一种基于核熵和人工免疫的网络异常检测方法  

On a Network Anomaly Detection Method Based on Kernel Entropy Component Analysis and Artificial Immune

作　　者：罗娅[1] 陈文[2] 

机构地区：[1]重庆理工大学计算机科学与工程学院,重庆400050 [2]四川大学计算机学院,成都610065

出　　处：《西南师范大学学报（自然科学版）》2016年第6期119-124,共6页Journal of Southwest China Normal University(Natural Science Edition)

基　　金：国家自然科学基金项目(61572334;61402308)

摘　　要：针对网络样本数据复杂且维数较高,导致异常检测模型容易遭受维数灾难这一问题,本文将核熵成分分析法应用到基于人工免疫的网络异常检测中,与传统的多元统计分析方法相比,核熵成分分析可以保证数据降维过程的信息熵损失更少,从而保留了更多有用的分类信息.基于降维后的数据,本文采用实值否定选择算法训练人工免疫检测器对网络异常样本进行检测.在入侵检测标准数据集KDD Cup99上进行了对比实验,实验结果表明,基于核熵成分分析的异常检测准确率从87.1%提高到了98.9%,有效地改进了网络异常检测的性能.A study has been done aiming at the problem that the network samples are complex,and with high data dimension,resulting in the curse of dimensionality of network abnormal detection models.In the paper,kernel entropy component analysis method has been applied to network abnormal detection based on artificial immune system.Compared with traditional multi-components analysis methods,there is less information entropy loss during the dimension reduction procedure of KECA,thus more classification information can be reserved.After the dimension reduction,the real valued negative selection algorithm has been utilized to train artificial immune detectors to detect the network abnormal.The comparisons are executed on the standard intrusion detection test dataset KDDCUP99.The results demonstrate that,compared with traditional methods,the true detection rate of KECA is enhanced from 87.1%to 98.9%,which means the performance of network abnormal detection is effectively improved.

关 键 词：核熵 人工免疫系统 网络安全 异常检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]