实时异常检测是目前网络安全的研究热点,基于大规模网络流量的统计特征,提出了一个基于统计的流量异常检测模型。根据网络流量的测度集,描绘了一个正常网络流量的基线。参照该正常流量基线,使用假设检验理论进行异常检测。采用一个基于滑动窗口的流量更新策略和感应阈控制模型,使异常检测能够更加高效。 Real-time anomaly detection is a hot research topic in network security. Based on the statistical characteristics of large-scale network traffic, an anomaly detection model based on statistics is proposed. Based on the measure of network traffic, a baseline of normal network traffic is depicted. With reference to this normal flow baseline, anomaly detection is performed using hypothesis testing theory. Using a sliding window-based traffic update strategy and sensing threshold control model, anomaly detection can be more efficient.