无监督异常检测的核聚类和序列分析方法  

Kernel Clustering and Sequence Analysis Methods for Unsupervised Anomaly Detection

作　　者：钟诚[1] 罗程[1,2] 

机构地区：[1]广西大学计算机与电子信息学院,南宁530004 [2]广西大学行健文理学院,南宁530004

出　　处：《计算机研究与发展》2008年第z1期326-331,共6页Journal of Computer Research and Development

基　　金：广西科学基金项目(桂科自0339008)

摘　　要：利用核函数构造数据的特征空间并在此空间采用核函数结合RA算法选取初始聚类中心,在核k-means聚类基础上,划分出大簇小簇,然后在大簇中进行异类分离以发现实验数据中以小概率事件出现的R2L,U2R和PROBE攻击;并且在大簇中挖掘闭合序列模式,获得描述大簇的序列规则,从中判断是否存在DoS攻击.算法分析和实验结果表明提出的方法可以获得较高的检测率并降低误报率.A feature space of data is constructed by using the kernel function, and the initial cluster centroids on the feature space are selected by applying a kernel-RA algorithm. The large and small clusters are partitioned and the outliers are split from the large clusters iteratively after the kernel k-means clustering, and the R2L and U2R and PROBE attacks with small probability distribution in data set can be detected and discovered. Furthermore, the closed sequence patterns in the large clusters are mined and the rules that describe the large clusters are obtained, and the DoS attacks are detected and found by applying the rules. The algorithm analysis and experiment results show that the presented methods can obtain the high detection rate and decrease the false positive rate.

关 键 词：异常检测 模式挖掘 序列分析 核函数 聚类 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP18[自动化与计算机技术—计算机科学与技术]