基于代价敏感鉴别字典学习的入侵检测方法

发布时间：2019-04-10 12:04

【摘要】：针对目前存在的字典学习方法不能有效的构造具有鉴别能力的结构化字典,并且忽视了由于正负类样本数据不均衡造成的代价不同问题,提出了基于代价敏感的鉴别字典学习方法,并将其用于网络入侵检测。首先,重新构建稀疏表示模型,通过在目标函数中设计约束的鉴别项学习具有鉴别性质的字典;其次,考虑到数据集中入侵数据和非入侵数据不平衡,二者的检测代价是不同的,引入代价敏感矩阵来考虑不同的误检测行为代价对于分类性能造成的影响。选择经过预处理的KDD99网络入侵数据集作为实验数据,引入召回率、查准率、错误接受率以及F-measure等指标进行分类器性能评估,并与支持向量机、决策树以及聚类分析等机器学习算法进行实验对比发现,CS-DDL能够较好的改善分类器的性能。
[Abstract]:In view of the existing dictionary learning methods can not effectively construct a structured dictionary with discriminating ability, and ignore the different costs caused by the imbalance of positive and negative sample data. A cost-sensitive discriminant dictionary learning method is proposed and applied to network intrusion detection. Firstly, the sparse representation model is reconstructed, and the discriminant terms of constraints are designed in the objective function to learn the dictionary with discriminant property. Secondly, considering the imbalance of intrusion data and non-intrusion data in the data set, the detection costs are different. The cost-sensitive matrix is introduced to consider the impact of different false detection behavior costs on classification performance. The pre-processed KDD99 network intrusion data set is selected as the experimental data, and the recall rate, precision ratio, error acceptance rate and F-measure are introduced to evaluate the performance of the classifier, and the classifier performance is evaluated with support vector machine (SVM). Compared with other machine learning algorithms, such as decision tree and cluster analysis, CS-DDL can improve the performance of classifier.
【作者单位】：南京森林警察学院信息技术系;
【基金】：中央高校基本科研业务费专项资金项目(LGYB201605)
【分类号】：TP181;TP393.08

【相似文献】