自组织增量神经网络IDS研究  

Network anomaly detection with improved self-organizing incremental neural network

作　　者：向直扬[1] 朱俊平[1] 

机构地区：[1]西北农林科技大学信息工程学院,陕西杨凌712100

出　　处：《计算机工程与应用》2014年第2期88-91,123,共5页Computer Engineering and Applications

摘　　要：理想的网络入侵检测系统(IDS)是无监督学习的、在线学习的。现有的满足这两个标准的方法训练速度较慢,无法保证入侵检测系统所需要的低丢包率。为了提高训练速度,提出一种基于改进的自组织增量神经网络(improved SOINN)的网络异常检测方法,用于在线地、无监督地训练网络数据分类器;并提出使用三种数据精简(Data Reduction)的方法,包括随机子集选取,k-means聚类和主成分分析的方法,来进一步加速改进的SOINN的训练。实验结果表明,提出的方法在保持较高检测率的前提下,减少了训练时间。An ideal Intrusion Detection System （IDS） should implement unsupervised learning and online learning. Exist- ing methods suffice these two criterions requires too much training time, which would cause a high packet loss rate and is unacceptable. To overcome the difficulty, an intrusion detection method based on improved Self-Organizing Incremental Neural Network（SOINN） and data reduction is presented, which allows online training of network classifiers in an unsu- pervised fashion. Also, data reduction methods, including random subset selection, k-means clustering, and principle com- ponent analysis are employed to accelerate the training. Experimental results show that the proposed method requires less time in training while maintaining a high detection rate.

关 键 词：异常检测 在线聚类 数据精简 自组织增量神经网络 最近邻分类器 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]