Research of Network Traffic Anomaly Detection Model Based on Multilevel Autoregression

Real-time anomaly detection of network traffic is an important research field of network security. Network behavior can be characterized by the distribution of characteristic parameters, in which respect there are great differences between normal and abnormal network behaviors. Distribution characteristics of information entropy can describe network behavior, and can transform the anomaly detection problem of network traffic into a classification problem based on traffic characteristic entropy. In this paper, an anomaly detection model of network traffic of multilevel autoregressive based on information entropy is presented. Firstly, the information entropy is zero-averaged, then the anomaly traffic detection model is established by third-order linear auto regression, and the residual ratio of information entropy is proposed as the measure value of anomaly detection. Finally, the network traffic is tested by model of multilevel autoregressive anomaly detection in the simulation network environment. Experiments show that the model of multilevel autoregressive anomaly detection can detect more than 95% of network anomaly traffic.