基于深度森林的BGP异常检测方法  

BGP ANOMALY DETECTION METHOD BASED ON DEEP FOREEST

作　　者：赵智男 张健毅 池亚平[2,3] Zhao Zhinan;Zhang Jianyi;Chi Yaping(School of Telecommunications Engineering,Xidian University,Xi an 710701,Shaanxi,China;Beijing Electronic Science and Technology Institute,Beijing 100070,China;Key Laboratory of Network Assessment Technology,Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China)

机构地区：[1]西安电子科技大学通信工程学院,陕西西安710701 [2]北京电子科技学院,北京100070 [3]中国科学院信息工程研究所中国科学院网络测评技术重点实验室,北京100093

出　　处：《计算机应用与软件》2024年第10期372-378,共7页Computer Applications and Software

摘　　要：一直以来,边界网关协议(Border Gateway Protocol,BGP)异常事件严重影响着互联网的稳定与安全,因此BGP异常检测算法的研究显得尤为重要。针对已应用于BGP异常检测的机器学习算法准确率不高且实验数据集异常种类单一的问题,为了提高准确率并提高方法普适性,引入基于深度森林的异常分类算法。实验采用多个异常事件数据集,根据皮尔森相关系数来剔除冗余无关特征,用于对BGP异常分类,分别采用深度森林算法和其他机器学习算法对数据分类。实验结果表明,深度森林的性能是优于其他算法的。For a long time,BGP abnormal events have seriously affected the stability and security of the Internet,so the research on BGP anomaly detection algorithms is particularly important.In view of the low accuracy of the machine learning algorithm that has been applied to BGP anomaly detection and the single type of anomaly in the experimental data set,in order to improve the accuracy and universality of the algorithm,an anomaly classification algorithm based on deep forest is introduced.The experiment used multiple abnormal event data sets,and eliminated redundant and irrelevant features based on Pearson correlation coefficients,which were used to classify BGP anomalies.The deep forest algorithm and other machine learning algorithms were used to classify the data.Comprehensive experimental results show that the performance of deep forest is better than other algorithms.

关 键 词：边界网关协议 异常检测 深度森林 机器学习 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]