基于特征选择的轻量级入侵检测系统  

Lightweight Intrusion Detection System Based on Feature Selection

作　　者：陈友[1,2] 程学旗[1] 李洋[1,2] 戴磊[1,2] 

机构地区：[1]中国科学院计算技术研究所 [2]中国科学院研究生院,北京100049

出　　处：《软件学报》2007年第7期1639-1651,共13页Journal of Software

基　　金：国家重点基础研究发展计划(973)No.2004CB318109;国家242信息安全计划No.2005C39~~

摘　　要：基于特征选择的入侵检测系统处理的数据含有大量的冗余与噪音特征,使得系统耗用的计算资源很大,导致系统训练时间长、实时性差,检测效果不好.特征选择算法能够很好地消除冗余和噪音特征,为了提高入侵检测系统的检测速度和效果,对基于特征选择的入侵检测系统进行研究是必要的.综述了这一领域的研究进展,从过滤器、封装器、混合器3种模式对基于特征选择的轻量级入侵检测系统进行分类比较,分析和总结各种系统的优缺点以及它们各自适用的条件,最后指出入侵检测领域特征选择的发展趋势.特征选择不仅可以提升入侵检测系统的性能,而且使得对入侵检测的研究向特征提取算法的方向转移.The intrusion detection system based on feature selection deals with huge amount of data which contains redundant and noisy features causing slow training and testing process, high resource consumption as well as poor detection rate. Feature selection, therefore, is an important issue in intrusion detection and it can delete redundant and noisy features. In order to improve performances of intrusion detection system in terms of detection speed and detection rate, a survey of intrusion detection system based on feature selection is necessary. This paper introduces the concepts and algorithms of feature selection, surveys the existing lightweight intrusion detection systems based on feature selection algorithms, groups and compares different systems in three broad categories： filter, wrapper, and hybrid. This paper concludes the survey by identifying trends of feature selection research and development in intrusion detection system. Feature selection is not only useful for intrusion detection system, but also helpful to provide a new research direction for intrusion detection system.

关 键 词：特征选择 轻量级入侵检测系统 过滤器 封装器 混合器 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]