基于模糊D-S证据论的入侵检测  

Intrusion detection based on obscure D-S evidence theory

作　　者：张秋余[1] 张启坤 王锐芳[1] 

机构地区：[1]兰州理工大学计算机与通信学院,兰州730050

出　　处：《计算机工程与应用》2007年第22期154-157,共4页Computer Engineering and Applications

基　　金：甘肃省自然科学基金(the Natural Science Foundation of Gansu Province of China under Grant No.ZS021-A25-018-G)。

摘　　要：根据操作系统的工作原理,对计算机执行程序的行为特征进行严密地入侵剖析。运用马尔可夫模型对计算机受到入侵时的状态建立合适粒度的状态知识源,采用模糊D-S证据论方法来融合所建立的状态知识源进行综合评判,解决了入侵检测过程多源数据融合常涉及到非排斥性假设和操作不确定性的数据所造成的误检和漏检率。经过实验分析,该方法有效地降低了误检和漏检率,提高了入侵检测的全面性和准确性。Aiming at the behavior and characteristic of the computer execution of processes,take a rigorous analysis of the computer invaded based on the operation principles of the operating system.This method is to build state knowledge sources of appropriate granularity for the intrusion by using of Markov model and combine the prescriptive state knowledge sources based on the obscure dempster-shafter evidence theory.It can reduce the proportion of mistaken detection and that of missing detection of data of no exclusion hypothesis and undefined operation by the multi-sources data fusion.Through experimental analysis,this method improves the completeness and the accuracy of the invasion detection.

关 键 词：入侵检测 马尔可夫模型 D-S证据理论 数据融合 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]