基於時間序列模型之網路流量預測與異常偵測

儘管多元化的網路應用為民眾與企業帶來便捷的服務，並創造了許多商機，但也引來有心人士利用網路通訊協定漏洞竊取商業機密、盜用個人帳密，或是駭客植入木馬病毒等惡意程式癱瘓網站，使得網路的服務品質下降，安全性受到質疑，甚至影響網站營運造成巨大損失。因此，如何降低網站營運風險做好危機管理已成為網管人員的首要任務。為了要兼顧網路服務品質與安全，建立有效的資訊安全防護機制，網管人員有必要針對網路行為進行分析。本研究蒐集銘傳大學資訊學院2012年5月18日至2012年6月22日共計36天網路正常流量Netflow封包數據，首先利用重標極差分析法計算Hurst指數，驗證網路流量的長記憶性，估計分數差分階數，再利用R軟體配適週期性自迴歸分數整合移動平均模型，並建立95%預測區間，做為網管人員監控未來網路流量變化之管制界限。

關鍵字

資訊安全；網路流量；長記憶性；重標極差分析法；週期性自迴歸分數整合移動平均模型

並列摘要

The varieties of network applications provide convenient services to users and create many commerce markets. However, lots of network hacking activities have been attacking the services and cause extensive damage and inconvenience. It is very important for network managers to protect the services and improve the QoS and the security. To create an efficient network abnormal detecting system, we need to collect and analyze the network activities. In this paper we collect network traffic data from school of information at MCU. The dataset are stored in Netflow format and dated from 2012/05/15 to 2012/06/22. The rescaled range (R/S) analysis method is used to compute the Hurst index to verify the property of long memory and estimate the fractional difference order. The R statistical package is then adopted to build the seasonal autoregressive fractional integrated moving average model to establish 95% prediction interval. The results of this study III are able to provide the control limit for monitoring network traffic.

並列關鍵字

information security ； network traffic ； long memory ； rescaled range analysis ； seasonal autoregressive fractional integrated moving average model

參考文獻

1. 江其杰，「殭屍網路(Botnets)：最危險的安全威脅」，Communication of the CCISA，(2009)，第15輯，第4期，第122-128頁。

4. 蔡垂君，「緩長記憶模式應用於新加坡摩根台灣股價指數期貨之研究」，中華管理學報，(2002)，第三卷，第二期，第75-88頁。

1. Ayesha Binte Ashfaq, Muhammad Qasim Ali and Syed Ali Khayam (2011), ‘Accuracy improving guidelines for network anomaly detection systems,’ J Comput Virol, 7, 63-81.

2. Benoit Mandelbrot and James R. Wallis (1969), ‘Global dependence in geophysical records,’ Water Resources Research, 5, 321-340.

5. C. W. J. Granger (1980), ‘Long Memory Relationships and the Aggregation of Dynamic Models,’ Journal of Econometrics, 14, 227-238.

國際替代計量

基於時間序列模型之網路流量預測與異常偵測

全文下載

主題瀏覽