基于粗糙集的协作入侵检测系统信息合成方法  

A New Approach Based on Rough Set Theory in Aggregating Alerts of Cooperative Intrusion Detection System

作　　者：刘峰[1] 胡昌振[1] 帅艳民[2] 

机构地区：[1]北京理工大学机电工程学院,北京100081 [2]北京师范大学地理与遥感科学学院,北京100875

出　　处：《计算机工程》2005年第7期27-28,210,共3页Computer Engineering

基　　金：国家"863"计划基金资助项目(2002AA4Z3420)

摘　　要：利用3种轻型检测器检测对系统的攻击,对检测器发出的告警信息在时间和空间两个方向上进行信息合成。由于描述攻击包含许多不确定信息,因此将粗糙集理论应用到告警信息空间方向上的合成。实验表明该方法不仅能降低无用和重复告警信息的发送,而且可以提高检测准确率。In this paper three light-weighted detectors have been developed in order to protect the key host. Alerts from each detector have been aggregated and correlated in the spatio-temporal space. Due to the uncertainty in describing attacks, the rough set theory has been applied into the aggregation of alerts in the spatial space. Experiments show that this way can not only reduce the amount of futile and repetitive alerts but also increase the detection rate.

关 键 词：协作入侵检测系统 粗糙集 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]