基于Logistic回归的网络安全态势要素获取研究

发布时间：2018-03-18 00:12

本文选题：态势感知　切入点：态势提取　出处：《福州大学》2014年硕士论文　论文类型：学位论文

【摘要】：本文以网络安全态势感知为应用背景,主要从智能计算技术入手,综合引用粒子群优化算法(Particle Swarm Optimization, PSO)、Logistic回归算法、邻域粗糙集技术以及MapReduce分布式框架,建立智能化网络安全态势要素获取模型及计算方法,以提升网络安全态势要素获取的精确性,更好的辅助网络管理员对网络的安全态势进行详细深入分析,有助于其做出更优的主动防范决策。主要工作包括以下几个部分：(1)提出一种采用改进的粒子群优化算法(Improved Particle Swarm Optimization,IPSO)和逻辑斯蒂回归算法(Logistic Regression, LR)的态势要素提取模型(LR-IPSO),从大量网络安全状态数据中获取态势要素。网络安全态势感知中态势要素获取的问题可转化为海量数据的识别分类问题,针对此类问题,采用Logistic回归模型进行求解。在Logistic回归模型中,利用改进的粒子群优化算法的内在隐并行性和很好的全局寻优能力对Logistic回归模型的参数进行估算,优化Logistic回归模型的学习能力,从而改善对大量网络安全状态数据态势要素获取的正确率。(2)引入特征提取技术,提出一种基于能直接处理连续型数据的邻域粗糙集模型和Logistic回归算法的态势要素获取模型。特征选择可用于处理海量数据。同时,邻域粗糙集模型能够直接处理连续型数据,规避了一些重要信息在大量的预处理和离散化过程中丢失,从而导致分类精度下降。邻域粗糙集模型处理之后,保留了特征集合中的最优子集。在此基础上,利用LR-IPSO模型对大量网络安全状态数据的态势要素进行获取,可以很好的提高态势要素获取能力。(3)为了进一步提高Logistic回归算法的综合性能,我们综合考虑了网络状态数据的海量性和单机的处理能力,在上述算法和模型的基础上,采用MapReduce框架,提出了一种改进的基于Logistic回归和邻域约简模型的网络安全态势要素获取模型,即：利用MapReduce框架对Logistic回归算法进行改写,实现并行Logistic回归算法,可以一次性处理所有日志数据,避免了抽取一部分原始数据过程中丢失一些重要的信息,进一步提高了网络安全态势要素获取的精度,同时缩短了整个获取过程所需的时间。
[Abstract]:In this paper, based on the application background of network security situation awareness, the particle swarm optimization algorithm (PSO) Swarm optimization, PSOO logistic regression algorithm, neighborhood rough set technology and MapReduce distributed framework are introduced. In order to improve the accuracy of the acquisition of network security situation elements and assist the network administrator to analyze the network security situation in detail, the intelligent network security situation element acquisition model and the calculation method are established to improve the accuracy of the network security situation element acquisition. The main work includes the following parts: 1) this paper proposes a situation factor extraction model using improved Particle Swarm optimization algorithm (IPSO) and logistic regression algorithm (LRR), which is based on improved particle swarm optimization (PSO) and logistic regression algorithm (LRR). LR-IPSO, which obtains the situation elements from a large number of network security state data. The problem of obtaining the situation elements in the network security situation awareness can be transformed into the recognition and classification problem of the massive data. In the Logistic regression model, the parameters of the Logistic regression model are estimated by using the inherent implicit parallelism and good global optimization ability of the improved particle swarm optimization algorithm. The learning ability of Logistic regression model is optimized to improve the correct rate of acquiring a large number of network security state data situation elements. This paper presents a situation element acquisition model based on neighborhood rough set model and Logistic regression algorithm, which can directly process continuous data. Feature selection can be used to deal with mass data. At the same time, neighborhood rough set model can deal with continuous data directly. Some important information is lost in the process of preprocessing and discretization, which leads to the decline of classification accuracy. After the processing of neighborhood rough set model, the optimal subset of feature set is retained. In order to further improve the comprehensive performance of Logistic regression algorithm, the LR-IPSO model is used to obtain the situation elements of a large number of network security state data, which can improve the acquisition ability of the situation elements. Considering the magnanimity of network state data and the processing ability of single computer, we adopt MapReduce framework on the basis of the above algorithms and models. An improved network security situation element acquisition model based on Logistic regression and neighborhood reduction model is proposed, that is, the Logistic regression algorithm is rewritten by using the MapReduce framework, and the parallel Logistic regression algorithm is realized, which can process all the log data at one time. It avoids the loss of some important information in the process of extracting some raw data, further improves the precision of obtaining network security situation elements, and shortens the time required for the whole acquisition process.
【学位授予单位】：福州大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】