粗糙集属性约简的极限学习机网络入侵检测算法

针对网络入侵数据量大、属性冗余及属性之间线性相关导致分类算法计算速度慢、准确度不高等问题,提出一种改进粗糙集属性约简的极限学习机网络入侵分类算法。对训练集采用粗糙集正域和分辨矩阵相结合的方法获得属性核,筛选出只有属性核的数据集得到无冗余属性的特征集合;使用极限学习机(ELM)作为分类模型进行分类,使用支持向量机(SVM)、神经网络、极限学习机比较证明提出方法的有效性,为网络入侵检测提供一种新的解决方法。     

A hybrid genetic algorithm for feature subset selection in rough set theory

Rough set theory has been proven to be an effective tool to feature subset selection. Current research usually employ hill-climbing as search strategy to select feature subset. However, they are inadequate to find the optimal feature subset since no heuristic can guarantee optimality. Due to this, many researchers study stochastic methods. Since previous works of combination of genetic algorithm and rough set theory do not show competitive performance compared with some other stochastic methods, we propose a hybrid genetic algorithm for feature subset selection in this paper, called HGARSTAR. Different from previous works, HGARSTAR embeds a novel local search operation based on rough set theory to fine-tune the search. This aims to enhance GA’s intensification ability. Moreover, all candidates (i.e. feature subsets) generated in evolutionary process are enforced to include core features to accelerate convergence. To verify the proposed algorithm, experiments are performed on some standard UCI datasets. Experimental results demonstrate the efficiency of our algorithm.     

融合邻域粗糙集与粒子群优化的网络入侵检测

入侵检测数据往往含有大量的冗余、噪音特征及部分连续型属性,为了提高网络入侵检测的效果,利用邻域粗糙集对入侵检测数据集进行属性约简,消除冗余属性及噪声,也避免了传统粗糙集在连续型属性离散化过程中带来的信息损失;使用粒子群算法优化支持向量机的核函数参数和惩罚参数,以避免靠主观选择参数带来精度较低的风险,进一步提高入侵检测的性能。仿真实验结果表明,该算法能有效提高入侵检测的精度,具有较高的泛化性和稳定性。     

基于GA-PSO的粗糙集属性约简算法

属性约简是粗糙集合研究的重要内容之一。为了能够有效地获取决策表中属性最小相对约简,提出了一种基于GA-PSO的属性约简算法。该算法以条件属性对决策属性的支持度为基础,求解核属性,把所有的条件属性(除去核属性)加入粒子群算法的初始种群中,并用遗传算法对不满足适应度条件的粒子进行交叉变异操作。实验结果表明,该算法在加强局部搜索能力的同时保持了该算法全局寻优的特性,能够快速有效地获得最小相对属性集。     

基于粗糙集的故障诊断特征提取

故障的特征提取对于进行准确可靠的诊断非常重要。而实际的故障诊断数据样本的分类边界常常是不确定的,并且故障与征兆之间的关系往往也是不确定的。粗糙集理论是处理模糊和不确定性问题的新的数学工具。论文将粗糙集理论引入到故障诊断特征提取,提出了一种基于粗糙集的故障诊断特征提取方法。并通过两个故障诊断实例对该方法进行了验证。结果表明:在有效地保持故障诊断分类结果的情况下,该方法可以提取出最能反映故障的特征,从而为粗糙集在故障诊断中的深入应用打下了基础。     

改进粗糙集属性约简结合K-means聚类的网络入侵检测方法

面对日益复杂的网络环境,传统入侵检测方法误报率高、检测效率低,且存在优化过程中准确性和可解释性相互矛盾等问题,因此提出一种结合改进粗糙集属性约简和K-means聚类的网络入侵检测（IRSAR-KCANID）方法。首先基于模糊粗糙集属性约简对数据集进行预处理,优化异常的入侵检测特征;再利用改进K-means聚类算法估计入侵范围阈值,并对网络特征进行分类;然后根据用于特征优化的线性规范相关性,从所选择的最优特征探索特征关联影响尺度以形成特征关联影响量表,完成对异常网络入侵的检测。实验结果表明,特征优化聚类后的最小化测量特征关联影响量表能在保证最大预测精度的前提下,最小化入侵检测过程的复杂度并缩短完成时间。     

