| 工业网络流量异常检测的概率主成分分析法 |
| |
| 引用本文： | 侯重远,江汉红,芮万智,刘亮.工业网络流量异常检测的概率主成分分析法[J].西安交通大学学报,2012(2):70-75. |
| |
| 作者姓名： | 侯重远 江汉红 芮万智 刘亮 |
| |
| 作者单位： | 海军工程大学电气与信息工程学院 |
| |
| 基金项目： | 国家自然科学基金创新研究群体科学基金资助项目(50421703) |
| |
| 摘 要： | 针对主成分分析(PCA)法用于工业测控网络流量异常检测时存在的误报率高的问题,提出了一种基于概率主成分分析(PPCA)的检测算法.首先通过分析误报成因,建立了工业测控网络流量矩阵的PPCA模型,然后使用迭代变分贝叶斯算法辨识该模型的参数,再利用模型参数估计值求解流量矩阵的秩的分布函数并得到秩的极大似然估计值,最后以秩的跃变状况为判据进行异常流量检测.模拟攻击实验表明,该方法使漏报率平均下降了32%,从而有效降低了PCA方法的误报率.
|
| 关 键 词： | 工业网络 流量异常检测 主成分分析 误报率 变分贝叶斯 |
A Probabilistic Principal Component Analysis Approach for Detecting Traffic Anomaly in Industrial Networks |
| |
| HOU Chongyuan,JIANG Hanhong,RUI Wanzhi,LIU Liang.A Probabilistic Principal Component Analysis Approach for Detecting Traffic Anomaly in Industrial Networks[J].Journal of Xi'an Jiaotong University,2012(2):70-75. |
| |
| Authors: | HOU Chongyuan JIANG Hanhong RUI Wanzhi LIU Liang |
| |
| Institution: | (College of Electric and Information Engineering,Naval University of Engineering,Wuhan 430033,China) |
| |
| Abstract: | An algorithm using probabilistic principal component analysis(PPCA) is proposed to reduce the false alarm rate of anomaly detection of industrial networks using traditional principal component analysis(PCA).A PPCA model of industrial network traffic matrix is established by analyzing the causes of false alarm.Parameters in the model are identified by using the iterative variational Bayesian algorithm,and then are used to infer the rank of the PPCA model.Traffic anomaly is finally detected by making judgement on the rank.Simulated attack experiments show that the proposed method decreases false alarm rate by 32% in average,and effectively reduces the false alarm rate of PCA method. |
| |
| Keywords: | industrial networks traffic anomaly detection principal component analysis false alarm rate variational Bayesian method |
| 本文献已被 CNKI 等数据库收录！ |
