Abstract: Aiming at the problem of high-dimensional data processing in IDS，a network anomaly detection approach based on neighborhood preserving is proposed in this paper，the prototype of which is anomaly detection method based on transduction scheme.The approach proposed in this paper could be used for dimension reduction，and thus reduce resource consumption during the procedure of Euclidean distance computing and then accelerate the detection algorithm.Simulation and experimental results based on famous KDD cup99 data set demonstrate that approach proposed in this paper outperforms other existing models based on principle component analysis and one-class support machine in detection rate while keeping lower false alarm rate.

Key words: neighborhood preserving, network anomaly detection, principle component analysis, dimension reduction

摘要： 针对入侵检测中的高维数据处理问题，以直推式网络异常检测方法为原型，提出了一种基于近邻保持降维方法的新模型。该模型能够用于高维数据的降维，从而减少欧氏距离的计算量，加快异常检测算法的训练及检测速度。采用著名的KDD cup99公用数据集的仿真实验表明，相比较基于主成分分析法和单类支持向量机的网络异常检测模型来说，基于近邻保持降维技术的检测模型能够在降维的同时，保持较高的检测率和较低的误报率。

关键词: 近邻保持, 网络异常检测, 主成分分析, 特征降维