流量异常检测,作为一种网络入侵检测的方法,存在着如何建立正常行为模型的难题。提出了扩大属性检测的范围,采用异常值计算,并由此建立条件规则库作为正常模型的想法,在此基础上用不精确推理方法进行流量异常检测,最后给出了综合系统的设计。 Traffic anomaly detection, as a method of network intrusion detection, there is a problem of how to set up a normal behavior model. This paper proposes the idea of ​​expanding the scope of attribute detection, using outlier calculation and establishing the rule base as a normal model. Based on this, an inaccurate reasoning method is used to detect the flow anomalies. Finally, the design of the integrated system is given.