一种基于核PCA的网络流量异常检测算法

摘要

对各种网络数据流量的异常检测引起了人们的兴趣.网络数据流异常的检测和定位对于保障网络的稳定安全运行极为重要.基于主成份分析PCA(Principal component analysis)的网络异常检测算法虽然具有较好的检测性能,但是基于PCA的网络异常检测算法前提是假设网络流量数据满足高斯分布,且对网络数据的非线性结构表示无能为力.为了解决该问题,引入核函数空间,提出一种基于核主成分分析的在线网络流量异常检测算法.该算法以矩阵分解的方式构建正常子空间和异常子空间,并实现网络流量异常的检测.仿真实验分析表明,该算法取得了很好的检测性能.%Anomaly detection of various network data traffic has aroused people's interest.Network data flow anomaly detection and positioning of the network for the safe and secure operation is extremely important.Although PCA-based network anomaly detection algorithm has good detection performance, the premise of PCA-based algorithm is that it assumes that the network data satisfies the Gauss distribution and it cannot describe the nonlinear capability of network data.To address this problem,a new algorithm for online traffic anomaly detection based on kernel principal component analysis was proposed by taking advantages of kernel function space.In this work,the normal subspace and the abnormal subspace were constructed by matrix decomposition,and the detection of the network traffic anomaly was implemented. Simulation results showed that the proposed algorithm had good performance.