摘要
传统基于网络流量的木马检测方法对训练样本要求较高,泛化能力差,分类精度难以提升,且不能处理概念漂移问题。为提升现有方法的准确度,在研究网络流量通信特征的基础上,提出一种集成学习分类模型,在流量处理中检测其产生的概念漂移,根据检测结果动态更新由训练集构建的集成分类器,利用集成分类器加权集成,达到检测木马流量的目的。真实网络环境下的实验结果验证了该模型的有效性,通过重新训练和集成学习使漏报率和误报率显著降低。
Traditional Trojan detection methods based on network flow overly depend on training sam- ples, have poor generalization ability and low classification precision, and are not able to deal with concept drift problem. To improve the accuracy of current methods, an ensemble learning classifica- tion model is proposed based on the research of the communication ieatures of network flow. The model made detection for concept drift in flow processing, and automatically replaced ensemble clas- sifiers built by training set according to detection result. And it weighted integration using ensemble classifiers to achieve the purpose of detecting Trojan flow. Experimental results verified the effective- ness of the model in the real network environment. By retraining and ensemble learning, the model can significantly reduce false negative rate and false positive rate.
作者
李晔
刘胜利
张兆林
LI Ye;LIU Shengli;ZHANG Zhaolin(Information Engineering University,Zhengzhou 450001,China)
出处
《信息工程大学学报》
2017年第6期708-711,共4页
Journal of Information Engineering University
基金
国家自然科学基金资助项目(61271252)
郑州市科技创新团队资助项目(10CXTD150)
关键词
木马检测
通信流量
概念漂移
集成学习
Trojan detection
communication flow
concept drift
ensemble learning
