基于主成分分析和决策树的入侵检测方法  

An Intrusion Detection Method Based on Principal Component Analysis and Decision Tree

作　　者：刘勇[1] 孙东红[2] 陈友[3] 王宛山[1] 

机构地区：[1]东北大学机械工程与自动化学院,辽宁沈阳110004 [2]清华大学信息工程研究网络中心,北京100084 [3]中国科学院计算技术研究所,北京100190

出　　处：《东北大学学报（自然科学版）》2010年第7期933-937,共5页Journal of Northeastern University(Natural Science)

基　　金：国家高技术研究发展计划项目(2007AA01Z444;2007AA01Z474;2007AA010501;2007AA01Z467);国家自然科学基金资助项目(60703021;60573134;60803134;90812001)

摘　　要：特征选择算法能够更好地提高入侵检测系统的检测速度和检测效果,消除冗余数据并减轻噪音特征.结合特征选择算法的优势,提出一种基于主成分分析(PCA)与决策树(C4.5)的入侵检测方法,进而构建出轻量级的入侵检测系统.通过在KDD1999数据集上对该方法进行详细的实验验证,证明该方法一方面确保系统有较高的检测率与较低误报率,另一方面能够比较显著地提高系统的训练时间与测试时间.同时,通过比较实验发现此方法在训练时间、测试时间、检测率、误报率上的效果也优于GA-SVM方法.A feature selection algorithm can improve efficiently the detection speed and result, with irrelevant and redundant data eliminated and denoised in an intrusion detection system. Taking advantage of the algorithm, a new hybrid feature selection algorithm based on the principal component analysis （PCA） in combination with decision tree algorithm （CA. 5） was proposed to develop a lightweight intrusion detection system. Verifying the proposed algorithm in detail via tests with the KDD 1999 dataset, the algorithm was proved that it is available to not only ensure the high detection rate and low false alarm rate but also improve obviously the training/testing time of the intrusion detection system. Furthermore, as a result of comparative tests, the algorithm is superior to GA-SVM algorithm in training/testing time, detection rate and false alarm rate.

关 键 词：入侵检测 主成分分析 决策树 特征选择 GA-SVM 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]