基于数据挖掘的入侵防御研究  

Intrusion prevention research based on data mining method

作　　者：潘仰峰[1] 刘渊[1] 

机构地区：[1]江南大学信息工程学院,江苏无锡214122

出　　处：《计算机工程与设计》2007年第1期56-58,共3页Computer Engineering and Design

摘　　要：分析了目前比较热门的入侵防御系统,并指出了其优势和不足。提出了一种基于深度防御原则的网络安全模型,在该模型中采用数据挖掘技术来分析入侵防御系统中的警报。该模型的核心是一个管理着各分支本地安全策略服务器的全局安全策略服务器,其中每一条分支上的本地安全策略服务器又管理一个入侵防御系统。对设计的模型进行了性能分析,结果论证了该模型在提升检测率和误报率方面的可行性和有效性。Firstly, the popularintrusion prevention system is analyzed and its advantages and insufficiencies are pointed. Then a defense in depth network security model is proposed and the data mining technologies is applied to analyze the alerts collected from intrusion pre- vention system. The key component of the model consists of a global policy server to manage the scattered prevention systems, each of which is managed by a local policy servei＇. Finally, analysis results demonstrate that the proposed model performs very well on attack detection rate and false alarm rate.

关 键 词：入侵防御 深度防御 数据挖掘 本地安全策略服务器 全局安全策略服务器 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]