基于改进属性加权的朴素贝叶斯入侵取证研究

Research of intrusion forensics based on improved attribute Weighted Naive Bayes

针对传统朴素贝叶斯分类模型在入侵取证中存在的特征项冗余问题,以及没有考虑入侵行为所涉及的数据属性间的差别问题,提出一种基于改进的属性加权朴素贝叶斯分类方法。用一种改进的基于特征冗余度的信息增益算法对特征项集进行优化,并在此优化结果的基础上,提取出其中的特征冗余度判别函数作为权值引入贝叶斯分类算法中,对不同的条件属性赋予不同的权值。经实验验证,该算法能有效地选择特征向量,降低分类干扰,提高检测精度。

Traditional Naive Bayes classification exists the issues of feature redundancy in intrusion forensics and neglects the difference between data attributes in different intrusion actions. For these issues, an improved Weighted Naive Bayes classification method by setting attribute weights is proposed. A new Information Gain algorithm based on feature redundancy is used to opti- mize the set of feature, then the discriminant of feature redundancy extracted as weights is introduced to Bayes classification algorithm based on this optimization results. The different condition attributes are weighted differently. The experimental results show that the new algorithm can effectively select features, reduce classification interference and improve detection accuracy.