一种基于混合分类器的异常检测模型  

Anomaly Detection Model Based on Hybrid Classifiers

作　　者：王飞[1] 徐本连[1] 钱玉文[2] 戴跃伟[2] 王执铨[2] 

机构地区：[1]常熟理工学院电气与自动化工程学院,常熟215500 [2]南京理工大学自动化学院,南京210094

出　　处：《系统仿真学报》2012年第4期854-858,867,共6页Journal of System Simulation

基　　金：国家自然科学基金(60804068);江苏省自然科学基金(BK2010261);江苏省产学研联合创新资金计划(BY2010126)

摘　　要：针对网络的异常检测方法对未知攻击难以提供更多有用信息的缺点,提出一种基于分类器的异常检测模型。模型首先采用支持向量机对网络连接进行异常检测,然后将检测获得的异常作为输入进入聚类模块以得到其更多信息,其中聚类模块由自组织映射算法与信息获取算法共同完成。通过对检测到的异常进行信息获取的方法可以获得未知入侵的更多有价值的信息。最后应用kddcup99数据集进行仿真实验,实验结果表明,该检测模型具有较好的检测率和较低的误报率,并且该模型对于获得未知入侵的更多信息是有效的。In view of the disadvantage,of an anomaly detection which can not provide more useful information about the unknown intrusions,an anomaly detection model based on hybrid SVM/SOM was proposed.At first,support vector machine（SVM） was used to detect anomalous connections,and then the detected anomalies were as input of the clustering module to get more information.The clustering module consisted of self-organizing map（SOM） algorithm and information acquisition algorithm.Through the method of acquire information about the detected anomalies,more valuable information about the unknown intrusions could be obtained.Finally,the kddcup99 data sets were used for simulation.The experimental results show that the detection model has a better detection efficiency and low false alarm rate,and the model for getting information of unknown intrusions is valid.

关 键 词：支持向量机 自组织映射 异常检测 信息获取 

分 类 号：TP391.9[自动化与计算机技术—计算机应用技术]