Neighborhood rough set based heterogeneous feature subset selection

Feature subset selection is viewed as an important preprocessing step for pattern recognition, machine learning and data mining. Most of researches are focused on dealing with homogeneous feature selection, namely, numerical or categorical features. In this paper, we introduce a neighborhood rough set model to deal with the problem of heterogeneous feature subset selection. As the classical rough set model can just be used to evaluate categorical features, we generalize this model with neighborhood relations and introduce a neighborhood rough set model. The proposed model will degrade to the classical one if we specify the size of neighborhood zero. The neighborhood model is used to reduce numerical and categorical features by assigning different thresholds for different kinds of attributes. In this model the sizes of the neighborhood lower and upper approximations of decisions reflect the discriminating capability of feature subsets. The size of lower approximation is computed as the dependency between decision and condition attributes. We use the neighborhood dependency to evaluate the significance of a subset of heterogeneous features and construct forward feature subset selection algorithms. The proposed algorithms are compared with some classical techniques. Experimental results show that the neighborhood model based method is more flexible to deal with heterogeneous data.     

基于粗糙集与小生境GA的网络入侵规则提取

对网络入侵规则的提取采用了一种基于ROUGH集和小生境GA结合的方法。该方法是利用粗糙集把原始数据进行处理,获得决策规则,并把这些决策规则作为小生境GA的初始种群,最后通过进化得到有较广覆盖范围和较高可信度的入侵检测规则集。     

Towards accurate intrusion detection based on improved clonal selection algorithm

Artificial immune system constructs a dynamic and adaptive information defense system through a function similar to the biological immune system. In order to resist the external invasion of useless and harmful information and ensure the effectiveness and the harmlessness of received information. Due to the low accuracy and the high false positive rate of the existing clonal selection algorithms applied to intrusion detection, in this paper, we propose an improved clonal selection algorithm. The improved method detects the intrusion behavior by selecting the best individual overall and cloning them. Experimental results show that the improved algorithm achieves very good performance when applied to intrusion detection. And it is shown that the algorithm is better than BP neural network with its 99.5 % accuracy and 0.1 % false positive rate.     

基于遗传算法的入侵检测特征选择*

针对入侵检测日志数据存在大量不相关特征和冗余特征,导致入侵检测数据集维数较高,检测算法实时性较低的问题,提出一种基于遗传算法的入侵检测特征选择算法。首先删除入侵检测数据集中的不相关特征及冗余特征,构建有效特征集L,并通过偏F检验对特征进一步选择,构成待优化特征集L’;然后采用遗传算法对L’进行优化选择,选出最能反映系统状态的特征集L″。仿真实验结果证明,该算法在保证特征分类精度和确保入侵检测漏检率、误检率尽量小的前提下明显提高了入侵检测的效率。     

Enhancing SVM performance in intrusion detection using optimal feature subset selection based on genetic principal components

Intrusion detection is very serious issue in these days because the prevention of intrusions depends on detection. Therefore, accurate detection of intrusion is very essential to secure information in computer and network systems of any organization such as private, public, and government. Several intrusion detection approaches are available but the main problem is their performance, which can be enhanced by increasing the detection rates and reducing false positives. This issue of the existing techniques is the focus of research in this paper. The poor performance of such techniques is due to raw dataset which confuse the classifier and results inaccurate detection due to redundant features. The recent approaches used principal component analysis (PCA) for feature subset selection which is based on highest eigenvalues, but the features corresponding to the highest eigenvalues may not have the optimal sensitivity for the classifier due to ignoring many sensitive features. Instead of using traditional approach of selecting features with the highest eigenvalues such as PCA, this research applied a genetic algorithm to search the genetic principal components that offers a subset of features with optimal sensitivity and the highest discriminatory power. The support vector machine (SVM) is used for classification purpose. This research work used the knowledge discovery and data mining cup dataset for experimentation. The performance of this approach was analyzed and compared with existing approaches. The results show that proposed method enhances SVM performance in intrusion detection that outperforms the existing approaches and has the capability to minimize the number of features and maximize the detection rates.     

MapReduce based parallel fuzzy-rough attribute reduction using discernibility matrix

Fuzzy-rough set theory is an efficient method for attribute reduction. It can effectively handle the imprecision and uncertainty of the data in the attribute reduction. Despite its efficacy, current approaches to fuzzy-rough attribute reduction are not efficient for the processing of large data sets due to the requirement of higher space complexities. A limited number of accelerators and parallel/distributed approaches have been proposed for fuzzy-rough attribute reduction in large data sets. However, all of these approaches are dependency measure based methods in which fuzzy similarity matrices are used for performing attribute reduction. Alternative discernibility matrix based attribute reduction methods are found to have less space requirements and more amicable to parallelization in building parallel/distributed algorithms. This paper therefore introduces a fuzzy discernibility matrix-based attribute reduction accelerator (DARA) to accelerate the attribute reduction. DARA is used to build a sequential approach and the corresponding parallel/distributed approach for attribute reduction in large data sets. The proposed approaches are compared to the existing state-of-the-art approaches with a systematic experimental analysis to assess computational efficiency. The experimental study, along with theoretical validation, shows that the proposed approaches are effective and perform better than the current approaches.

