关键词: 入侵检测, 非负矩阵分解, 可视化

Abstract: The curse of dimensionality would arise when high dimensional network connection records are directly processed. So it is usually required to reduce dimensionality of the records. Non-negative matrix factorization not only can reduce dimensionality, but also makes all elements in the factor matrices non-negative, which corresponds to the semantic feature of the network connection records. After high dimensional network connection records are projected into low dimensional visual space by non-negative matrix factorization, network connection records are represented as scatter dots in low dimensional space. The class to which the record belongs is determined by observing the location of the scatter dot, and intrusion detection is visualized. Experiments demonstrate the effectiveness of this intrusion detection method.

Key words: intrusion detection, non-negative matrix factorization, visualization