基于混沌神经元的延时滥用入侵检测模型  

A Time-Delayed Misuse Intrusion Detection Model Based on Chaotic Neuron

作　　者：姚羽[1] 高福祥[1] 于戈[1] 

机构地区：[1]东北大学信息科学与工程学院,辽宁沈阳110004

出　　处：《电子学报》2004年第8期1370-1373,共4页Acta Electronica Sinica

基　　金：国家自然科学基金 (No .60 1 730 51 ) ;国家教育部博士点基金 (No.2 0 0 30 1 4 50 2 9) ;教育部高等学校优秀青年教师教学和科研奖励基金 ;国家 863项目 (No .2 0 0 3AA41 4 2 1 0 )

摘　　要：在研究混沌神经元延时特性的基础上 ,构建了MLP/CNN混合前馈型神经网络 .提出基于混沌神经元的滥用入侵检测模型 ,它既具备MLP的分类功能 ,又具有混沌神经元的延时、收集和思维判断功能 ,具有灵活的延时分类特性 ,因而能够有效地识别分布式入侵 .使用从网络数据流中获取的样本 ,以FTP口令穷举法入侵为例 ,对该模型进行仿真和整体测试 ,结果表明可以依据实际情况设置入侵判据 ,本文对FTP入侵检测的精确率在 98%以上 ,误报率和漏报率均小于 2 % .该模型可以推广到检测分布式DOS等具有延时特性的攻击行为和具有延时分类要求的其它系统中 .A hybrid MLP/CNN neural network is constructed based on research on time-delayed characteristic of chaotic neuron A misuse detection Model based on chaotic neuron is proposed,which has both the capability of classification which MLP has and the functionality of time-delay,collection and judgment which chaotic neuron has.Because this intrusion detection system has flexible time-delay characteristic,it can identify distributed intrusion effectively.The simulation and test is conducted using samples captured from data traffic.The detection rate of FTP (File Transfer Protocol) brute-force attack is up to 98%.The false alarm and false negative rates are both less than 2%.The model proposed in this paper may be generalized to time-delayed intrusion detection systems such as distributed DOS etc.and other time-delayed classification systems.

关 键 词：滥用入侵检测 MLP/CNN混合神经网络 混沌神经元 延时分类 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]