基于数据驱动的网络安全数据分类方法  

Network security data classification method based on data driven

作　　者：陈晶[1] Chen Jing(Wuhan Center for Disease Control and Prevention,Wuhan 430024,China)

机构地区：[1]武汉市疾病预防控制中心,武汉430024

出　　处：《国外电子测量技术》2021年第4期42-46,共5页Foreign Electronic Measurement Technology

摘　　要：为了快速准确完成网络安全数据分类,提出了基于数据驱动的网络安全数据分类方法。利用基于数据驱动的K-means聚类算法通过初始中心选取和K值的确定聚类分析网络安全数据,采用随机森林算法完成聚类数据预处理,剔除网络数据的不相关特征属性,并利用领域粗糙集算法提取特征,去除冗余数据后,建立基于XGBoost算法的分类模型,通过设置Booster参数、学习目标参数和通用参数,并利用网格搜索法自动优化选择参数,实现网络安全数据分类。实验表明,该方法在网络安全数据分类应用中平均查准率、平均召回率高,且数据分类时间短,正常数据和异常数据分类准确率均可达95%以上。A data-driven network security data classification method is proposed to complete the network security data classification quickly and accurately.The data-driven K-means clustering algorithm is used to cluster and analyze the network security data by selecting the initial center and determining the K value.The random forest algorithm is used to complete the preprocessing of the clustering data,and the irrelevant feature attributes of the network data are removed.After removing the redundant data,the classification model based on xgboost algorithm is established Parameters,learning objective parameters and general parameters,and the grid search method is used to automatically optimize and select parameters to achieve network security data classification.The experimental results show that:in the application of network security data classification,the average precision rate and average recall rate are high,and the data classification time is short,and the classification accuracy of normal data and abnormal data can reach more than 95%.

关 键 词：数据驱动 网络安全 数据分类 聚类算法 冗余数据 召回率 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]