本文已被：浏览 1759次 下载 2582次
Received:August 30, 2015 Revised:October 14, 2015
Received:August 30, 2015 Revised:October 14, 2015
中文摘要: 互联网控制报文协议(Internet Control Message Protocol,ICMP)实时地反映着网络的状态,当网络故障或受到攻击时,ICMP报文在整个流量中出现的概率,以及ICMP流量中不同类型的报文比例等特征都会发生变化.本文利用ICMP流量小的特点,并结合SDN架构中控制面可对ICMP流量进行集中观察的优势,采用SVM分类的方法,提出一种轻量级的异常检测机制以改善异常检测的实时性和准确性——AD-ICMP-SDN(Anomaly Detection Method based on ICMP Traffic for SDN).实验结果证明,AD-ICMP-SDN在检测准确率和误报率等指标上展现了较好的性能.
Abstract:ICMP(Internet Control Message Protocol) provides a good way to observe the status of network in real time. When the network is in fault or is attacked, the percent of ICMP traffic and the percent of packet type in ICMP characteristics will change. Since the control plane in Software-Defined Networking(SDN) can observe ICMP traffic, and the value of ICMP traffic is also small, this paper proposes a lightweight anomaly detection system based on SVM classification method to improve the accuracy and real-time performance of anomaly detection system. We name it as AD-ICMP-SDN(Anomaly Detection Method based on ICMP Traffic for SDN). The experiment results have shown that AD-ICMP-SDN can effectively improve the accuracy rate and false rate.
keywords: SDN anomaly detection support vector machine ICMP
文章编号： 中图分类号： 文献标志码：
基金项目:浙江省教育厅科研项目(Y201534903);广东省自然科学基金(2014A030310349,2014A030313637);2014年大学生创新训练项目
引用文本：
史振华,刘外喜,杨家烨.SDN架构下基于ICMP流量的网络异常检测方法.计算机系统应用,2016,25(4):135-142
SHI Zhen-Hua,LIU Wai-Xi,Yang Jia-Ye.Anomaly Detection Method Based on ICMP Traffic for SDN.COMPUTER SYSTEMS APPLICATIONS,2016,25(4):135-142
史振华,刘外喜,杨家烨.SDN架构下基于ICMP流量的网络异常检测方法.计算机系统应用,2016,25(4):135-142
SHI Zhen-Hua,LIU Wai-Xi,Yang Jia-Ye.Anomaly Detection Method Based on ICMP Traffic for SDN.COMPUTER SYSTEMS APPLICATIONS,2016,25(4):135-142
