流量异常检测中的直觉模糊推理方法  

Intuitionistic Fuzzy Reasoning Method in Traffic Anomaly Detection

作　　者：范晓诗[1] 雷英杰[1] 王亚男[1] 郭新鹏[1] 

机构地区：[1]空军工程大学防空反导学院,西安710051

出　　处：《电子与信息学报》2015年第9期2218-2224,共7页Journal of Electronics & Information Technology

摘　　要：针对网络流量特征属性不确定性和模糊性的特点,将直觉模糊推理理论引入异常检测领域,该文提出一种基于包含度的直觉模糊推理异常检测方法。首先设计异常检测中特征属性的隶属度与非隶属度函数,其次,给出基于包含度的强相似度计算方法并生成推理规则库,再次给出多维多重式直觉模糊推理规则,最后建立异常检测中的直觉模糊推理方法。通过对异常检测标准数据集KDD99的实验,验证该方法的有效性,与常见经典异常检测方法对比,该方法具有更良好的检测效果。Aiming at the characteristics of uncertainty and fuzziness of the network traffic attribute, an Intuitionistic Fuzzy Reasoning Theory（IFRT） is introduced to the anomaly detection field. A method of IFRT detection based on the inclusion degree is proposed. Firstly, the membership and non-membership functions of attributes in anomaly detection are designed. Secondly, the intensity similarity measure method based on the inclusion degree is presented and the rules library is generated. And then, the FMP rules of the IFRT are presented. Finally, an anomaly detection based on the IFRT is constructed. The validity is checked by experiment on the standard detection dataset KDD99, compared with other traditional theory, the IFRT anomaly detection method performs better than others.

关 键 词：网络 信息安全 直觉模糊集 异常检测 直觉模糊推理 特征属性 包含度 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]