GraphPrints：一种网络异常检测的图分析方法
GraphPrints: Towards a Graph Analytic Method for Network Anomaly Detection
摘要：
本文介绍了一种新的图分析方法，用于检测网络流数据中的异常称为GraphPrints。基于基础网络挖掘技术，我们的方法将流量的时间片表示为一个图，然后计算小图-描述局部拓扑结构的小诱导子图。通过对graphlet计数的序列执行离群值检测，识别流量的异常间隔，并且此外，挑选出经历异常行为的个体IP。GraphPrints的初始测试是在具有植入异常的真实网络数据上执行的。评价显示假阳性率在时间间隔水平为2.84%，在IP水平为0.05%，两个水平的真阳性率均为100%。
英文摘要：
This paper introduces a novel graph-analytic approach for detecting anomalies in network flow data called GraphPrints. Building on foundational network-mining techniques, our method represents time slices of traffic as a graph, then counts graphlets -- small induced subgraphs that describe local topology. By performing outlier detection on the sequence of graphlet counts, anomalous intervals of traffic are identified, and furthermore, individual IPs experiencing abnormal behavior are singled-out. Initial testing of GraphPrints is performed on real network data with an implanted anomaly. Evaluation shows false positive rates bounded by 2.84% at the time-interval level, and 0.05% at the IP-level with 100% true positive rates at both.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
