轻量级主机数据采集与实时异常事件检测方法研究

发布时间：2018-06-19 04:42

本文选题：异常检测 + 移动代理　；参考：《西安交通大学学报》2017年04期

【摘要】：针对特征值匹配方法不能检测未知异常的缺点以及常驻采集代理占用大量系统资源的问题,提出一种主机数据采集和异常检测方法。采用智能化的移动代理实现主机数据采集,大幅度降低系统中数据采集代理的数量;结合实时异常检测的需求,采用主成分分析方法对所收集的主机信息进行维度约减,并采用聚类方法对降维后的数据进行聚类分析,挖掘其中的异常点;为消除随机异常点对检测结果的影响,采用基于连续时间窗口的主机异常检测方法实现主机异常的准确检测。实验结果表明:与传统方法相比,数据规模相当的情况下,所提方法的时间复杂度减少了50%以上,检测准确率达到了95%以上,适用于主机异常的实时检测。
[Abstract]:To solve the problem that the eigenvalue matching method can not detect unknown anomalies and that resident acquisition agents occupy a large number of system resources, a host data acquisition and anomaly detection method is proposed. The intelligent mobile agent is used to realize the data acquisition of the host computer, which greatly reduces the number of the data acquisition agents in the system, combining with the demand of real-time anomaly detection, the dimension of the collected host information is reduced by principal component analysis method. In order to eliminate the influence of random outliers on the detection results, clustering analysis is used to analyze the dimensionally reduced data, and the outliers are mined. The method of host anomaly detection based on continuous time window is used to detect the host anomaly accurately. The experimental results show that the time complexity of the proposed method is reduced by more than 50% and the detection accuracy is more than 95% when the data scale is equal to that of the traditional method, which is suitable for real-time detection of host anomalies.
【作者单位】：武汉数字工程研究所系统科研部;武汉数字工程研究所系统软件部;西安交通大学电子与信息工程学院;
【基金】：国家自然科学基金资助项目(61502438,61672026) 陕西省自然科学基金资助项目(2016JM6040) 国防预研基金资助项目(B0820132036)
【分类号】：TP309

【相似文献】