基于数据挖掘和本体的实时入侵检测系统  

Data Mining and Ontology Based Intrusion Detection System in Real-time Environment

作　　者：张玉强[1] 

机构地区：[1]江苏科技大学电子信息学院,江苏镇江212003

出　　处：《微计算机信息》2006年第07X期142-144,共3页Control & Automation

基　　金：国家自然科学基金项目(No.60310213)

摘　　要：通过分析现有入侵检测技术,提出了一种建立入侵检测系统的新方法。该方法结合误用检测技术和异常检测技术,利用数据挖掘能高效地从大量的审计数据中挖掘出代表行为特征的频繁模式和本体可以对对象的本质进行描述的特点,并加入相似度以判断是否发生入侵,同时决定是否更新规则本体库。经分析该系统可以有效地提高检测的效率。Through analyzing the current intrusion detection system, this paper presented a new method of building intrusion detection system. Combining the misuse detection and anomaly detection technology, and making use of the characteristics of data mining can dig out the multifarious mode that representing the behavior feature from a flood of audit data efficiently and ontology that can describe the genius of the object, the method adds similarity in order to estimate whether the intrusion occur or not, at the same time, decide whether the pattern ontology base can be update or not. The analyzing shows that this system can improve the efficiency of detection.

关 键 词：数据挖掘 本体 入侵检测 频繁模式增长 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]