Combining Visualization And Machine Learning For Network Anomaly Detection

With the development of network technology,people’s study and daily life has brought great convenience.At the same time,in view of the increasingly complex network attack means,network attack software has become increasingly diverse,network security is facing serious challenges.Network anomaly detection technology can detect the abnormal behavior,to protect the security of the network.Machine learning method is the mainstream of the anomaly detection at present stage,the inherent advantages of the method itself are:solid foundation in mathematics;than the people have a relatively fast learning speed;convenience of accumulated knowledge;study result is easy to spread.Based on the above reasons,machine learning techniques in anomaly detection has the congenital advantage.But machine learning are understandability is not strong,the learning cycle is long,large amount of calculation and so on.In this paper,based on the above reasons,we are introduced in this visualization methods and the combination of machine learning,improve the detection efficiency of abnormal behavior.Visualization technology is the following advantages:first is strong comprehensibility,information can be directly to the brain to accept;Second,High speed parallel access to the outside world knowledge;followed by human eyes after level for high-speed processing in the brain,perception for graphics has stronger than the perception of data;Finally it has strong ability of pattern recognition.The disadvantage of visualization technology is the recognition of too much data is easy to cause "overload".Based on the above reasons,this paper combined with machine learning and visualization technology,carry out the network anomaly detection technology research.,the innovation points are as follows:This paper proposes a combination of parallel coordinate system and information gain method of anomaly detection.Parallel coordinates to the high-dimensional data display in the plane,feature selection method based on information gain to select the most valuable characteristics to determine the article number of the longitudinal axis parallel coordinate system,reduce the number of the display shaft,make the sample space said more concise,the visual representation of the sample is more significant.The effectiveness of the proposed method is verified by experiment.This paper proposes a combined with pixel visualization and looking for abnormal important feature of principal component analysis method.Visualization can also put the high-dimensional data display pixels in the plane,principal component analysis can be characteristics of the reorganization,forming features for classification is more valuable,the combination can more effectively show the characteristics of network attack.The effectiveness of the proposed method is verified by experiment.