一种基于选择性协同学习的网络用户异常行为检测方法

发布时间：2018-03-14 00:31

本文选题：网络用户异常行为检测　切入点：协同学习　出处：《计算机学报》2014年01期 　论文类型：期刊论文

【摘要】：为了快速准确检测网络用户的异常行为,机器学习技术得到了广泛应用.但随着用户规模的扩大及用户行为的复杂化,基于机器学习的传统检测方法面临着大量标记训练样本而导致的巨大开销、实际网络用户异常行为数据非平衡性而导致的检测准确性不足等问题.因此,将选择性集成技术引入到协同学习过程中,提出了一种基于选择性协同学习的网络用户异常行为检测方法,使用基于多数类分布的改进EasyEnsemble方法将非平衡训练样本划分为平衡的样本子集,然后使用基于混合扰动的生成方法构造差异性成员分类器对样本子集进行协同学习,在学习过程中使用选择性集成进行置信度计算与数据更新以减少开销,并基于准确性选择构建集成分类器用于实际检测,使得检测方法在获得非平衡性复杂分布数据的处理能力的同时进一步提高检测准确性.实验结果表明,该方法较传统方法减少了对训练样本中标记数据的需求,同时在准确性评价指标上表现更好,能更快速准确地检测出网络用户的异常行为.
[Abstract]:In order to detect the abnormal behavior of network users quickly and accurately, machine learning technology has been widely used, but with the expansion of user scale and the complexity of user behavior, The traditional detection method based on machine learning is faced with the huge cost caused by a large number of tag training samples, and the detection accuracy is not enough due to the imbalance of abnormal behavior data of actual network users, and so on. The selective integration technique is introduced into the collaborative learning process, and a method for detecting abnormal behavior of network users based on selective collaborative learning is proposed. An improved EasyEnsemble method based on majority class distribution is used to divide the non-equilibrium training samples into a balanced subset of samples, and then a diversity member classifier is constructed based on the mixed disturbance generation method to carry out collaborative learning for the sample subset. In the process of learning, the confidence degree and data update are calculated by selective integration to reduce the overhead, and the integration classifier is constructed based on the accuracy selection for actual detection. The experimental results show that the proposed method can reduce the requirement of marking data in training samples, and improve the accuracy of detection while obtaining the processing ability of unbalanced and complex distributed data, and the experimental results show that the proposed method can reduce the requirement of marking data in training samples. At the same time, it can detect the abnormal behavior of network users more quickly and accurately.
【作者单位】：东南大学计算机科学与工程学院;苏州科技学院电子与信息工程学院;
【基金】：国家“九七三”重点基础研究发展规划课题(2010CB328104) 国家自然科学基金(61070158,61003257,61070161,61070210,61320106007) 国家“八六三”高技术研究发展计划课题(2013AA013503) 高等学校博士点学科专项科研基金(20110092130002) 江苏省自然科学基金(BK20131154) 江苏省网络与信息安全重点实验室(BM2003201) 教育部计算机网络与信息集成重点实验室(东南大学)(93K-9)资助~~
【分类号】：TP393.08

【参考文献】