     

基于粗集理论的属性约简改进算法

粗集理论是一种处理不确定,不一致数据的新的数学工具.属性约简是粗集理论研究的重要内容,是在保持信息系统分类能力不变的基础上,删除冗余属性.而求取最优约简是一个NP难题,为了能够有效地获取信息系统的约简,提出一种改进算法.该算法以知识量作为启发式信息,每次删除知识量小的属性,直到找到约简为止.分析及实例表明此算法具有有效性.     

基于粗糙集与改进LSSVM的入侵检测算法研究

提出了基于粗糙集和改进最小二乘支持向量机的入侵检测算法。算法利用粗糙集理论的可辨识矩阵对样本属性进行约简,减少样本维数;利用稀疏化算法对最小二乘支持向量机进行改进,使其既具备稀疏化特性又具备快速检测的特点,提高了数据样本分类的准确性。结合算法不仅充分发挥粗糙集对数据有效约简和支持向量机准确分类的优点,同时克服了粗糙集在噪声环境中泛化性较差,支持向量机识别有效数据和冗余数据的局限性。通过实验证明,基于粗糙集和改进最小二乘支持向量机的入侵检测算法的检测精度高,误报率和漏报率较低,检测时间短,验证了算法的实效性。     

基于Rough Set的属性值约简算法研究

从逻辑的角度分析了属性值约简的本质及过程,在此基础上构造辨识矩阵,提出了一种基于Rough set的属性值约简新算法,并对此进行了证明。该算法比以往的算法更简便、直观,易于编程实现,也更易从本质上理解属性值约简的实质及过程,并且算法不破坏决策系统中的不一致规则所蕴含的信息量。实例分析表明该算法是有效可行的。     

基于粗糙集和遗传约简算法的入侵检测方法

采用改进的贪心算法和遗传算法结合的混合遗传算法进行属性约简,并利用值约简后生成的入侵检测规则,提出一种基于粗糙集理论和遗传约简算法的入侵检测方法。基于KDDCUP99数据集的实验表明该方法取得了良好的入侵检测效果,并且改进的混合遗传算法生成约简的速度更快。     

一种基于粗糙集理论的数据库入侵检测模型

提出了一种可以检测数据库管理系统中异常事务入侵检测模型.该模型运用粗糙集理论从用户历史会话中提取用户正常行为轮廓,并利用散列算法来加速SQL模板的匹配,既可以有效检测异常事务,又可以避免因为一两次误用而把无辜的用户误认为是恶意攻击者.对模型的性能做了测试和分析.     

基于模糊邻域粗糙集的启发式属性约简算法

属性约简是机器学习等领域中常用的数据预处理方法。在基于粗糙集理论的属性约简算法中,大多是根据单一的方法来度量属性重要度。为了从多角度对属性达到更为优越的评估效果,首先在已有的模糊邻域粗糙集模型中定义属性依赖度度量,然后根据粒计算理论中知识粒度的概念,在模糊邻域粗糙集模型下提出了模糊邻域粒度度量。由于属性依赖度和知识粒度代表了不同视角的属性评估方法,因此将这两种方法结合起来用于信息系统的属性重要度评估,最后给出一种启发式属性约简算法。实验结果表明,所提出的算法具有较好的属性约简性能。     

基于回溯搜索算法的决策粗糙集属性约简

属性约简是粗糙集理论的核心问题,为了获得更多更稳定的最小属性约简,根据决策粗糙集模型将最小属性约简问题转化为决策风险最小化问题,并给出了新的适应度函数计算方法;在此基础上利用回溯搜索算法较强的全局搜索性能,提出了基于回溯搜索算法的决策粗糙集属性约简算法;对UCI数据集的实验结果以及与其他约简算法的比较表明,该算法能够得到更多的最小属性约简,而且能够在多次运行中保持约简结果个数的稳定性。     

基于改进遗传算法的粗糙集属性约简算法

属性约简是粗糙集理论研究的主要内容之一,为了能够有效地获取决策表中属性最小约简,在分析属性约简的方法与遗传算法的基础上,将属性重要性度量作为启发式信息引入遗传算法,提出了一种启发式遗传算法.通过构造新的变异算子来引入启发式信息,体现了启发式信息的局部搜索技术,使得算法既保持整体优化特性,又具有较快的收敛速度.实验结果表明,该方法能快速有效地求出决策表的最小约简.