作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2010, Vol. 36 ›› Issue (21): 137-139. doi: 10.3969/j.issn.1000-3428.2010.21.049

• 安全技术 • 上一篇    下一篇

基于特征压缩与分支剪裁的网络异常检测算法

贾伟峰1,2,王 勇1,张凤荔1,童 彬1   

  1. (1. 电子科技大学计算机科学与工程学院,成都 610054;2. 安阳师范学院计算中心,河南 安阳 455000)
  • 出版日期:2010-11-05 发布日期:2010-11-03
  • 作者简介:贾伟峰(1982-),男,讲师、硕士,主研方向:机器学习,网络入侵检测;王 勇,副教授、博士;张凤荔,教授、博士生导师;童 彬,博士研究生
  • 基金资助:
    电子信息产业发展基金资助项目“大唐入侵防御系统”(信部运[2007]329);国家“242”信息安全计划基金资助项目“网络安全态势感知与趋势分析系统”(2006C27)

Network Anomaly Detection Algorithm Based on Feature Compression and Branch Clipping

JIA Wei-feng1,2, WANG Yong1, ZHANG Feng-li1, TONG Bin1   

  1. (1. School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu 610054, China; 2. Computing Center, Anyang Normal University, Anyang 455000, China)
  • Online:2010-11-05 Published:2010-11-03

摘要: 提出一种改进的直推式网络异常检测算法,利用K-L变换降低计算欧氏距离特征向量的维数,采用分支限界树剪裁减少欧氏距离的计算次数。基于KDD CUP99数据集的实验验证了改进算法能提高网络异常检测的实时性,通过与基于单类支持向量机的异常检测算法的性能对比结果表明,改进算法在保证一定误报率的情况下具有较高的检测率。

关键词: 网络安全, 异常检测, K-L变换, 分支限界树

Abstract: This paper presents an improved transduction network anomaly detection algorithm, it applies K-L transform for dimension reduction to high-dimensional data which is used for Euclidean distance calculation, and adopts branch and bound tree for reducing times of Euclidean distance calculation. Experiment based on KDD CUP99 dataset demonstrates improved algorithm can improve real-time performance of network anomaly detection. In comparison with anomaly detection algorithm based on OC-SVM, improved algorithm can obtain a better detection rate while keeping a proper false positive rate.

Key words: network security, anomaly detection, Karhunen-Loeve(K-L) transform, branch bound tree

中图分类号: