The invention discloses a method and a
system for intrusion detection based on non-negative matrix factorization under sparse representation. The method includes: acquiring
network data and host data, and obtaining a level-one audit privilege program of original
network data; preprocessing the
network data and the host data, and generating network characteristic data and short-sequence vectors; performing non-negative matrix iterative factorization for a data
test matrix, and performing sparse representation for a basis matrix and a weight matrix; sampling weight matrix data subjected to sparse representation by the aid of a projection matrix so that highly characteristic
weight coefficient vectors are obtained; and matching the highly characteristic
weight coefficient vectors with characteristic vectors in training data by the aid of characteristic vector
library data, and judging whether abnormal characteristics are conformed to or not. The method and the
system for intrusion detection achieve
data dimension reduction by non-negative matrix factorization and uses multi-
divergence as a measurement level, an RIP (
routing information protocol) condition in sparse representation is added into a combined
divergence objective function family to restrain a non-negative matrix factorization iterative process,
data detection dimensionality is lowered, and high-dimensional
mass data processing of the
system for intrusion detection is facilitated.