Abstract: Traditional Naive Bayes classification exists the issues of feature redundancy in intrusion forensics and neglects the difference between data attributes in different intrusion actions. For these issues, an improved Weighted Naive Bayes classification method by setting attribute weights is proposed. A new Information Gain algorithm based on feature redundancy is used to optimize the set of feature, then the discriminant of feature redundancy extracted as weights is introduced to Bayes classification algorithm based on this optimization results. The different condition attributes are weighted differently. The experimental results show that the new algorithm can effectively select features, reduce classification interference and improve detection accuracy.

Key words: intrusion forensics, Naive Bayes, Weighted Naive Baye, Information Gain, feature redundancy, attribute weighted

摘要： 针对传统朴素贝叶斯分类模型在入侵取证中存在的特征项冗余问题，以及没有考虑入侵行为所涉及的数据属性间的差别问题，提出一种基于改进的属性加权朴素贝叶斯分类方法。用一种改进的基于特征冗余度的信息增益算法对特征项集进行优化，并在此优化结果的基础上，提取出其中的特征冗余度判别函数作为权值引入贝叶斯分类算法中，对不同的条件属性赋予不同的权值。经实验验证，该算法能有效地选择特征向量，降低分类干扰，提高检测精度。

关键词: 入侵取证, 朴素贝叶斯, 加权朴素贝叶斯, 信息增益, 特征冗余度, 属性加权