基于模糊核聚类和主动学习的异常检测方法  

Anomaly detection method based on fuzzy kernel clustering and active learning

作　　者：吕宗平[1] 时熙然 顾兆军[1,2] Lü Zongping;SHI Xiran;GU Zhaojun(Information Security Evaluation Center,Civil Aviation University of China,Tianjin 300300,China;College of Computer Science and Technology,Civil Aviation University of China,Tianjin 300300,China)

机构地区：[1]中国民航大学信息安全测评中心,天津300300 [2]中国民航大学计算机科学与技术学院,天津300300

出　　处：《现代电子技术》2019年第20期53-57,63,共6页Modern Electronics Technique

基　　金：国家自然科学基金(61601467);民航安全能力建设项目(PESA170003);民航安全能力建设项目(AADSA0018);中国民航信息技术科研基地开放课题基金(CAAC-ITRB-201702)

摘　　要：针对日志数据的异常检测获取标记数据代价过高的问题,提出一种基于模糊核聚类与主动学习的算法,即KFCM?AL算法。首先将日志解析,之后利用模糊核聚类算法将待选样本在高维空间进行划分聚类,滤去样本冗余点,同时选取聚类中心进行标记构建初始分类器,最后结合主动学习利用较小的标记代价对异常检测模型进行优化。实验结果表明,所提方法能够利用较少的标记样本获取异常检测模型的性能提升。In allusion to the problem of high cost of obtaining marking data for anormal detection of log data,an algorithm based on kernel fuzzy C?means and active learning(KFCM?AL)is proposed.The log is parsed,and then the samples under se?lection are classified and clustered in high?dimensional space by means of KFCM algorithm.The redundant points of samples are filtered out,at the same time the clustering center is selected to make marking and build the initial classifier.In combination with active learning,the anomaly detection model is optimized with a smaller marking cost.The experimental results show this method can improve the performance of the anomaly detection model with fewer marking samples.

关 键 词：异常检测 模糊核聚类 主动学习 日志解析 聚类分析 性能对比 

分 类 号：TN911.23?34[电子电信—通信与信息系统] TP301.6[电子电信—信息与通信工程]