摘要
网络异常检测技术是网络安全领域的热点问题。目前存在的异常检测算法大多属于静态分类算法,并未充分考虑到实际应用领域中海量数据不断增加的问题。本文提出了一种基于增量KNN模型的分布式入侵检测架构,它首先将少量的训练集均匀分配到各个节点上建立初始KNN模型,然后再将新增的数据分割成小块数据交由各个节点并行地进行增量学习,即对各节点的原有模型进行调整、优化,最后通过模型融合得到较为鲁棒的检测效果,在KDDCUP’99数据集上的实验结果验证了本方法的有效性。
Network intrusion detection is a hot topic in network security. Most of intrusion detection algorithms in literature are static classification algorithms, which do not fully consider the problem of data from real - world applications increasing all the time. This paper proposed a distributed architecture for intrusion detection based on incremental KNN model. It divides a small amount of training data into each node on which the initial KNN model are built, and then partitions the new coming data into small parts and passes to different nodes for incremental learning parallelly to adjust and optimize previous generated KNN model. It aims to obtain robust detection performance via integrated learning. Experimental results carried out on KDD CUP＇99 data sets justify its effectiveness of the proposed method.
出处
《微计算机应用》
2009年第11期28-33,共6页
Microcomputer Applications
基金
福建省自然科学基金NO.2007J0016
教育部留学回国人员基金(教外司留[2008]890号)的资助
关键词
入侵检测系统
增量学习
并行计算
KNN模型
intrusion detection system, incremental learning
parallel computing, KNNModel
