一种基于可拓距的特征变换方法及其在网络入侵检测中的应用

发布时间：2018-01-27 00:59

本文关键词： 网络入侵检测特征变换可拓学簇外中心距簇内可拓距　出处：《河南师范大学学报(自然科学版)》2017年05期 　论文类型：期刊论文

【摘要】：作为识别攻击或异常行为以保护网络安全的重要步骤之一,网络入侵检测常常与数据挖掘或机器学习技术结合应用.如今,随着网络数据的爆炸性增长,传统的入侵检测技术面临着海量数据检测处理的问题,现有入侵检测系统往往难以同时满足实时性和有效性的需求.本文尝试将可拓学中的可拓距概念引入网络入侵检测研究中,提出了一种基于可拓距的特征变换方法,将数据点的原特征映射为簇外中心距和簇内可拓距这两大部分,根据原始数据多维特征生成新的特征,以达到特征降维的目的,旨在同时满足网络入侵检测系统的实时性和有效性的需求.本文使用KDD CUP 99作为仿真数据集测试所提出的基于可拓距的方法在网络入侵检测特征变换中的应用效果.实验结果表明,较之传统的KNN算法,基于可拓距的方法明显地减少了检测时间,而同时其检测率的下降可以控制在1%之内,具有较好的时效性优势.
[Abstract]:As an important step to identify attacks or abnormal behaviors to protect network security, network intrusion detection is often combined with data mining or machine learning technology. Nowadays, with the explosive growth of network data. The traditional intrusion detection technology is faced with the problem of massive data detection and processing. The existing intrusion detection systems are often difficult to meet the requirements of real-time and effectiveness. This paper attempts to introduce the extension distance concept into the network intrusion detection research. A method of feature transformation based on extension distance is proposed. The original features of data points are mapped to two parts: outer center distance of cluster and extension distance within cluster, and new features are generated according to multidimensional features of original data. To achieve the goal of feature dimension reduction. The purpose of this paper is to meet the requirements of real time and efficiency of network intrusion detection system. This paper uses KDD CUP. 99, a method based on extension proposed as a simulation data set test, is applied to the feature transformation of network intrusion detection. The experimental results show that. Compared with the traditional KNN algorithm, the extension distance based method can significantly reduce the detection time, while the detection rate can be controlled within 1%, which has a good timeliness advantage.
【作者单位】：湖北工业大学计算机学院;
【基金】：国家自然科学基金(61602162;61440024;61502155) 湖北工业大学博士科研启动基金计划项目(BSQD12029)
【分类号】：TP393.08
【正文快照】： 随着网络技术不断发展,互联网在军事、医疗、金融等领域的应用越来越广泛,网络安全愈来愈得到重视.为了能及时地发现攻击行为,从而将其所产生的损失降到最低,人们对网络入侵检测系统的实效性提出了更高的要求.传统的检测方法虽然在检测率等方面有着较好的表现,但是需要耗费大

【相似文献】