基于核神经气聚类的入侵报警分析  

Analyzing intrusion alerts based on kernel neural-gas clustering

作　　者：肖云[1] 韩崇昭[1] 郑庆华[1] 昝鑫[1] 

机构地区：[1]西安交通大学电子与信息工程学院,陕西西安710049

出　　处：《系统工程与电子技术》2006年第9期1442-1446,共5页Systems Engineering and Electronics

基　　金：国家"973"重点基础研究发展规划项目(2001CB3094);国家"863"高技术研究发展计划项目(2004AA1Z2280)资助课题

摘　　要：利用无监督的核神经气聚类方法分析入侵报警数据,并针对核神经气聚类方法运行时间较长的缺点作了改进,加快了学习过程的速度而不影响其收敛性。利用改进的核神经气聚类方法对真正报警数据进行聚类,获得了各个神经元被作为获胜神经元的次数分布图,并根据此分布图获得报警的判别规则以区分误报警和真报警。实验采用网络入侵检测器Snort在实验环境下获得的攻击和正常数据产生的报警数据集,测试结果证明了提出的方法具有良好的性能:当滑窗长度为10时,在漏报增加率约为6%的代价下可以去除约81%的误报警。The unsupervised kernel neural-gas clustering method is applied to analyze intrusion alerts. The kernel neural-gas clustering method is improved for its high runtime, so the process of learning speeds up while its astringency is not affected. The improved kernel neural-gas clustering method was used to cluster the true alert data, and the frequency distributing figures of each neural as best matching unit are obtained. Based on these figures, the discriminant rules are gained to distinguish false positive alerts from true alerts. The experimental data is the alerts produced by Snort, a kind of network intrusion detection system, monitoring the attack and normal data in experimental environment. The testing results confirm the good performance of the pro posed method： false positive alerts are reduced by 81 %with sliding window of 10, at the cost of false negative alerts increased by 6%.

关 键 词：入侵检测 报警 核神经气聚类 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]