基于时间对抗的网络报警深度信息融合方法

发布时间：2018-02-27 01:17

本文关键词： 异构数据流网络报警深度信息融合时间对抗衰减因子　出处：《计算机应用》2016年02期 　论文类型：期刊论文

【摘要】：针对目前网络报警信息融合方法仅以单时间点为处理单元,无法适应网络攻击逐渐呈现出的隐蔽性强、持续时间长等特点,提出一种基于时间对抗的网络报警深度信息融合方法。面对多源异构报警数据流,首先采集并保存当前一个较长时间窗口内的报警信息,然后利用基于滑动窗口的流聚类算法对报警信息进行聚类,最后引入窗口衰减因子对聚类后的报警进行深度融合。真实数据的实验结果显示,与基本DS证据理论(Basic-DS)和指数加权DS证据理论(EWDS)融合方法方法相比,该方法有较高的检测率和较低的误检率,但因为采用了更长的时间窗口,精简率上略低;实际测试与性能分析也表明,该算法的时延较小,能更加有效地检测网络攻击,且能完成实时处理。
[Abstract]:In view of the fact that the current network alarm information fusion method only takes the single time point as the processing unit, it can not adapt to the characteristics of the network attack, such as strong concealment, long duration and so on. In this paper, a method of network alarm depth information fusion based on time countermeasure is proposed. In the face of multi-source and heterogeneous alarm data flow, the alarm information in the current long window is first collected and saved. Then the flow clustering algorithm based on sliding window is used to cluster the alarm information. Finally, the window attenuation factor is introduced for the deep fusion of the alarm after clustering. The experimental results of the real data show that, Compared with Basic-DSs (basic DS evidence Theory) and EWDS (exponential weighted DS evidence Theory) fusion method, this method has higher detection rate and lower false detection rate, but the reduction rate is slightly lower because of the longer time window. The actual test and performance analysis also show that the proposed algorithm can detect network attacks more effectively and can complete real-time processing because of its small delay.
【作者单位】：信息工程大学;
【基金】：国家自然科学基金资助项目(61309013)~~
【分类号】：TP393.08

【参考文献】