摘要
入侵检测系统在训练过程中需要大量有标识的监督数据进行学习 ,不利于其应用和推广 为了解决该问题 ,提出了一种基于主成分分析的无监督异常检测方法 ,在最小均方误差原则下学习样本的主要特征 ,经过压缩和还原的互逆过程后能最大限度地复制样本信息 ,从而根据均方误差的差异检测出异常信息 构建的仿真系统经过实验证明 ,基于主成分分析的无监督异常检测方法能够在无需专家前期参与的情况下检测出入侵 。
Intrusion detection systems need a mass of the labeled data in the process of training It hampers the application and popularity of traditional IDSs A study was conducted to realize the automation of the learning process of the detection models where the training data is unsupervised A novel method of unsupervised anomaly detection based on principal components analysis (PCA) is presented The main characteristics of the training samples are learned under the principle of least mean square errors The information of the samples is duplicated in the process of encoding and decoding The anomaly behaviors can be detected according to the anomaly factor defined by the square errors between the original vector and the resultant one The experiment of the simulation system proves that the method of unsupervised anomaly detection based on PCA does not need the participation of experts in the prophase The experimental result shows its effectiveness
出处
《计算机研究与发展》
EI
CSCD
北大核心
2004年第9期1474-1480,共7页
Journal of Computer Research and Development
关键词
网络安全
异常检测
无监督学习
主成分分析
network security
anomaly detection
unsupervised learning
principal components analysis
