基于相关特征矩阵和神经网络的异常检测研究

文章描述了一个基于相关特征矩阵和神经网络的异常检测方法。该方法首先创建用户轮廓以定义用户正常行为,然后比较当前行为与用户轮廓的相似度,判断输入是正常或入侵。为了避免溢出和减少计算负担,使用主成分分析法提取用户行为的主要特征,而神经网络用于识别合法用户或入侵者。在性能测试实验中,系统的检测率达到74.6%,而误报率为2.9%。在同样的数据集和测试集的情况下,与其它方法相比,此方法的检测性能最优。

A Study on Anomaly Detection Method Based on Correlation Eigen Matrix and Neural Network

This article presents an anomaly detection method based on correlation eigen matrix and neural network.The method first creates a profile defining a normal user's behavior,and then compares the similarity of a current behavior with the created profile to decide whether the input instance is valid user or not.In order to avoid overfitting and reduce the computational burden,user behavior principal features are extracted by the(PCA) method.The neural network is used to distinguish valid user or intruder after training procedure has been completed by unsupervised learning and supervised learning.In the experiments for performance evaluation the system achieves a correct detection rate equal to 74.6% and a false detection rate equal to 2.9%,which is consistent with the best results reports in the literature for the same data set and testing paradigm.