一种基于偏最小二乘的网络入侵检测方法分析  

A Network Intrusion Detection Method Based on Partial Least Squares

作　　者：陈善雄[1] 彭茂玲 彭喜化[1] 

机构地区：[1]西南大学计算机与信息科学学院,重庆400715 [2]重庆城市管理职业技术学院,重庆401331

出　　处：《信息网络安全》2016年第1期6-10,共5页Netinfo Security

基　　金：国家自然科学基金[61303227];西南大学博士启动基金[swu1114033];中央高校基本科研业务费[XDJK2014C039;XDJK2016C045]

摘　　要：由于网络应用的日益广泛,网络安全在计算机网络中的作用越来越重要。通过对网络数据流的分析和鉴别,进而甄别出入侵行为是网络安全研究的一个重要方向。当网络遭受来自外部的入侵时,入侵数据可以视为叠加在正常网络流量上的一个非线性扰动,其扰动强度受入侵时间、入侵数据流量大小影响。因此我们可以利用非线性理论和模型,建立网络非线性数据的模型,通过参数拟合发现异常数据流。文章在网络入侵检测中引入了非线性回归方法——偏最小二乘,来预测网络行为。同时在偏最小二乘的残差计算中采用了Kullback-Leibler散度作为迭代计算标准,提升了检测速度和精度。Due to widely network applications, the role of network security is becoming more and more important in computer networks. The analysis and discrimination of network data stream and intrusion behaviors is an important direction of network security research. When anomelous behavior coming from outside is detected in network, intrusion data can be treat as nonlinear disturbance which is overlay normal network data fl ow. Strength of disturbance is infl uenced by the stream of intrusion data. Therefore, we can use non-linear theory and model to construct non-linear pattern for the network data stream. Then abnormal behavior could be discovered based on parameter fitting method. In response to network intrusion detection, this paper introduces a nonlinear regression method- partial least squares to predict the network behaviors. At the same time, in the calculation of partial least squares residuals, the paper adopts the Kullback Leibler-divergence as an iterative calculation standard so as to improve the detection speed and accuracy.

关 键 词：散度 偏最小二乘 入侵检测 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]