网络异常检测精度问题分析与优化方法研究

Anomaly detection is able to detect unknown attacks in the Internet and scale to high-speed networks, so it also is an important area for both academic research as well as commercial interests. However, anomaly detectors are constrained by lower detection accuracy, so the performce of anomaly detectors does not meet the requirements. In-depth analyzing of the accuracy problems of anomaly detectors and proposing some optimization algorithms which are accurate and adaptive have an extremely important theoretical and practical significance. Proposed algorithms can be widely used in the protection of our national Cyberspace. The reasons which lead to poor performance are found and analysed; the cross-correlation about multi-anomaly scores of different anomaly detectors is mined and the multi-metrics correlation algorithm based on cross-correlations is proposed; the self-correlation about different windows of each anomaly detector is mined and the multi-windows correlation algorithm based on self-correlation is proposed; The correlation between the training dataset and the detection model is mined and the on-line training algorithm based on this correlation is proposed.

在网络安全领域，异常检测技术具有能够检测未知攻击和可扩展性好的优点，一直以来都是学术界和企业界关注的重点。但是异常检测技术受到检测精度较低的限制，其应用效果并不理想。深入分析异常检测面临的精度问题，研究出高精度、自适应的精度优化算法具有极其重要的理论和现实意义，在保障国家和大型企事业单位网络安全方面具有广阔应用前景。本项目将深入分析导致异常检测精度较差的原因；挖掘多种异常检测统计量之间存在的互相关性，重点研究基于多统计量互相关性的精度优化方法；挖掘单个异常检测统计量不同时刻取值之间存在的自相关性，重点研究基于统计量自相关性的精度优化方法；挖掘训练数据集和检测统计量模型之间的相关关系，重点研究基于统计量计算结果的实时在线训练过程优化方法。

在网络安全领域，异常检测技术具有能够检测未知攻击和可扩展性好的优点，一直以来都是学术界和企业界关注的重点。但是异常检测技术受到检测精度较低的限制，其应用效果并不理想。深入分析异常检测面临的精度问题，研究出高精度、自适应的精度优化算法具有极其重要的理论和现实意义，在保障国家和大型企事业单位网络安全方面具有广阔应用前景。本项目将深入分析导致异常检测精度较差的原因,从检测基本概率谬误、正常模式概念漂移、训练过程等过个方面进行了分析，在分析的基础上，提出了对应的检测精度优化意见；挖掘多种异常检测统计量之间存在的互相关性，重点研究基于多统计量互相关性的精度优化方法，提出了多统计量相关性检测精度优化方法；挖掘单个异常检测统计量不同时刻取值之间存在的自相关性，重点研在线训练过程优化方法，提出了实时在线训练过程优化方法。