基于模糊核聚类和主动学习的异常检测方法

Anomaly detection method based on fuzzy kernel clustering and active learning

针对日志数据的异常检测获取标记数据代价过高的问题,提出一种基于模糊核聚类与主动学习的算法,即KFCM?AL算法。首先将日志解析,之后利用模糊核聚类算法将待选样本在高维空间进行划分聚类,滤去样本冗余点,同时选取聚类中心进行标记构建初始分类器,最后结合主动学习利用较小的标记代价对异常检测模型进行优化。实验结果表明,所提方法能够利用较少的标记样本获取异常检测模型的性能提升。

In allusion to the problem of high cost of obtaining marking data for anormal detection of log data,an algorithm based on kernel fuzzy C?means and active learning(KFCM?AL)is proposed.The log is parsed,and then the samples under se?lection are classified and clustered in high?dimensional space by means of KFCM algorithm.The redundant points of samples are filtered out,at the same time the clustering center is selected to make marking and build the initial classifier.In combination with active learning,the anomaly detection model is optimized with a smaller marking cost.The experimental results show this method can improve the performance of the anomaly detection model with fewer marking samples.