基于主成分分析无监督异常检测.pdfVIP

第 41 卷 第 9 期 计 算 机 研 究 与 发 展 Vol 41 ,No 9 2004 年 9 月 J OURNAL OF COMPU TER RESEARCH AND DEV ELOPMEN T Sep 2004 基于主成分分析的无监督异常检测 关 　健 　　　刘大昕 ( 哈尔滨工程大学计算机科学与技术学院 　哈尔滨 　150001) (guanjian @hrbeu educn) 摘 　要 　入侵检测系统在训练过程中需要大量有标识的监督数据进行学习 ,不利于其应用和推广 为了解决该问题 ,提 出了一种基于主成分分析的无监督异常检测方法 ,在最小均方误差原则下学习样本的主要特征 ,经过压缩和还原的互逆 过程后能最大限度地复制样本信息 ,从而根据均方误差的差异检测出异常信息 构建的仿真系统经过实验证明 ,基于主 成分分析的无监督异常检测方法能够在无需专家前期参与的情况下检测出入侵 ,实验结果验证了其有效性 关键词 　网络安全;异常检测 ;无监督学习 ;主成分分析 中图法分类号 　TP39308 Unsupervised Anomaly Detection Based on Principal Components Analysis GUAN Jian and L IU DaXin ( ) College of Computer Science and Technology , Harbin Engineering U niversity , Harbin 　150001 Abstract 　Intrusion detection systems need a mass of the labeled data in the process of training It hampers the application and popularit y of traditional IDSs A study was conducted to realize the automation of the learning process of the detection models where the training data is unsupervised A novel method of unsu pervised anomaly detection based on principal components analysis ( PCA) is presented The main charac teristics of the training samples are learned under the principle of least mean square errors The information of the samples is duplicated in the process of encoding and decoding The anomaly behaviors can be detected according to the anomaly factor defined by the square errors between the original vector and the resultant one The experiment of the simulation system proves that the method of unsupervised anomaly detection based on PCA does not need the participation of experts in the prophase The experimental result shows its effectiveness Key words 　network security ; anomaly detection ; unsupervised learning ; principa