摘要： 对于校园网等小规模的局域网，通过计算网络流量自相似值的方法无法有效检测网络异常流量。针对该问题，在分析校园网络流量特点的基础上，将网络流量分解成趋势项和随机成分等其他项，使用经验模式分解消除网络流量中的趋势项，使得网络流量序列的自相似值能直接反映随机成分状态。实验结果表明，该方法能提高异常流量检测的准确性。

关键词: 自相似性, 希尔伯特黄变换方法, 经验模式分解, 网络流量, Hurst值

Abstract: For the campus network and other small-scale local area network, the abnormal traffic can not be detected rightly by calculating self-similarity value directly. Based on analyzing the characteristics of the campus network traffic, it decomposes traffic into trend and random components and other items, uses Empirical Mode Decomposition(EMD) to eliminate traffic trend items, and makes the self-similarity value direct response to the state of random items. Experimental results show that this method can improve the accuracy of abnormal traffic detection.

Key words: self-similarity, Hilbert-Huang Transform(HHT) method, Empirical Mode Decomposition(EMD), network traffic, Hurst value

中图分类号: 

• TP393