基于非监督学习的入侵分析新方法

提出一种新的基于非监督学习的入侵分析方法.该方法具有发现未知攻击类型的能力,既可以作为独立的分析方法使用,又可以作为基于数据融合的入侵检测的一个分析引擎.在该方法中,核心非监督学习算法采用最大最小距离算法,同时融合非线性的归一化预处理和非数值型特征的有效编码等技术.与同类方法相比,该方法检测率较高,尤其是对于DoS和Probing两大类攻击效果更好.

New Intrusion Detection Method Based on Unsupervised Learning

A new detection method based on unsupervised learning was designed and implemented,which had the ability of discovering unknown kinds of attacks.It could be used not only as an independent analysis method,but also as an IDE(Intrusion Detection Engine) in intrusion detection based on data fusion.In method,max-min distance algorithm was employed as the core clustering algorithm,and some other techniques were also involved,such as nonlinear normalization pretreatment,efficiency coding of non-numerical feature etc.Its detection rate is distinctively higher than that of similar methods under the same experimental conditions,at the same false positive rate,especially for attacks from DoS and Probing.