计算机工程与应用 ›› 2006, Vol. 42 ›› Issue (21): 21-.

• 博士论坛 • 上一篇    下一篇

一种基于聚类和主成分分析的异常检测方法

汪阳,黄天戍,杜广宇   

  1. 武汉大学电子信息学院
  • 收稿日期:2006-02-08 修回日期:1900-01-01 出版日期:2006-07-21 发布日期:2006-07-21
  • 通讯作者: 汪阳 powerflow

An Anomaly Detection Method Based on Principal Component Analysis

,,   

  1. 武汉大学电子信息学院
  • Received:2006-02-08 Revised:1900-01-01 Online:2006-07-21 Published:2006-07-21

摘要: 提出了一种基于主成分分析的异常检测方法,该方法利用聚类分析将训练数据划分为不同的子集,从而得到正常模式在特征空间中的分布,然后利用主成分分析来提取各行为子集的特征轮廓,最后利用各子集的PCA变换矩阵进行检测。实验结果证明了基于主成分分析的异常检测方法的有效性。

关键词: 入侵检测, 异常检测, 主成分分析

Abstract: An anomaly detection method based on principal component analysis is proposed. The method partitions the train data set into several sub-sets to get the distribution of the normal pattern in feature space. Then it extracts the feature contour of each sub-set. Finally it detects behavior records by the PCA matrix of each sub-set. The results of the experiment show that the anomaly detection method based on principal component analysis is effective.

Key words: Intrusion detection, Anomaly detection, Principal Component Analysis