基于已知特征的入侵衍生特征挖掘算法  

Derived Signature Mining Algorithm of Intrusion Based on Known Characteristic

作　　者：牛建强[1] 陈昕[2] 

机构地区：[1]河南科技大学电子信息工程学院,洛阳471039 [2]北京信息工程学院计算机信息系统系,北京100101

出　　处：《计算机工程与应用》2005年第20期127-130,134,共5页Computer Engineering and Applications

基　　金：北京优秀人才培养专项资助项目(编号:20042D0500701)

摘　　要：入侵特征值识别和发现算法是误用入侵检测中的关键技术。入侵衍生特征挖掘提出一种特定的特征值挖掘算法,基于已经知道某种攻击的特征值,找出衍生于这种攻击的变种攻击程序的特征值,并在产生候选项集和数据扫描阶段进行了优化。实验中通过分组数据测试,与通用的SignatureApriori算法进行了对比。实验结果表明,入侵衍生特征挖掘算法在挖掘效率上优于SignatureApriori。The recognition and discovery algoritnms of intrusive signature are the core technologies of misuse intrusion detection.Derived signature mining algorithm provides a new kind of signature mining algorithm.Based on the known characteristic values of certain attacks,the algoritnm can compute and find out the new and mutational signature values from the attack and optimizes the procedure in what candidated itemsets is provided and database is scanned.In the experiment,tested data divided into different groups,which is used to compare the proposed algorithm with Signature Apriori algorithm,which is a general signature mining algorithm in intrusion dtection field.The results of concerned experiments indicates that the derived signature mining algorithm is superior to Signature Apriori algorithm in mining efficiency.

关 键 词：入侵检测 数据挖掘 SIGNATURE APRIORI 

分 类 号：TP301.6[自动化与计算机技术—计算机系统结构]