Web用户异常行为检测的优化研究  

Research on Optimization of Web User Abnormal Behavior Detection

作　　者：王青松[1] 李菲 WANG Qing-song;LI Fei(College of Information,Liaoning University,Shenyang 110036,China)

机构地区：[1]辽宁大学信息学院,辽宁沈阳110036

出　　处：《辽宁大学学报（自然科学版）》2021年第1期74-81,共8页Journal of Liaoning University：Natural Sciences Edition

基　　金：国家自然科学基金项目(61802160)。

摘　　要：为了优化对于Web日志记录的用户异常行为的检测能力,提出一种基于决策树算法的Web用户异常行为检测算法.从给定已有标签的数据集中,根据Relief-F算法来度量特征,引进混淆矩阵的概念选择合适的阈值ε,选取比阈值大的统计量分量,其所对应的的特征组成用来训练学习器的特征集.将划分后的相关特征集利用C4.5算法构建模型,形成一种新的Web用户异常行为检测算法F_C4.5算法.UNSW-NB 15数据集的实验表明,相比传统的几种数据分析算法,F_C4.5算法分类效果最优,在KDD CUP1999数据集上验证了F_C4.5算法降低了C4.5算法在构造树的复杂度,在Web用户异常行为检测中具有更高效的性能.In order to optimize the ability to detect the abnormal behavior of web users,this paper proposes a web user abnormal behavior detection algorithm based on decision tree algorithm.From the data sets of a given label,according to the Relief-F algorithm to measure the features,the concept of confusion matrix is introduced to select the appropriate threshold,and the statistical component larger than the threshold is selected,whose corresponding features constitute the feature set used to train the learner.The C4.5 algorithm was used to construct the model of the divided feature set,and a new abnormal behavior detection algorithm F C4.5 was formed.Experiments in UNSW-NB 15 data sets show that compared with several traditional data analysis algorithms,F C4.5 algorithm has the best classification effect.the KDD CUP1999 data sets validate the F_C4.5 algorithm reduces the complexity of C4.5 algorithm in tree construction and has more efficient performance in the detection of web users’abnormal behavior.

关 键 词：异常行为检测 Relief-F算法 决策树模型 混淆矩阵 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]