基于SDN的网络流量异常检测技术

Anomaly Detection Technology of Network Traffic in SDN

摘要: 软件定义网络(Software-Defined Networking, SDN)作为一种新型的网络架构，已经成功地被商业化开发。但由于信息化社会的网络流量越来越大，种类越来越多，对于网络流量的异常检测日趋重要。为了实现在SDN网络环境下对流量进行异常检测，本文提出了一种基于支持向量回归(Support Vec-tor Regression, SVR)和自回归积分滑动平均模型(Auto-Regressive Integrated Moving Average, ARIMA)的算法。该算法充分发挥SDN网络的特性，周期性的获取网络流量，并利用ARIMA模型对流量进行预测，之后通过SVR模型将预测结果进行校正。试验结果表明，相较于ARIMA模型，ARIMA-SVR模型拥有较高的准确率和检测率；相较于支持向量机模型，ARIMA-SVR模型能够快速地检测出未知类型的异常流量。

Abstract: Software-Defined Networking (SDN) is a novel network architecture that has been successfully developed commercially. However, due to the increasing number and variety of network flows in the information society, abnormal detection of network traffic is becoming important. To realize anomaly detection of traffic in SDN network environment, this paper presents an algorithm based on Support Vector Regression (SVR) and Auto-Regressive Integrated Moving Average (ARIMA). The algorithm makes full use of the characteristics of SDN network, obtains the running state of the network periodically, and uses the ARIMA model to predict, then corrects the prediction results through the SVR model. The experimental results show that ARIMA-SVR model has higher accuracy and detection rate than ARIMA model; and compared with Support Vector Machine (SVM) model, ARIMA-SVR model can detect unknown types of abnormal traffic quickly.