基于主元分析和互信息维数约简策略的网络入侵异常检测

摘要

Aim to high dimensional co-linearity problem of network intrusion anomaly detection model's input features and dynamic changes of network environment, a new fast anomaly detection model construction approach based on dimension reduction strategy using principal component analysis (PCA) and mutual information (MI) is proposed in this paper. At first, PCA based feature extraction method is used to extract independence latent features, to diminish co-linearity among these input variables. Then, MI based feature selection method is used to select important features from PCA extracted latent features. Thus, these independent features that have much relation to anomaly detection model's output are selected. At last, a kind of machine learning algorithm with fast learning speed, i.e., random vector function link (RVFL) net, is used to construct the ifnal intrusion detection model with these extract and selected features. Simulation results based on KDD99 data set show that the proposed method can extract and select features effectively with fast learning speed.%针对网络入侵异常检测模型输入特征的高维共线性问题,以及网络环境动态变化频繁等问题,文章提出基于主元分析(PCA)和互信息(MI)维数约简策略的快速网络入侵异常检测模型构建方法.该方法首先通过基于PCA的特征提取技术对输入变量进行潜在特征提取,消除变量间的共线性;然后采用基于MI的特征选择技术对PCA提取的潜在变量进行选择,进而实现与异常检测模型输出类别最为相关的相互独立的特征变量的选择;最后,以这些特征输入,基于具有较快学习速度的随机向量泛函联接(RVFL)网络建立检测模型.在国际KDD99数据集上的仿真实验表明所提方法能够合理提取和选择特征,具有较快的学习速度和较好的推广性.