关键词: 入侵取证, 朴素贝叶斯, 加权朴素贝叶斯, 信息增益, 特征冗余度, 属性加权

Abstract: Traditional Naive Bayes classification exists the issues of feature redundancy in intrusion forensics and neglects the difference between data attributes in different intrusion actions. For these issues, an improved Weighted Naive Bayes classification method by setting attribute weights is proposed. A new Information Gain algorithm based on feature redundancy is used to optimize the set of feature, then the discriminant of feature redundancy extracted as weights is introduced to Bayes classification algorithm based on this optimization results. The different condition attributes are weighted differently. The experimental results show that the new algorithm can effectively select features, reduce classification interference and improve detection accuracy.

Key words: intrusion forensics, Naive Bayes, Weighted Naive Baye, Information Gain, feature redundancy, attribute weighted