Teaching Management and Monitoring Abnormal Network Behaviors Under COVID-19

2. Bursty And High-Frequent Access Detection

The bursty and high-frequent access is the one that can be observed at high-level network monitoring points and appears repeatedly and periodically for a period time (Yang 2020). However, the access is a small probability abnormal event on macro-time scale.

The bursty and high-frequency access detection in the high-speed network traffic environment differs from the traditional network intrusion detection. In bursty and high-frequent access in the high-speed network, the aim is to monitors and discover the potential sudden and high-frequency access which behaves different from the conventional distribution information. In the massive amount of data passing through at high speed, these bursty and high-frequent events can be discovered in time, and these sudden high-frequency events can be correlated with network security events through other related methods, which is convenient for grasping the status of large-scale networks in a real-time manner. The emergency response is reacted for bursty and high-frequent access.

It is unrealistic and impractical to perform local analysis by copying each network data item that arrives at the high-level monitoring point of the high-speed backbone network. The monitoring must be on-the-fly without reservation, which requires the bursty and high-frequent access detection is with low time complexity. This paper introduces a data stream model which is a new data preprocessing method for network application in recent years (Agrawal 2016). The major advantage of data stream model is that it can perform in real-time and one-pass. In one-pass processing, no or less data is required to be retained.