用决策树改进基于协议分析的入侵检测技术  

The improvement of intrusion detection by using decision tree based on protocol analysis

作　　者：李亮[1] 李汉菊[1] 黎明[1] 

机构地区：[1]华中科技大学计算机科学与技术学院,湖北武汉430074

出　　处：《华中科技大学学报（自然科学版）》2004年第12期37-39,共3页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家网络与信息安全保障持续发展计划资助项目 (2 0 0 4研 1 917 0 2 1);武汉市科学技术局资助项目 (2 0 0 4 30 0 10 32 )

摘　　要：针对传统的基于简单模式匹配的入侵检测技术性能低 ,误报率和漏报率高的问题 ,提出基于决策树算法的协议分析方法 ,描述该算法的定义和实现 ,通过实验与模式匹配作性能比较 .研究结果表明 ,基于决策树算法的协议分析方法根据协议的结构特点准确捕获入侵信号 ,大大提高了入侵检测系统的性能 .Protocol analysis approach was proposed based on decision tree algorithm and its definition and implementation were described. Its capability was compared with pattern matching algorithm according to the experiment. The result shows that protocol analysis approach based on decision tree algorithm captured intrusion signal according to the characteristic of protocol architecture and the performance of intrusion detection system has been improved.

关 键 词：入侵检测系统(IDS) 决策树 协议分析 模式匹配 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]