摘要
提出了一种新颖的综合考虑多维观测序列的实时检测模型——KCFM。通过抽取新型分散式P2Pbotnet的多个特征构成多维观测序列,使用离散Kalman滤波算法发现流量异常变化,将Multi-chart CUSUM作为差异放大器提高检测精度。实验表明,基于多维观测序列的KCFM模型能够有效地检测新型P2Pbotnet。
We propose a novel real-time detecting model-KCFM（Kalman filter and multi-chart CUSUM fused model） based on multi-observed sequence,which consists of several extracted the new P2P botnet characteristic properties.The KCFM finds the abnormal traffic by the discrete Kalman filter,and improves the detection precision by using the Multi-chart CUSUM as an amplifier.The experiments show that our approach can detect new decentralized botnet with a relatively high precision.
出处
《武汉大学学报（信息科学版）》
EI
CSCD
北大核心
2010年第5期520-523,共4页
Geomatics and Information Science of Wuhan University
基金
国家自然科学基金重大研究计划资助项目(90204014)
国家自然科学基金资助项目(60703023)
吉林省科技发展计划资助项目(20090110)
