用扩展巴科斯范式优化决策树协议解码技术  

Optimizing Decision Tree-Based Protocol Decoding with Extended Backus-Naur Form

作　　者：谷勇浩[1] 刘勇[1] 

机构地区：[1]北京邮电大学通信网络综合技术研究所,北京100876

出　　处：《吉林大学学报（信息科学版）》2007年第1期12-17,共6页Journal of Jilin University（Information Science Edition）

基　　金：国家自然科学基金资助项目(60372094)

摘　　要：基于规则的入侵检测系统中存在误报、漏报率高,检测速度慢等问题,为此在协议分析的基础上,提出一种基于决策树的协议解码方法。该方法使用扩展巴科斯范式描述检测规则,给出推理规则的定义;提出构造最优决策树和增量决策树的算法;通过构造基于决策树的入侵检测系统,将该方法与简单模式匹配,与基于动态规则集、基于状态转换两种协议解码方法进行了比较。实验结果表明:基于扩展巴科斯范式的协议解码方法,在误报率方面比其他3种方法分别降低10.08%,0.1%,1.51%;在漏报率方面分别降低15.56%,3.68%,2.86%。Nowadays, intrusion detection system is still facing the problem of high false positive, high false negative and slow detection speed. In order to solve these problems, it gives an inference system using extended Backus-Naur Form to deal with these problems and provides a best decision tree algorithm and an incremental de- cision tree algorithm. The third section constructs DT （Decision Tree） -based Intrusion detection system and compares the improved method with traditional pattern match, dynamic rule sets-based method and state transition-based method. In the final part, it draws a conclusion that intrusion detection performance can be highly im- proved using the optimization decision tree method with the decrease by 10. 08%, 0. 1% and 1.51% respectively for false positive; the decrease by 15.56%, 3.68% and 2. 86% respectively for false negative.

关 键 词：决策树 协议解码 扩展巴科斯范式 最优决策树 增量决策树 

分 类 号：TN945[电子电信—信号与信息处理]