网络异常检测精度问题分析与优化方法研究

项目名称： 网络异常检测精度问题分析与优化方法研究

项目编号： No.61303265

项目类型： 青年科学基金项目

立项/批准年度： 2014

项目学科： 自动化技术、计算机技术

项目作者： 郑黎明

作者单位： 中国人民解放军国防科学技术大学

项目金额： 23万元

中文摘要： 在网络安全领域，异常检测技术具有能够检测未知攻击和可扩展性好的优点，一直以来都是学术界和企业界关注的重点。但是异常检测技术受到检测精度较低的限制，其应用效果并不理想。深入分析异常检测面临的精度问题，研究出高精度、自适应的精度优化算法具有极其重要的理论和现实意义，在保障国家和大型企事业单位网络安全方面具有广阔应用前景。本项目将深入分析导致异常检测精度较差的原因；挖掘多种异常检测统计量之间存在的互相关性，重点研究基于多统计量互相关性的精度优化方法；挖掘单个异常检测统计量不同时刻取值之间存在的自相关性，重点研究基于统计量自相关性的精度优化方法；挖掘训练数据集和检测统计量模型之间的相关关系，重点研究基于统计量计算结果的实时在线训练过程优化方法。

中文关键词： 网络安全；异常检测；精度；相关性；优化

英文摘要： Anomaly detection is able to detect unknown attacks in the Internet and scale to high-speed networks, so it also is an important area for both academic research as well as commercial interests. However, anomaly detectors are constrained by lower detection accuracy, so the performce of anomaly detectors does not meet the requirements. In-depth analyzing of the accuracy problems of anomaly detectors and proposing some optimization algorithms which are accurate and adaptive have an extremely important theoretical and practical significance. Proposed algorithms can be widely used in the protection of our national Cyberspace. The reasons which lead to poor performance are found and analysed; the cross-correlation about multi-anomaly scores of different anomaly detectors is mined and the multi-metrics correlation algorithm based on cross-correlations is proposed; the self-correlation about different windows of each anomaly detector is mined and the multi-windows correlation algorithm based on self-correlation is proposed; The correlation between the training dataset and the detection model is mined and the on-line training algorithm based on this correlation is proposed.

英文关键词： Network security；Anomaly detection；Accuracy；Correlation；Optimization