基于大数据技术的网络异常行为检测模型  

Network Abnormal Behavior Detection Model Based on Big Data Technology

作　　者：刘建兰 覃仁超[1] 何梦乙 熊健 Liu Jianlan;Qin Renchao;He Mengyi;Xiong Jian(School of Computer Science and Technology,Southwest University of Science and Technology,Mianyang 621010,China)

机构地区：[1]西南科技大学计算机科学与技术学院,四川绵阳621010

出　　处：《计算机测量与控制》2020年第3期62-66,71,共6页Computer Measurement &Control

基　　金：国防基础科研计划项目(JCKY2017404C004);四川省教育厅项目(17zd1119,18sxb022);四川省组织部项目(17sjjg02)。

摘　　要：针对传统的网络异常检测受数据存储、处理能力的限制,存在准确率较低、误报率较高以及无法检测未知攻击的问题;在Spark框架下结合改进的支持向量机和随机森林算法,提出了一种基于大数据技术的网络异常行为检测模型;使用NSLKDD数据集进行了方法验证,表明该方法在准确率和误报率方面明显优于传统的检测算法,整体检测的准确率和误报率分别为96.61%和2.92%,DOS、Probe、R2L和U2R四种攻击类型的准确率分别达到98.01%、88.29%、94.03%和66.67%,验证了方法的有效性。The traditional network anomaly detection is limited by data storage and processing capabilities,which has the problems of low accuracy rate,high false alarm rate and unable to detect unknown attacks.To resolve this,combined with the improved Support Vector Machine and Random Forest algorithm in Spark,a network abnormal behavior detection model based on big data technology is proposed.The method is verified by NSL-KDD data set,which shows that the method is superior to the traditional detection algorithm in accuracy and false positive rate.The accuracy and false positive rate of the overall detection are 96.61% and2.92%,The accuracy rates of DOS,Probe,R2 Land U2 Rrespectively were 98.01%,88.29%,94.03%and 66.67%,which verified the effectiveness of the method.

关 键 词：大数据技术 网络异常行为 支持向量机 随机森林 模拟退火 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]