基于健壮主成分分类器的无监督异常检测方法研究

入侵检测系统在训练过程中需要大量有标识的监督数据进行学习，不利于其应用和推广，经典主成分分析方法对离群数据非常敏感，进而导致分类准确性的下降。为了解决该问题，提出了一种基于健壮主成分分类器的方法，得到被离群数据干扰较少的主成分。根据主成分空间距离和数据重构误差构建异常检测模型。实验表明：该方法能够有效检测未知入侵，在检测率、误警率方面都达到较满意的结果。

Novel unsupervised anomaly detection based on robust principal component classifier

Intrusion Detection System(IDS) needs a mass of labeled data in the process of training, which hampers the application and popularity of traditional IDS. Classical principal component analysis is highly sensitive to outliers in training data, and leads to the poor classification accuracy. A novel scheme based on robust principle component classifier was proposed, which obtained principal components that were not influenced much by outliers. An anomaly detection model was constructed from the distance in the principal component space and the reconstruction error of training data. The experiments show that the approach can detect unknown intrusions effectively, and has a good performance in detection rate and false positive rate.