Abnormal behavior detection and control in high speed networks based on bidirectional flow

A new method is proposed to effectively identify and locate the abnormal network flows based on the abnormal changes of the flow statistics and the incomplete flows. The method bases on the bidirectional flow model, and analyzes the interactive features of different network flows. A hash function in the structure of the connection degree sketch is designed by using the Chinese remainder theorem, so that the source of the abnormal behaviors can be accurately and timely achieved, and the users'information is obtained from the abnormal flows in the high-speed networks. The dynamic and soft isolation method is used to control the abnormal behaviors and hence to slow down the spread speed of the abnormal behaviors. The experimental results in an actual network show that the proposed method is efficient in improving both the detection accuracy and speed for most kinds of abnormal behaviors. At the same time, the source of the abnormal flow is exactly located, and it is helpful to control the spread of the abnormal behaviors.