基于贝叶斯树和集成学习的异常检测

基于贝叶斯树和集成学习的异常检测 Anomaly Detection Based on Bayesian Tree Algorithm and Integrated Learning 姚武军 YAO Wujun 1 first-author 魏彬 Wei Bin 1 武警工程大学电子技术系 武警工程大学电子技术系 Department of Electronic Technology,Engineering University of Chinese Armed Police Force Department of Electronic Technology,Engineering University of Chinese Armed Police Force 为解决入侵检测中朴素贝叶斯算法的高数据内部依赖性和决策树容易产生数据"破碎"的问题,本文结合决策树分段的优点和朴素贝叶斯多证据融合的优点,建立了基于贝叶斯树算法的进程服务预测模型,并将bagging集成学习法用于改进贝叶斯树.实验结果表明,模型能有效检测主机异常,且算法的时间复杂度相对较低,适合在线检测. In intrusion detection,in order to solve the problem of high data dependence of Naive Bayesian algorithm and decision tree is easy to generate data fragmentation,this paper combines the advantages of decision tree segmentation and naive Bayesian multi-evidence integration advantages,using Native APIs sequence generated by the key process,establish prediction model of process service based on Bayesian tree algorithm,and improve prediction model based on Bayesian tree algorithm uses Bagging ensemble learning algorithm.The experimental results show that,the model can effectively detect the anomaly,and the time complexity of the algorithm is low,suitable for online detection. 入侵检测 贝叶斯树 集成学习 本地系统服务 10.14188/j.1671-8836.2014.06.008 TP393.08 国家自然科学基金资助项目（61272492） 2014-06-01 2021-04-01 6 60