集成学习分布式异常检测方法-计算机工程与应用.PDF

Computer Engineering and Applications 计算机工程与应用 2011 ，47 （18） 9 集成学习分布式异常检测方法 1，2 1 周绪川 ，钟 勇 ZHOU Xuchuan1，2 ，ZHONG Yong1 1.中国科学院 成都计算机应用研究所，成都 610041 2.西南民族大学 计算机科学与技术学院，成都 610041 1.Chengdu Institute of Computer Applications ，Chinese Academy of Sciences ，Chengdu 610041 ，China 2.College of Computer Science and Technology ，Southwest University for Nationalities ，Chengdu 610041 ，China ZHOU Xuchuan ，ZHONG Yong.Distributed anomaly detection based on ensemble learning.Computer Engineering and Applications ，2011 ，47 （18）：9-12. Abstract ：Detecting anomalous behavior from terabytes of collected record data has emerged as a crucial component for many systems for data mining system.Very often ，processing record data collected from various locations or providers cannot be directly aggregated for anomaly analysis due to the proprietary nature of the data.This paper proposes a novel general framework for anomaly detection from distributed data sources that cannot be directly merged.In the proposed method ，anoma- ly detection algorithm is firstly applied to data from individual provider and then their results are combined.It investigates ten semi-supervised anomaly detection algorithms ，as well as four methods for combining anomaly detection results.The exper- iments performed on simulated data have shown that particular anomaly detection algorithms and combining methods are more suitable for the task of distributed anomaly detection than others. Key words ：data mining ；ensemble learning ；distributed ；anomaly detection 摘 要：研究了基于模型共享的集成学习分布式异常检测模型，采用多数投票、边界扩展、平均叠加和距离加权4 种不同的集成学 习方法得到全部的局部模型；采用交换本地数据挖掘模型的方式来实现数据共享，从而构造出一个总体的集成学习模型。从全 局的观点检测异常，减少了集中式检测所需数据的传输量，有效保护了数据提供者的隐私性。仿真实验结果表明，该方法的检测 性能与集中式检测的性能相当，甚至更好。 关键词：数据挖掘；集成学习；分布式；异常检测 DOI ：10.3778/j.issn. 1002-8331.2011.18.003 文章编号：1002-8331（2011 ）18-0009-04 文献标识码：A 中图分类号：TP391 异常检测是数据挖掘中重要的组成部分，它的主要任务