特征约简在入侵检测上的应用  

Application of Feature Reduction to Intrusion Detection System

作　　者：钱权[1] 陈孟[1] 桂林开[1] 

机构地区：[1]上海大学计算机工程与科学学院,上海200072

出　　处：《上海大学学报（自然科学版）》2010年第1期86-90,96,共6页Journal of Shanghai University:Natural Science Edition

基　　金：教育部博士点基金资助项目(20093108120016);上海市教委创新基金资助项目(09YZ05);上海市科委开放课题资助项目(09511501300);上海市重点学科建设资助项目(J50103)

摘　　要：入侵检测需要分析大量的高维样本数据.如何降低高维样本数据的特征维数,对于降低入侵检测系统的训练时间,提高检测精度和检测实时性具有十分重要的意义.提出基于特征相关性分析和基于特征属性重要性评价两种特征选择方法,并利用支持向量机作为分类器来评价不同特征约简方法的有效性和处理实时性.实验结果表明,同经典的主成分分析方法相比,两种特征约简算法都具有较好的处理实时性和较高的分类精度,其中基于属性重要度约简算法在数据预处理时间、训练时间和分类精度上同主成分分析方法相当,且略优于相关性尺度方法.In an intrusion detection system, a large number of samples with high-dimension are analyzed. Reduction of dimensions of the samples is crucial for reducing training time and improving accuracy and real-time capability. In this paper, two feature reduction methods, feature correlation analysis and feature importance measurement, are proposed. Support vector machine is used as a classifier to evaluate effectiveness and performance of different feature reduction methods. Experimental results show that, comparing with the principal component analysis （PCA） method, the two described methods permit real- time processing with high classification accuracy. Moreover, the feature importance measurement in data pre-processing time, training time and classification accuracy is equivalent to that of PCA, and better than the feature correlation approach.

关 键 词：特征约简 相关性分析 特征重要性评价 主成分分析(PCA) 支持向量机 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]