TCP/IP审计数据缩减技术在入侵检测中的可行性研究  

Research on the Feasibility of TCP/IP Feature Reduction for Intrusion Detection

作　　者：田俊峰[1] 王惠然[1] 傅玥[1] 

机构地区：[1]河北大学网络技术研究所,保定071002

出　　处：《电子与信息学报》2007年第9期2248-2251,共4页Journal of Electronics & Information Technology

基　　金：河北省自然科学基金(F2004000133)资助课题

摘　　要：目前的一些入侵检测系统是利用网络层的TCP/IP数据包里的特征进行分析建模,但TCP/IP的特征属性对检测过程的贡献不同,因而如果能够在不影响检测准确性的前提下,适当缩减特征属性的数量,那么对于提高IDS的检测率和实时性势必产生有益的影响,鉴于此该文提出基于决策树的规则统计方法(DTRS)来缩减TCP/IP的特征属性。它的基本思想是通过在n个子数据集上建立n棵决策树,提取其中的规则,根据特征属性使用频度的不同,计算出相对重要的属性,并通过实验验证了其可行性和有效性。At present some Intrusion Detection Systems （IDS） use the features of TCP/IP data packets for analysis and modeling, but due to the different contribution of TCP/IP features to the detecting process a favorable impact may be made on the promotion of IDS^s detecting rate and real time if the quantity of properties can be reduced properly without affecting the precision of detection. Therefore, a Decision Tree Rule-based Statistical method （DTRS） in light of this is presented to reduce TCP/IP features. Its primary concept is to create n decision trees in n data subsets, extract the rules, work out the relatively important features in accordance with the frequency of use of different features and verify its feasibility and effectiveness through tests.

关 键 词：入侵检测 特征缩减 决策树 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]