关键词: 网络流量, 异常检测, 模型融合, 流式并行计算, 黑名单

Abstract: Aiming at the low accuracy and difficulties of real-time detection resulting from the limitation of the data scale and the processing capacity of the traditional network traffic anomaly detection methods, a parallel anomaly detection method based on multi-model fusion is proposed. The first step of the method is to train the multiple single models, and then fuse them together. The fused model using distributed architecture can realize streaming parallel calculation of the algorithm and ultimately verify the recognition results so that it can form a blacklist of abnormal network traffic, and accurately detect the real -time network traffic by the blacklist. Experiments conducted on Hadoop platform with KDD CUP99 as data sets show that the proposed method complete the anomaly detection of real-time stream data, but also improve the accuracy and efficiency compared with other typical methods.

Key words: network traffic, anomaly detection, model fusion, streaming parallel calculation, blacklist