中文摘要：

提出了一种基于无类标训练数据的异常检测方法（ADUTD），该：于法克服了传统异常检测需要纯净训练数据或有类标训练数据的限制，提高了异常检测的可用性．ADUTD通过过滤掉网络连接记录属性中低频率类型值的方法，过滤掉由训练数据中的攻击记录引入的类型值，并建立正常行为的统计模型．建立模型所使用的属性不仅包括网络连接中数据包的头部字段，也包括应用层的数据．ADUTD另一个特点是按网络连接服务类型划分数据并分别建立统计模型，提高了检测模型的预测能力．用DARPA1999评估数据集所做的实验结果显示，ADUTD能有效检测网络入侵．

英文摘要：

This paper proposed a network connection based anomaly detection approach with unlabeled training data （ADUTD）. It can be considered as an enhancement to traditional anomaly detection methods by building detection models from noisy training data, ADUTD exploits the property that if there are intrusions hidden in training data, they are likely to consist of some kinds of attribute values with low frequency of occurrence. Both fields of packets＇ header and application layer data are used as attributes for building models and detecting intrusions. Furthermore, network traffic is divided into different parts according to their service types, and models are built for each part so as to enhance the ability of detecting attacks. Empirical experiments with DARPA 1999 IDS evaluation data set show that with unlabeled noisy training data, ADUTD has compared performance with previous schemes trained with clean or labeled data, When both trained with clean data, ADUTD has higher detection rate then previous schemes,