基于多窗口机制的聚类异常检测算法

发布时间：2018-06-24 20:20

本文选题：单窗口 + 多窗口　；参考：《信息网络安全》2016年11期

【摘要】：文章通过分析单窗口聚类异常检测算法的不足,综合利用权值、相似度和局部密度等概念对单窗口检测出的潜在异常点进行归属查找和异常合并,设计了一种基于多窗口机制的数据流异常检测算法。该算法首先在单个窗口内用改进的K-means聚类算法对预处理之后的数据流进行初步聚类检测,将每个窗口聚类的结果分为正常簇集合和潜在异常点集合。然后对单窗口检测结果进行二次判断。针对单窗口检测的潜在异常点,利用相似度原理进行正常类簇的归属查找,排除异常误判;利用局部密度等概念,对剩下的潜在异常点进行异常合并,再次排除可能的正常点。最后利用时间权值,综合多个数据流窗口的检测结果得出最终异常数据。仿真实验表明,相较于单窗口数据流异常检测算法,该算法提高了数据流的异常检测率,减少了异常误判,在检测率和误报率方面更具优势。
[Abstract]:In this paper, by analyzing the deficiency of single window clustering anomaly detection algorithm, using the concepts of weight, similarity and local density, we can find and merge the potential outliers detected by single window. An algorithm of data stream anomaly detection based on multi-window mechanism is designed. Firstly, the improved K-means clustering algorithm is used to detect the pre-processed data stream in a single window, and the results of each window clustering are divided into normal cluster set and potential outlier point set. Then the results of single window detection are judged twice. For the potential outliers detected by single window, the homing search of normal clusters is carried out by the similarity principle, and the abnormal misjudgment is eliminated. By using the concepts of local density, the remaining potential outliers are merged and the possible normal points are eliminated again. Finally, using the time weight value, the detection results of multiple data stream windows are synthesized to obtain the final abnormal data. The simulation results show that compared with the single window data flow anomaly detection algorithm, the algorithm improves the anomaly detection rate of the data flow, reduces the abnormal error detection, and has more advantages in the detection rate and false alarm rate.
【作者单位】：海军工程大学信息安全系;91428部队;
【基金】：湖北省自然科学基金[2015CF867]
【分类号】：TP311.13

【相似文献】