each cluster centre calculating each time point, and attribute vector is ranged the minimum cluster of distance cluster centre, obtain the cluster belonging to each time point.

3rd sub-step S30: recalculate each cluster centre and calculate predetermined instant attribute variable X relative to change $p\left(X\right)=\frac{|X-\stackrel{\‾}{X}|}{\stackrel{\‾}{X}}$

4th sub-step S40: judge whether p (X) is greater than assign thresholds;

If rate of change p (X) is greater than assign thresholds, then again attribute variable X is classified, return the second sub-step S20.

When not having rate of change p (X) to be greater than the point of assign thresholds, cluster terminates.

Fig. 3 is the three-dimensional result (3 variablees being used for examining or check are respectively router and enter bag change ifInOctcts, and router goes out bag change ifOutOctcts and router packet loss change ifOutDiscards) realized based on the intrusion detection of ant group algorithm.As can be seen from Figure 3 the variable member that rightmost cluster comprises only has 1, therefore can judge that this cluster is as isolated point, and think that the moment of its correspondence there occurs Network Abnormal.

This method analyzes Network anomaly detection from a new angle, by sampling mib variable, Network anomaly detection problem is introduced in cluster analysis and Outlier Detection technology.Using this method, by reasonably arranging the time window of calculating, cluster analysis just can be utilized possible Network Abnormal point to be detected.

In addition, it should be noted that, unless stated otherwise or point out, otherwise the term " first " in specification, " second ", " the 3rd " etc. describe only for distinguishing each assembly, element, step etc. in specification, instead of for representing logical relation between each assembly, element, step or ordinal relation etc.

Be understandable that, although the present invention with preferred embodiment disclose as above, but above-described embodiment and be not used to limit the present invention.For any those of ordinary skill in the art, do not departing under technical solution of the present invention ambit, the technology contents of above-mentioned announcement all can be utilized to make many possible variations and modification to technical solution of the present invention, or be revised as the Equivalent embodiments of equivalent variations.Therefore, every content not departing from technical solution of the present invention, according to technical spirit of the present invention to any simple modification made for any of the above embodiments, equivalent variations and modification, all still belongs in the scope of technical solution of the present invention protection.

Claims (8)

1. a network anomaly detection method, is characterized in that comprising:

First step, by by the attribute of the MIB data of cluster, generates attribute vector for determining according to network to be detected;

Second step, for sampling to the MIB data in the scheduled time;

Third step, for performing cluster analysis process to the MIB data collected;

4th step, carries out Outlier Detection for performing cluster analysis result.

2. network anomaly detection method according to claim 1, it is characterized in that, in the 4th step, the cluster that number of members in cluster analysis result is less than assign thresholds is judged as isolated cases, and judges to there occurs Network Abnormal in the time corresponding to isolated cases.

3. network anomaly detection method according to claim 1 and 2, is characterized in that, described MIB data are MIB data that router produces.

4. network anomaly detection method according to claim 1 and 2, is characterized in that, described assign thresholds is 3-10.

5. network anomaly detection method according to claim 1 and 2, is characterized in that, described assign thresholds is 5.

6. network anomaly detection method according to claim 1 and 2, is characterized in that, adopts K-MEANS algorithm to perform cluster analysis process to the MIB data collected in third step.

7. network anomaly detection method according to claim 1 and 2, is characterized in that, performs cluster analysis process comprise the steps: in third step to the MIB data collected

First sub-step: the cluster centre X of random setting n cluster and each cluster _i(i=1,2 ..., n);

Second sub-step: the normal form distance of attribute vector value to each cluster centre calculating each time point, and attribute vector is ranged the minimum cluster of distance cluster centre, obtain the cluster belonging to each time point.

3rd sub-step: recalculate each cluster centre and calculate predetermined instant attribute variable X relative to change $p\left(X\right)=\frac{|X-\stackrel{\‾}{X}|}{\stackrel{\‾}{X}}$

4th sub-step: judge whether p (X) is greater than assign thresholds;

If rate of change p (X) is greater than assign thresholds, then again attribute variable X is classified, return the second sub-step.

8. network anomaly detection method according to claim 1 and 2, is characterized in that, each component of attribute vector is each attribute variable in MIB.