启发式DDoS数据流特征搜索方法的研究.doc

PAGE 4 毕 业 设 计（论 文） 题 目： 启发式DDoS 数据流特征搜索方法研究 摘 要 特征选择是网络安全、模式识别、数据挖掘等领域的重要问题之一。基于特征选择的入侵检测系统处理的数据含有大量的冗余与噪音特征，使得系统耗用的计算资源很大，导致系统训练时间长、实时性差，检测效果不好。特征选择算法能够很好地消除冗余和噪音特征，为了提高入侵检测系统的检测速度和效果，对基于特征选择的入侵检测系统进行研究是必要的。针对高维数据对象，特征选择一方面可以提高分类精度和效率，另一方面可以找出富含信息的特征子集。文中提出一种封装器模型的特征选择算法来构建检测系统。该算法利用启发式搜索策略对特征子集空间进行启发式搜索，然后利用提供的数据在支持向量机上的分类正确率作为特征子集的评价标准来获取最优特征子集。 关键词：特征选择；支持向量机；启发式搜索 ABSTRACT Feature selection is one of the most important problems in network security, pattern recognition and data mining areas. The intrusion detection system based on feature selection deals with huge amount of data which contains redundant and noisy features causing slow training and testing process, high resource consumption as well as poor detection rate. Feature selection, therefore, is an important issue in intrusion detection and it can delete redundant and noisy features. In order to improve performances of intrusion detection system in terms of detection speed and detection rate, a survey of intrusion detection system based on feature selection is necessary. For high dimension data, feature selection not only can improve the accuracy and efficiency of classification, but also discover informative subset. This paper proposes a new feature selection algorithm aiming at building intrusion detection system first using a Heuristic strategy as search strategy to specify a candidate subset for evaluation and then using Support Vector Machines (SVMs) iterative procedure as wrapper approach to obtain the optimum feature subset. Key words：feature selection; support vector machines; heuristic search 目 录 TOC \o 1-3 \h \z \u HYPERLINK \l _Toc201394879 第一章 引言 PAGEREF _Toc201394879 \h 1 HYPERLINK \l _Toc201394880 1.1研究内容 PAGEREF _Toc201394880 \h 1 HYPERLINK \l _Toc201394881 1.2研究背景 PAGEREF _Toc201394881 \h 1 HYPERLINK \l _Toc201394882 第二章 特征选择模型 PAGEREF _Toc201394882 \h 3 HYPERLINK \l _Toc201394883 2.1特征选择的数学模型及一般化过程 PAGEREF _Toc201394883 \h 3 HYPERLINK \l _Toc20