一种基于随机空间树数据流异常检测算法.docVIP

一种基于随机空间树的数据流异常检测算法 　　摘 要： 针对现有的数据流异常检测算法的不足，提出一种基于随机空间树的数据流异常检测算法。首先，采取统计策略对数据流特征范围进行估计，分割得到多棵随机空间树（RS?Tree），形成RS森林（RS?Forest）。然后，RS?Forest采用单窗口策略对数据流进行处理，通过打分和模型更新来实现异常检测。针对实例落入的树节点，定义分段恒定密度，求取密度估计值相对于森林中所有树的平均值，并将其作为数据流中每个新来实例的得分。利用相对于森林中所有树的平均得分对每个新来实例进行排序。窗口满后则采用对偶式节点剖度技术进行模型更新，并利用采集的节点尺寸信息对下一轮到达窗口的数据进行打分。利用多种基准数据集进行仿真实验，结果表明RS?Forest算法在大部分数据集下的AUC得分和运行时间性能均优于当前其他基准算法。 　　关键词： 数据流； 异常检测； 随机空间树； 单窗口策略； AUC得分； 运行时间 　　中图分类号： TN915.08?34； TP393 文献标识码： A 文章编号： 1004?373X（2017）19?0056?06 　　A data stream anomaly detection algorithm based on randomized space tree 　　QIN Weirong1， WANG Ning2 　　（1. School of Electronics and Information Engineering， Qinzhou University， Qinzhou 535000， China； 　　2. School of Information Engineering， Zhengzhou University， Zhengzhou 450001， China） 　　Abstract： Aiming at the shortcomings of the available data stream anomaly detection algorithms， a data stream anomaly detection algorithm based on randomized space tree （RS?Tree） is proposed. The statistical strategy is adopted to estimate the characteristic range of data stream， by which several randomized space trees are obtained by means of segmentation to form RS?Forest. The single window policy is used by RS?Forest to process the data stream， and realize anomaly detection by means of scoring and model updating. According to the tree node that an instance falls in， the piecewise constant density is defined to get the average value of the density estimation values relative to all the trees in forest， which is taken as the score of each new instance in data stream. The average score of all the trees relative to forest is employed to sort each new instance. When the windows are occupied， the antithetic node dissection technology is used to update the model， and the acquired node size information is used to mark the data arriving at the window in the next round. The simulation experiments were carried out with variety of benchmark datasets. Its results show that the AUC scoring and run time