基于改进ReliefF算法的Honeynet告警日志分析  

Analysis of alert log in Honeynet based on improved ReliefF

作　　者：毕凯[1] 周炜[1] 蒋玉娇[1] 安和平[1] 

机构地区：[1]空军工程大学导弹学院,陕西三原713800

出　　处：《计算机工程与设计》2011年第7期2237-2240,共4页Computer Engineering and Design

基　　金：国家自然科学基金项目(60975026)

摘　　要：针对蜜罐中数据分析系统的薄弱性,提出了基于PCA和改进的ReliefF方法的告警日志分析系统。通过主成分分析,去除特征之间的冗余性,能够有效降低算法的复杂性,再利用改进的ReliefF算法,选择出最能代表样本的特征,构成有效特征子集,实现特征的降维。该方法能够在保证较高分类精度的同时,显著提高分类速度,并在一定程度上实现了数据分析的智能化和自动化,实验结果表明了其正确性。An analysis system of the alert log based on PCA and improved ReliefF is proposed to resolve the problem of weak data analysis system in honeypot. Through the analysis of the principle component, it can effectively decrease the redundancy of features and reduce the complexity of the algorithm. Then by using improved ReliefF to take out the most representative features which constitute the effective feature sets, the dimensions of the features are decreased. The method effectively decreases the time of classification with a higher accuracy, and achieves the target of intelligent and automated data analysis. In the end, experimental results show that the method is correct.

关 键 词：蜜罐 蜜网 数据分析 PCA RELIEFF 

分 类 号：TP393.8[自动化与计算机技术—计算机应用技术]