基于相关特征矩阵和神经网络的异常检测研究  

A Study on Anomaly Detection Method Based on Correlation Eigen Matrix and Neural Network

作　　者：李战春[1] 李之棠[1] 黎耀[1] 

机构地区：[1]华中科技大学网络与计算中心,武汉430074

出　　处：《计算机工程与应用》2006年第7期19-21,58,共4页Computer Engineering and Applications

基　　金：湖北省自然科学基金资助项目(编号:2004ABA051);国家网络与信息安全保障可持续发展计划资助项目(编号:2004-研1917-C-021)

摘　　要：文章描述了一个基于相关特征矩阵和神经网络的异常检测方法。该方法首先创建用户轮廓以定义用户正常行为,然后比较当前行为与用户轮廓的相似度,判断输入是正常或入侵。为了避免溢出和减少计算负担,使用主成分分析法提取用户行为的主要特征,而神经网络用于识别合法用户或入侵者。在性能测试实验中,系统的检测率达到74.6%,而误报率为2.9%。在同样的数据集和测试集的情况下,与其它方法相比,此方法的检测性能最优。This article presents an anomaly detection method based on correlation eigen matrix and neural network.The method first creates a profile defining a normal user＇s behavior,and then compares the similarity of a current behavior with the created profile to decide whether the input instance is valid user or not.In order to avoid overfitting and reduce the computational burden,user behavior principal features are extracted by the（PCA） method.The neural network is used to distinguish valid user or intruder after training procedure has been completed by unsupervised learning and supervised learning.ln the experiments for performance evaluation the system achieves a correct detection rate equal to 74.6% and a false detection rate equal to 2.9% ,which is consistent with the best results reports in the literature for the same data set and testing paradigm.

关 键 词：异常检测 神经网络 相关特征矩阵 

分 类 号：TP18[自动化与计算机技术—控制理论与控制工程]