基于主动学习的非均衡异常数据分类算法研究

doi:10.3969/j.issn.1671-1122.2017.10.007

摘要/Abstract

摘要：

目前,网络安全正面临着越来越复杂的挑战。随着攻击方式和类型的多样化,其破坏程度也在不断增加,网络防护要求已经从单一被动的方式,转为数据融合技术下的主动的网络态势感知,因此,对于异常数据分类的研究仍然十分重要。然而,传统的分类算法在面临非均衡数据时,只考虑了算法正确率的提升,忽视了少数类的分类效果,从而容易导致对攻击和漏洞信息的误判,并且对于新的异常类型的识别效率不够理想。文章针对上述问题,首先,采用主动学习的采样方法提高了算法在大量样本中的学习效率;然后,基于组合类器的思想对分类算法进行改进,利用误分类代价函数增加算法对少数类的分类精度;最后,通过实验仿真将文中方法和传统方法进行对比,验证提出方法的可行性和有效性。

关键词: 网络安全, 非均衡分类, 主动学习, 代价函数, 组合分类

Abstract:

Network security is facing increasingly complex challenges. With the diversification of attack methods and types, the extent of damage is also increasing; network protection requirements have been from a single passive approach to data fusion of active network technology under the situation awareness. Therefore, for the study of abnormal data classification is still very important. However, the traditional classification algorithm in the face of unbalanced data, only consider the algorithm accuracy, ignoring the classification effect of the minority class, thus easily lead to attacks and vulnerabilities of false positives, and for the new type of abnormal recognition efficiency is not ideal. Aiming at the above problems, firstly, this paper uses the sampling method of active learning algorithm to improve the learning efficiency in a large number of samples; then, the classification algorithm is improved based on the idea of the combination classifier, and the classification accuracy of the algorithm is increased by using the misclassification cost function; finally, the feasibility and effectiveness of the proposed method are verified by comparing the proposed method with the traditional method.

Key words: network security, imbalanced classification, active learning, cost function, combination classification

中图分类号:

TP309

王波, 王怀彬. 基于主动学习的非均衡异常数据分类算法研究[J]. 信息网络安全, 2017, 17(10): 42-49.

Bo WANG, Huaibin WANG. Research on Imbalanced Abnormal Data Classification Algorithm Based on Active Learning[J]. Netinfo Security, 2017, 17(10): 42-49.

图/表 10

图1

图2

图3

图4

表1

图5

表2

表3

图6

图7

参考文献 20

[1]	CHAWLA N V, BOWYER K W, HALL L O, et al.SMOTE: Synthetic Minority over-sampling Technique[J]. Journal of Artificial Intelligence Research, 2011, 16(1):321-357.
[2]	LIU Yang, AN Aijun, HUANG Xiangji.Boosting Prediction Accuracy on Imbalanced Datasets with SVM Ensembles[C]//Springer. 10th Pacific-Asia Conference on Advances in Knowledge Discovery and Data Mining, April 9-12, 2006, Singapore. Heidelberg: Springer, 2006: 107-118.
[3]	VEROPOULOS K, CAMPBELL C, CRISTIANINI N. Controlling the Sensitivity of Support Vector Machines[EB/OL]. https://www.researchgate.net/publication/2617438_Controlling_the_Sensitivity_of_Support_Vector_Machines, 2017-4-11.
[4]	WANG B X, JAPKOWICZ N.Boosting Support Vector Machines for Imbalanced Data Sets[C]//Springer. 17th International Conference on Foundations of Intelligent Systems, May 20-23, 2008, Toronto, Canada. Heidelberg: Springer, 2008: 38-47.
[5]	AKBANI R, KWEK S, JAPKOWICZ N.Applying Support Vector Machines to Imbalanced Datasets[C]//Spring. 15th European Conference on Machine Learning, September 20-24, 2004, Pisa, Italy. Heidelberg: Springer, 2004: 39-50.
[6]	吴晓平,周舟,李洪成. Spark框架下基于无指导学习环境的网络流量异常检测研究与实现[J]. 信息网络安全,2016(6):1-7.
[7]	KANG P, CHO S.EUS SVMs: Ensemble of Under-Sampled SVMs for Data Imbalance Problems[C]//Springer. 13th International Conference on Neural Information Processing, October 3-6, 2006, Hong Kong, China. Heidelberg: Springer, 2006: 837-846.
[8]	李鹏,王晓龙,刘远超,等. 一种基于混合策略的失衡数据集分类方法[J]. 电子学报,2007,35(11):2161-2165.
[9]	IMAM T, KAI M T, KAMRUZZAMAN J.Z-SVM: An SVM for Improved Classification of Imbalanced Data[C]//Springer. 19th Australian Joint Conference on Artificial Intelligence: Advances in Artificial Intelligence, December 4-8, 2006, Hobart, Australia. Heidelberg: Springer, 2006: 264-273.
[10]	LÓPEZ V, FERNÁNDEZ A, GARCÍA S, et al. An Insight into Classification with Imbalanced Data: Empirical Results and Current Trends on using Data Intrinsic Characteristics[J]. Information Sciences, 2013, 250(11): 113-141.
[11]	DATTA S, DAS S. Near-Bayesian Support Vector Machines for Imbalanced Data Classification with Equal or Unequal Misclassification Costs[EB/OL]. , 2017-2-22.
[12]	XU Yitian, YANG Zhiji, ZHANG Yuqun, et al.A Maximum Margin and Minimum Volume Hyper-spheres Machine with Pinball Loss for Imbalanced Data Classification[J]. Knowledge-Based Systems, 2016, 95(C): 75-85.
[13]	何明亮,陈泽茂,左进. 基于多窗口机制的聚类异常检测算法[J]. 信息网络安全,2016(11):33-39.
[14]	任晓芳,赵德群,秦健勇. 基于随机森林和加权K均值聚类的网络入侵检测系统[J]. 微型电脑应用,2016,32(7):21-24.
[15]	韩亮. 基于随机森林的行人检测算法研究[D]. 北京:北方工业大学,2014.
[16]	杨连群,温晋英,刘树发,等. 一种改进的图分割算法在用户行为异常检测中的应用[J]. 信息网络安全,2016(6):35-40.
[17]	丁文彬. 基于决策树分类的网络异常流检测与过滤[D]. 成都:电子科技大学,2013.
[18]	赵强利,蒋艳凰. 类别严重不均衡应用的在线数据流学习算法[J]. 计算机科学,2017,44(6):255-259.
[19]	胡洋瑞,陈兴蜀,王俊峰,等. 基于流量行为特征的异常流量检测[J]. 信息网络安全,2016(11):45-51.
[20]	李诒靖,郭海湘,李亚楠,等. 一种基于Boosting的集成学习算法在不均衡数据中的分类[J]. 系统工程理论与实践,2016,36(1):189-199.