应用于入侵取证的改进信息增益算法  

Application of improved information gain algorithm in intrusion forensics

作　　者：贾娴[1,2] 刘培玉[1,2] 公伟[1,2] 

机构地区：[1]山东师范大学信息科学与工程学院,济南250014 [2]山东师范大学山东省分布式计算机软件新技术重点实验室,济南250014

出　　处：《计算机应用》2011年第8期2156-2158,2177,共4页journal of Computer Applications

基　　金：国家自然科学基金资助项目(60873247);山东省高新技术自主创新专项(2008ZZ28);山东省自然科学基金资助项目(ZR2009GZ007);山东省教育厅科技计划项目(J09LG52)

摘　　要：基于信息增益算法的特征选择虽然能够较好地解决入侵取证中存在的数据高维海量问题,但由于没有考虑特征之间的关系,导致特征子集中存在着冗余特征,从而影响了入侵取证的速度和精度,由此提出一种改进的基于特征冗余度的信息增益算法。通过添加对特征之间冗余度的判断,在删除无关特征的同时过滤了冗余特征,使特征子集得到有效精简。经实验验证,该算法能有效地选择特征向量,保证检测精度,提高检测速度。Feature selection algorithm based on the Information Gain（IG） can solve the problem of high-dimension and magnanimous data in intrusion forensics,but it neglects the correlation between features,which can lead to the redundancy of features,and affect the speed and accuracy of intrusion forensics.Therefore,an Improved Information Gain（IIG） algorithm based on feature redundancy was proposed.In the improved algorithm,the irrelevant features and the redundant features were removed by adding the judgments of redundancy between features,which effectively simplified feature subset.The experimental results show that the proposed algorithm can effectively select features,ensure detection accuracy and improve processing speed.

关 键 词：入侵取证 特征选择 信息增益 特征冗余度 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]