基于多次随机映射和EM算法的异常流量检测
首发时间:2020-01-14
摘要:针对传统异常检测算法实时性差、正确识别率低且误判率高等问题,本文提出一种多次随机映射以及无监督聚类算法相组合的改良算法。利用随机映射进行网络数据包的汇聚,以获取待测对象的时间序列;对各流量序列进行EM聚类检测得到多个待定异常集;对待定异常集进行交集操作,从中得出最终异常对象集。实验表明,改进算法具有较高的准确率和低误判率,能够有效检测网络中的异常数据。
For information in English, please click here
Network Traffic Detection Based on Multiple Random Projections and EM
Abstract:ITo solve the problems including poor real time,low true positive rate and high false positive rate of traditional anomaly detection methods,a new combination method is adopted,which integrates multiple random projections and unsupervised clustering algorithm.We first aggregated network traffic by using random projection to get time series of object.Then,EM clustering detection was applied with traffic series to get multiple alarm sets.We next exploited the intersection operation to determine final anomaly set.Last,based on ISCX we experimented with dataset and obtained the conclusion that the new detection method has higher true positive ratio and lower false positive ratio and can detect anomaly of network.
Keywords: Network traffic;Anomaly detection;Random projection;Clustering
基金:
引用
No.****
同行评议
共计0人参与
勘误表
基于多次随机映射和EM算法的异常流量检测
评论
全部评论0/1000