一种新的半监督入侵检测方法

针对基于监督的入侵检测算法在现实网络环境中通常面临的训练样本不足的问题,提出了一种基于纠错输出编码的半监督多类分类入侵检测方法。该方法综合cop-kmeans算法的半监督思想,挖掘未标记数据中的隐含关系,扩大有标记正常网络数据的数量。该算法首先采用SVDD计算入侵检测各类别的可分程度,从而得到由不同子类构成的二叉树；然后分别对二叉树的各层节点进行编码并形成层次输出编码,得到最终的分类器。实验表明,该算法对各种类型的攻击具有更高的检测率,在现实网络环境中具有较好的实用性。

Novel Intrusion Detection Method Based on Semi-supervised Clustering

A new semi-supervised intrusion detection method based on error-correcting output codes was proposed to solve the difficulties which existing in intrusion detection algorithms based on supervised learning usually face when the training samples are insufficient.This method mines the relationship under the unlabeled data to enlarge the known labeled normal data by introducing the idea of semi-supervised cop-kmeans algorithm.Firstly,the SVDD is used to mea-sure the class separabilty quantitatively.Then the inter-class separability matrix is got gradually.The binary tree is built based on the matrixes from the bottom to the up.Each node of the binary tree is encoded by level to get the final hierarchical error-correcting output codes and classifiter.The experiments in KDD Cup 1999 network data sets prove that the method has better performance in detection accuracy and good adaptability in the real network environment.