基于SVM和模糊逻辑的告警相关性分析

Alarm correlation analysis based on SVM and fuzzy logic

针对网络故障诊断中现有告警关联算法存在的网络动态适应性差、关联误报率高等问题,提出了一种基于支持向量机(support vector machine,SVM)和模糊逻辑的告警相关性分析算法。该算法在数据预处理部分采用滑动时间窗、时序模糊以及特征统计的方法解决了网络不确定性和数据格式规范化的问题,并通过SVM训练和识别完成相关性分析。DARPA攻击数据集测试结果表明,该算法误报、漏报率低,压缩率大,网络动态适应性好,提高了告警关联效率。

This paper proposed an alarm correlation algorithm based on support vector machine（SVM） and fuzzy logic to solve the problems of poor dynamic adaptability,high false alarm rate and so on,which were existing in the alarm correlation of network fault diagnosis.For the problems of network uncertainty and nonstandard data formats,sliding time window,fuzzy time series and feature statistics were employed in the data pre-processing part.The alarm correlation part was realized through the training and identificating of SVM.Experiment on DARPA intrusion detection evaluation data set shows that the algorithm has lower false alarm rate,higher compression ratio and better dynamic adaptability,which improve the efficiency of alarm correlation.