Research On Network Anomaly Detection Based On Projection Pursuit Regression

With the rapid development of modern internet technology, network failure frequency will greatly increase, network anomaly detection is meeting more challenges, and how to detect anomalies timely and accurately and control the spread of anomalies to be a focus of the study.Anomaly detection mainly uninterrupted monitoring operation of network,and alarm when emerge anomalies,not only improves network availability and reliability, is an important basis to set security policy which is set by network administrators. Network anomaly detection based on network flow which shows diversity and mutations, lead to poor real-time, resource consumption, high rate of false positives and false negative in the detection.Paper discusses the network anomaly detection method, established network anomaly detection mechanisms based on Projection Pursuit Regression(PPR) which is divided into training and testing stages. Training phase establish the profile of the normal in the clean network flow data, can catch the exception when the test results beyond the data range or the relative abnormal. The genetic algorithm is used to build a regression function faster in the process of establishing the profile. The basic idea of PP is to project the high-dimensional data to lower-dimensional subspace and use some means to maximize (minimize) the projection index to select the optimal projection direction that can reflect data features by computer technology. The results are objective and little disturbed.Mechanism uses DARPA1999 data set to train and test to receive a number of alarms,achieved a high detection rate and low false alarm rate, especially for anomalies difficult to detect. Experimental results show that PPR is a effective network anomaly detection methods.