东北大学学报（自然科学版）

东北大学学报(自然科学版) ›› 2010, Vol. 31 ›› Issue (7): 933-937.DOI: -

• 论著 • 上一篇    下一篇

基于主成分分析和决策树的入侵检测方法

刘勇;孙东红;陈友;王宛山;   

  1. 东北大学机械工程与自动化学院;清华大学信息工程研究网络中心;中国科学院计算技术研究所;
  • 收稿日期:2013-06-20 修回日期:2013-06-20 出版日期:2010-07-15 发布日期:2013-06-20
  • 通讯作者: -
  • 作者简介:-
  • 基金资助:
    国家高技术研究发展计划项目(2007AA01Z444,2007AA01Z474,2007AA010501,2007AA01Z467);;

An intrusion detection method based on principal component analysis and decision tree

Liu, Yong (1); Sun, Dong-Hong (2); Chen, You (3); Wang, Wan-Shan (1)   

  1. (1) School of Mechanical Engineering and Automation, Northeastern University, Shenyang 110004, China; (2) Network Research Center, Tsinghua University, Beijing 100084, China; (3) Institute of Computing Technology, The Chinese Academy of Sciences, Beijing 100190, China
  • Received:2013-06-20 Revised:2013-06-20 Online:2010-07-15 Published:2013-06-20
  • Contact: Sun, D.-H.
  • About author:-
  • Supported by:
    -

RichHTML

0

PDF (PC)

872

摘要： 特征选择算法能够更好地提高入侵检测系统的检测速度和检测效果,消除冗余数据并减轻噪音特征.结合特征选择算法的优势,提出一种基于主成分分析(PCA)与决策树(C4.5)的入侵检测方法,进而构建出轻量级的入侵检测系统.通过在KDD1999数据集上对该方法进行详细的实验验证,证明该方法一方面确保系统有较高的检测率与较低误报率,另一方面能够比较显著地提高系统的训练时间与测试时间.同时,通过比较实验发现此方法在训练时间、测试时间、检测率、误报率上的效果也优于GA-SVM方法.

关键词: 入侵检测, 主成分分析, 决策树, 特征选择, GA-SVM

Abstract: A feature selection algorithm can improve efficiently the detection speed and result, with irrelevant and redundant data eliminated and denoised in an intrusion detection system. Taking advantage of the algorithm, a new hybrid feature selection algorithm based on the principal component analysis (PCA) in combination with decision tree algorithm (C4.5) was proposed to develop a lightweight intrusion detection system. Verifying the proposed algorithm in detail via tests with the KDD 1999 dataset, the algorithm was proved that it is available to not only ensure the high detection rate and low false alarm rate but also improve obviously the training/testing time of the intrusion detection system. Furthermore, as a result of comparative tests, the algorithm is superior to GA-SVM algorithm in training/testing time, detection rate and false alarm rate.

中图分类号: