NIDS警报分析系统模型设计与分析  

Design and analysis of the model of the alarms analysis system in NIDS

作　　者：叶震[1] 钱焜[1] 白永志[1] 

机构地区：[1]合肥工业大学计算机与信息学院,安徽合肥230009

出　　处：《合肥工业大学学报（自然科学版）》2005年第11期1377-1380,共4页Journal of Hefei University of Technology：Natural Science

摘　　要：网络入侵检测系统(N IDS)是一种检测网络入侵行为的工具,但在实际应用中,警报量多、误警率高,已经严重制约了N IDS的发展。文章分析了其产生的原因,提出了一种基于异常检测技术的N IDS警报分析系统模型;重点讨论了数据挖掘技术在该模型中的应用。Nowadays many network intrusion detection systems （NIDSs） employ the misuse detection technology or the anomaly detection technology to detect network data streams and alarm attack attempts. In reality, too many alarms and the high false positive rate have already restricted the development of NIDSs. The causes are analyzed in this paper,and to solve the problems,a model based on anomaly detection is presented for analyzing the alarms in NIDSs. The application of database mining technology to extract the behavior of normal alarms of NIDSs is discussed in detail.

关 键 词：网络入侵检测系统 误警率 数据挖掘 异常检测 入侵警报 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]