| Anomaly Detection System Based on Principal Component Analysis and Support Vector Machine |
| |
| 引用本文： | LI Zhanchun LI Zhitang LIU Bin. Anomaly Detection System Based on Principal Component Analysis and Support Vector Machine[J]. 武汉大学学报:自然科学英文版, 2006, 11(6): 1769-1772. DOI: 10.1007/BF02831871 |
| |
| 作者姓名： | LI Zhanchun LI Zhitang LIU Bin |
| |
| 作者单位： | Network and Computing Center, Huazhong University of Science and Technology, Wuhan 430074, Hubei, China |
| |
| 摘 要： | This article presents an anomaly detection system based on principal component analysis （PCA） and support vector machine （SVM）. The system first creates a profile defining a normal behavior by frequency-based scheme, and then compares the similarity of a current behavior with the created profile to decide whether the input instance is norreal or anomaly. In order to avoid overfitting and reduce the computational burden, normal behavior principal features are extracted by the PCA method. SVM is used to distinguish normal or anomaly for user behavior after training procedure has been completed by learning. In the experiments for performance evaluation the system achieved a correct detection rate equal to 92.2% and a false detection rate equal to 2.8%.
|
| 关 键 词： | 异常检测 主成分分析 支持向量机 PCA SVM |
| 文章编号： | 1007-1202（2006）06-1769-04 |
| 收稿时间： | 2006-03-20 |
Anomaly detection system based on principal component analysis and support vector machine |
| |
| Li Zhanchun,Li Zhitang,Liu Bin. Anomaly detection system based on principal component analysis and support vector machine[J]. Wuhan University Journal of Natural Sciences, 2006, 11(6): 1769-1772. DOI: 10.1007/BF02831871 |
| |
| Authors: | Li Zhanchun Li Zhitang Liu Bin |
| |
| Affiliation: | (1) Nework and Computing Center, Huazhong University of Science and Technology, 430074 Wuhan, Hubei, China |
| |
| Abstract: | This article presents an anomaly detection system based on principal component analysis (PCA) and support vector machine (SVM). The system first creates a profile defining a normal behavior by frequency-based scheme, and then compares the similarity of a current behavior with the created profile to decide whether the input instance is normal or anomaly. In order to avoid overfitting and reduce the computational burden, normal behavior principal features are extracted by the PCA method. SVM is used to distinguish normal or anomaly for user behavior after training procedure has been completed by learning. In the experiments for performance evaluation the system achieved a correct detection rate equal to 92.2% and a false detection rate equal to 2.8%. |
| |
| Keywords: | anomaly detection principal component analysis (PCA) support vector machine (SVM) |
| 本文献已被 CNKI 维普 万方数据 SpringerLink 等数据库收录！ |
