Research On Network Evidence Fusion Method Based On Improved DS Evidence Theory

In the era of rapid development of artificial intelligence,the amount of network data has increased dramatically.In the meanwhile,the openness and virtuality of the network provide opportunities for criminals.How to accurately discover illegal data in massive data has become an urgent problem to be solved.Therefore,network forensics has emerged and has developed rapidly.In the forensic process,it mainly involves two steps: the generation of evidence called Basic Probability Assignment(BPA)and the fusion of evidence.There are problems of large amount of information,how to generate BPA and low precision of fusion in the process.A KNN method based on class contribution and feature weighting is used to preprocess to solve the problem of large amount of information.For the latter two problems,a BPA generation method based on Kernel Density Estimation(KDE)is proposed to provide evidences and the improved D-S combination method based on common credibility is used to improve the fusion accuracy.The main content of the paper can be summarized as follows:(1)Propose an improved KNN based on weighted feature and class contribution.The algorithm called DCT-KNN aims at the problem that the KNN algorithm is susceptible to the selection of neighboring point and category decision method.The feature weight is calculated by the accuracy of the presence or absence of the feature.On this basis,the weighted distance and the neighboring points of each class are used to determine the class contribution.The classification of data sets shows the the proposed KNN algorithm that called DCT-KNN works well.(2)Propose a Basic Probability Assignment generation method based on Kernel Density Estimation.In the process of D-S evidence theory applied to information fusion,the generation of BPA is still an important and open issue.The algorithm is based on KDE for BPA generation: by optimizing the bandwidth h in KDE to construct the Kernel density Estimation model of each attribute of training data;based on the probability density,the density-distance-distribution(Tri-D)is calculated.The nested method is used to assign the Tri-D values to obtain BPA.The experimental results prove the effectiveness of algorithm.(3)Propose an improved D-S combination method based on common credibility.Based on the fusion precision and conflict paradox in the D-S evidence theory combination,the algorithm proposes the mutual reliability based on the improved conflict measurement coefficient,credibility and untrustworthiness,and then weights the evidence.The correction of weighted evidences shows that the algorithm improves the convergence speed and the accuracy of the result while avoiding the combination conflict effectively.(4)Fusion analysis of network evidenceThe above three methods are used to complete the application of D-S evidence theory in network evidence fusion.Through preprocessing,generating BPA and fusing evidence,the analysis of network evidence is completed.