TCM-KNN网络异常检测算法优化研究

基于TCM-KNN(transductive confidence machine for K-nearest neighbors)网络异常检测方法,采用过滤器模式的特征选择方法和基于聚类的样本选择方法分别从精简异常检测的特征空间以及选择使用少量高质量的训练样本进行训练,从而高效地对网络异常进行检测.基于著名的KDD Cup 1999数据集的实验表明:这2种优化方法在保证TCM-KNN异常检测算法高检测率和低误报率的前提下,极大地减少了该算法的训练开销和检测开销,因而该轻量级检测方法适用于现实的网络应用环境.

Research on performance optimizations for TCM-KNN network anomaly detection algorithm

Based on TCM-KNN (transductive confidence machine for K-nearest neighbors) algorithm, the filter-based feature selection and cluster-based instance selection methods were used towards optimizing it as a lightweight network anomaly detection scheme, which not only reduced its complex feature space, but also acquired high quality instances for training. A series of experimental results demonstrate the two methods for optimizations are actually effective in greatly reducing the computational costs while ensuring high detection performances for TCM-KNN algorithm. Therefore, the two methods make TCM-KNN be a good scheme for a lightweight network anomaly detection in practice.